014/SNITCH

Everything your browser gives away · runs client-side
About
scanning…

Reading what a data broker script would make of you…

Why this matters

Every website you open is handed most of what you see below, automatically, the moment the page loads. You did not agree to it. No prompt, no banner, no "we value your privacy" box to close. It just happens, the way a room knows when someone walks in. On their own these details are dull: your screen is a certain width, your machine has a certain number of cores, your clock is set to a certain time zone, and nobody cares about any one of them. Put together, they are a fingerprint, and not as a figure of speech. It is a combination specific enough to pick your browser out of hundreds of millions, and to keep recognising it on the next site you open, and the one after that, with no cookie, no account, and nothing you are able to clear.

This is not a corner case that worries security researchers. It is how a large slice of the web pays its bills. Ad networks use it to follow you around; data brokers collect those trails, join them together, and sell the result to advertisers, insurers, political campaigns, and roughly anyone with a form of payment; some shops use it to quietly show you a higher price. A good deal of what is sold as "anonymous analytics" is exactly this, in a nicer outfit. And the habits most people trust do very little to stop it: clearing your cookies changes nothing, because no cookie is involved; a private window forgets your history, not your fingerprint; a VPN swaps your IP address and your apparent city, which is worth doing, and leaves the other forty-odd signals exactly where they were. There is even an irritating twist, where piling on privacy add-ons and flipping every switch tends to make you easier to identify rather than harder, because now you are the one person online with that precise unusual setup. Fingerprinting rewards looking like everyone else.

The word you will be offered for all of this is anonymous. In the narrow sense that your name is not literally stapled to it, fine, but a profile that consistently lands on one real person does not need a name to decide which ads you see, which price you are quoted, or what a background-check company believes about you. SNITCH does one thing: it runs the same reads a tracker would run, and shows you the answers instead of sending them anywhere. Nothing here is uploaded, logged, or stored, and there is no analytics on the analytics. Think of it as the itemised receipt every other website quietly forgets to hand you.

How easy you are to spot estimating… working it out
Read without asking things this page just learned about you
All of it weighs a tracker ships that before the page finishes loading

The "1 in N" above is a rough ceiling from a few signals, weighted by hand, not a live count. For an actual measurement of how identifiable your browser is, run EFF's Cover Your Tracks.

Global position
awaiting fix
Activity log
0 events
Network
public
resolving…
address class
resolving…
global address
resolving…
reverse dns pointer
resolving…
autonomous system
resolving…
network operator
-
navigator.connection
estimated throughput
-
connection rtt
probing…
local network exposure
Location
ip-derived
resolving…
locality
resolving…
state / province
resolving…
iso code
resolving…
approximate
resolving…
latitude, longitude
resolving…
iana zone
-
browser clock vs IP
-
language region vs IP
not requested
click to compare with GPS
resolving…
local currency
resolving…
your local sky, from your IP alone
Device
-
version
-
architecture
-
client hint
-
input capability
-
logical cores
-
reported lower bound
-
charge state
-
performance.memory
Display
-
reported resolution
-
minus system chrome
-
live inner window
-
device / css px
-
bits · gamut
-
sdr / hdr
-
screen.orientation
measuring…
measured, 60 frames
-
prefers-reduced-motion
-
prefers-color-scheme
Browser
-
version
-
layout engine
-
Accept-Language order
-
dnt · gpc
-
navigator.cookieEnabled
testing…
bait .ads div visibility
-
navigator.pdfViewerEnabled
-
ontouchstart present
-
navigator.userAgent
GPU
webgl
-
unmasked vendor
-
unmasked renderer
-
shading language
-
MAX_TEXTURE_SIZE
Fingerprint
deterministic
computing…
fnv-1a of all signals
computing…
2d text + shape render
computing…
params + extensions
computing…
offline oscillator sum
computing…
from 34-font probe
computing…
libm transcendental hash
Capabilities
querying…
Permissions API state
-
count by kind
-
StorageManager estimate
-
feature detection
-
feature detection
-
currently connected
Session
-
-
--:--:--
timezone
-
minutes from UTC
00:00:00
since page load
-
document.referrer
-
entries this tab
-
navigation duration
-
document.visibilityState
checking…
localStorage compare
What actually helps
roughly in order of effect

You cannot switch fingerprinting off, but you can go from trivial to follow to genuinely expensive. That is the realistic goal, and it does not take much.

  1. Change your browser first. This is the single biggest move. The Tor Browser makes almost everyone on it look identical; Mullvad Browser is the same engineering without routing through the Tor network. On plain Firefox, turning on privacy.resistFingerprinting (or running the Arkenfox user.js) fakes a common screen size, timezone and canvas. Any one of these does more than the rest of this list combined.
  2. Block the scripts, not just the ads. Install uBlock Origin and leave it on defaults. It stops most trackers before they get to read anything, which is the only move that helps on a browser you are not willing to replace.
  3. Close the side doors. WebRTC can leak your real local and public IP even through a VPN; disable it (media.peerconnection.enabled set to false in Firefox, or uBlock Origin's Prevent WebRTC from leaking local IP toggle). Deny location, camera, mic and notifications by default and grant them per-site when you actually mean to.
  4. Treat a VPN as one layer. It rewrites your IP address and the city it maps to, which is worth having, but it leaves the forty-odd other signals on this page untouched. Useful, not a solution.
  5. Resist the urge to over-tune. Every exotic extension, custom font and niche setting is one more thing that makes you the only person with that exact combination. If you are not going to commit to a hardened browser, plain and boring beats half-configured.