What websites can see about you
This page shows you the same data every website receives the moment you open it — before you click anything or accept anything. Each item says what it reveals and what you can do about it. Everything is computed in your browser; nothing is stored.
Everything below was read from this one request and from your browser's own APIs. Header values are shown back to you and discarded; script-readable values never leave your browser.
1 item marked as revealing more than most people expect
Network: what the server sees before any content loads
Identifies your connection, not you: provider and rough area. Changes when you switch networks or use a VPN.
City-level at best, from the network's registration and routing data; never a street. A VPN shows the server's city instead.
The operator announcing your address. Hosting or VPN networks get more captchas than home providers.
Home, mobile, business, hosting, VPN, proxy or Tor, from published lists and the ASN.
Mostly harmless; HTTP/3 and HTTP/2 support hints at a modern client.
The TLS handshake identifies the browser family from the server side (JA3/JA4-style fingerprints) — extensions cannot change it.
Latency to the nearest Cloudflare edge; combined with the location it narrows down the distance.
Request headers: sent by your browser with every request
Browser, major version, OS. Chromium browsers send a reduced string; the details move to client hints.
Your preferred languages. One of the strongest hints about where you live, and a classic VPN giveaway when it disagrees with the IP's country.
Supported content types and compression; low information but part of every fingerprint.
The page you came from (trimmed to the origin by the default referrer policy on cross-site navigations).
Legacy signal; most sites ignore it, and sending it makes your browser slightly more unusual.
A legally meaningful opt-out in some US states and under some regulators. Only a few browsers send it.
Brand list and major version, mobile flag and platform. Sent with every request by Chromium browsers.
Whether the request is a navigation, same-site or cross-site. Used for security more than tracking.
Sent when data-saver mode is on; also a hint about the device and network.
Browser and device: readable by any script on the page
Parsed from client hints or the user agent.
Parsed from client hints or the user agent.
Exact browser build, platform version, architecture and (Android) device model: returned only when a script asks and the browser agrees. We ask once, here, to show you.
Physical screen size. Unusual sizes narrow you down fast.
Window size changes often, so trackers prefer the screen size.
Retina/HiDPI and color depth; mostly identifies the device class.
The same list as Accept-Language, readable by script.
Readable by every script; a mismatch with your IP's time zone is the most common way VPN users stand out.
Logical CPU cores. Firefox and Tor Browser cap or spoof this value.
Rounded device RAM (Chromium only); Firefox and Safari do not expose it.
Touch support separates phones and tablets from desktops.
Coarse OS family; Chromium freezes it to a few values.
Modern browsers expose only a built-in PDF viewer entry, so this reveals little today.
Whether first-party cookies can be set at all.
The same signal as the DNT header, read by script.
The same signal as Sec-GPC, read by script.
Chromium exposes the effective connection type and a latency/bandwidth estimate; Firefox and Safari do not.
Dark mode and reduced-motion preferences, readable through media queries.
True when the browser is driven by automation software; sites use it for bot detection.
What the previous page left behind for scripts; empty when the referrer policy strips it.
Graphics and fonts: readable by script, used for fingerprinting
Often names your GPU model and driver: one of the highest-entropy values on desktops. Firefox and Brave blank or randomise it.
A hash of a small image your browser rendered; differs by GPU, drivers and fonts. Stable across visits unless the browser randomises it.
Detected by measuring text width against a list of common fonts; the set reflects your OS and installed software.
Not visible without your permission
We do not read it. Firefox and Safari removed the Battery API; Chromium still exposes level and charging state to scripts.
GPS-grade location needs an explicit permission prompt; without it a site only has the IP estimate above.
Capture devices and screen sharing require a permission prompt every time.
Reading the clipboard requires a user gesture and permission; writing to it is allowed on click.
Cross-site history is not readable; only cookies and storage that each site set for itself.
A site sees only the files you explicitly choose or drop onto it.
Your live report
The report updates as the page loads: network data comes from the connection itself, browser and device data from what your browser announces. Values that reveal more than most people expect are marked.
Network data
What the server sees before your browser sends a single byte of page content.
IP address and location
Your public address and the city-level area it is associated with. Reveals your provider and rough location; does not reveal your name or street. See IP location finder.
ISP and network type
The operator announcing your address and whether it is a home, mobile, business or hosting network. Sites use this to decide whether you look like a person or a server; a hosting or VPN range gets more captchas. See what is my ISP.
Browser and device data
What your browser volunteers in every request and through JavaScript.
User agent and client hints
The User-Agent header and, in Chromium browsers, the Client Hints that replace it: browser brand and major version, operating system, device model on Android, architecture and bitness on request. Decoded on the user agent page.
Screen, language and time zone
Screen size and pixel ratio, the languages you accept and your device's time zone. Individually harmless, together they narrow you down — and a time zone that does not match your address's location is the most common way VPN users stand out. See screen resolution and your time zone.
WebRTC and DNS
Whether WebRTC exposes a second public address and which resolvers answer your DNS queries. Both can undo a VPN; see the WebRTC leak test and DNS leak test.
Cookies, Do Not Track and GPC
Whether cookies are enabled, whether the browser sends the Do Not Track header (ignored by most sites) and whether it sends the Global Privacy Control signal (legally meaningful in some US states). We show the values; we do not set anything to read them.
Why it matters
None of these values identifies you on its own. Combined, they let a site recognize you when you come back without a cookie, estimate where you are, tell whether you are on a VPN and decide how much to trust you. Advertising networks and fraud systems use exactly this list. Knowing what is visible lets you decide what to change — and lets you stop worrying about the things that are not visible, such as your name, your email or your browsing history on other sites.
How to reveal less
Use a VPN that passes the VPN test to replace the address and location; match the device time zone to the VPN location; restrict WebRTC; block third-party cookies and enable your browser's tracking protection; keep the browser updated so it sends the reduced user agent; and do not install more extensions than you need — each one changes your fingerprint. The privacy score turns the list into a number you can improve.
Frequently asked questions
How do you know if a website is tracking you?
You cannot see tracking directly, but you can see its inputs: this page shows what a site can read, your browser's privacy or tracker-blocking panel shows which third-party requests a page makes, and a cookie inspector shows what was stored. Persistent identifiers in cookies or storage, and third-party requests to known ad or analytics domains, are the signs.
Which browser is considered the worst for privacy?
Rankings change with every release and depend on settings more than on brands. Any current browser with tracking protection enabled, third-party cookies blocked and WebRTC restricted reveals little more than the items on this page. Run the browser fingerprint test in the browser you use to see where it stands.
Is it a good idea to remove all website data?
It is harmless and resets everything a site stored about you in that browser — cookies, local storage, cached identifiers. You will be logged out everywhere and sites will ask for consent again. Do it when you want a clean start; it does not change your IP address or your fingerprint.
Can internet providers see search history?
Your provider sees which servers you connect to and, unless you use encrypted DNS or a VPN, every domain you look up — but not the content of HTTPS pages or the exact search terms inside them. A search engine's domain is visible; the query is not. Encrypted DNS hides the domains from the provider; a VPN hides everything but the fact that you use a VPN.
Server-side values come from this request (Cloudflare edge metadata and your headers); script-readable values from your browser. Nothing is stored; nothing is sent to third parties.