Explore cutting-edge technologies in browser fingerprinting, privacy protection, and cybersecurity
iCloud Private Relay splits your traffic across two hops so no one sees both who you are and where you go. Here's what it covers, and what sites still see.
Wi-Fi connected, status page green, yet pages crawl? Reachability and performance are different things. Here is how to tell which one is failing.
Nothing replaced Chrome's Topics API. See how it worked, why it was retired, and what interest-based ad targeting falls back on today.
How Encrypted Client Hello (RFC 9849) works: outer vs inner ClientHello, the DNS key, what your ISP and the CDN still see, and how to check your connection.
Some VPN slowdown is normal. Learn the four causes — distance, tunnel overhead, encryption and server load — and how to measure your own loss.
A full-page block means a filter in one of your lists matched the page's own address, so your blocker stopped it before connecting. Here's how to read it.
A page can't ask if you run an ad blocker - it checks the outcome: a hidden bait ad, a blocked request, or a missing ad-script global.
Browser extensions may have access to all your web data. Learn how to evaluate extension safety and protect your browsing privacy.
What navigator.hardwareConcurrency and navigator.deviceMemory report, how coarse they are, and why they help sites spot an implausible device claim.
How sites tell V8, SpiderMonkey and JavaScriptCore apart: stack traces, error text, toString output and Math precision, and what the signal can prove.
A browser can't send raw pings, so speed tests time HTTP transfers instead. See how warm-up, payload sizing, streams and medians shape the number you get.
navigator.audioSession lets a page declare its audio type and see an interrupted state. What that reveals about your device, and where the limits are.
A browser engine turns HTML and CSS into the page you see. Blink runs Chrome and Edge, Gecko runs Firefox, WebKit runs Safari and every iOS browser.
Your speed test shows download, ping, and jitter — what do they mean? Learn bandwidth vs latency vs jitter and what good values look like.
TLS session tickets speed up reconnects, but a ticket the server issues and you replay is also a linkable ID — no cookie, no JavaScript, no storage API.
Speed test numbers jumping around? Here's why results vary by server, time, device, and tool — plus how to get a reliable baseline you can actually trust.
An extension rarely gets you flagged by existing. It does when it changes what a page can measure and your browser stops agreeing with itself.
AmIUnique is an academic fingerprinting research site. Learn what its uniqueness result measures, how its dataset skews it, and what it can't tell you.
A site shows the wrong city for your IP? Find which layer is wrong, send provider corrections, publish a geofeed, and know which cases you can't fix.
WebDriver BiDi is the W3C standard that lets Puppeteer and others automate Chrome and Firefox. What it changes for bot detection, and what stays visible.
Two zero-permission WebAuthn checks that gate passkey logins also reveal device class, OS floor, and browser engine — a weak but telling fingerprint signal.
How Safari's ITP works, one mechanism at a time: tracker classification, the 7-day storage cap, cookie blocking, referrer trimming, and what it can't stop.
Storage partitioning keys browser state by the embedded site and the top-level page, so one widget on two sites gets two separate storage buckets.
Why is your upload speed always so much lower than download? It's built into cable, DSL, and wireless — not your plan. Here's what that costs you.
How honeypot form fields, trap links, and timing checks catch naive bots without touching real visitors, and why autofill is the usual cause of false positives.
Yes — Tor exit IPs come from a public relay list, so sites match them instantly. See how detection works at the IP and browser layers, and what bridges hide.
Which image and video formats your browser can decode leaks its engine, version and even GPU. How Accept, canPlayType and decodingInfo differ.
Your IP address can reveal your approximate location. This article analyzes IP geolocation accuracy and how to protect your location privacy.
Cloudflare's “checking your browser” page runs API, quirk and proof-of-work tests on top of TLS and IP reputation. Here's why real visitors get stuck in a loop.
FingerprintJS is an open-source library, separate from the paid Fingerprint product. What it collects, how accurate it is, and how it differs from CreepJS.
JA4H, JA4T, and JA4L extend TLS fingerprinting to HTTP requests, TCP handshakes, and latency. Here's how each works and why mismatches matter.
A public web page can quietly probe 127.0.0.1 and your router, timing the replies to map what's running on your network. Here's what stops it now.
Your device often has both an IPv4 and an IPv6 address. Here's how a website ends up seeing one or the other — and why it can differ visit to visit.
A frozen User-Agent string can lie about your browser version. Here's how feature-detection probes bracket your real engine milestone instead.
A User-Agent string is free text anyone can send. How sites verify a crawler claiming to be Googlebot really is one: DNS, IP ranges, signatures, registries.
performance.now() is deliberately clamped to block Spectre-style timing attacks. How the clamp works, why isolation restores precision, and what it costs.
How sites tell a real handset from a rented Android instance: GPU renderer strings, missing sensors, hardware uniformity, and no web attestation fallback.
navigator.plugins no longer lists real plugins - specs hard-code it now. Here's what an empty array, extra entries, or a pdfViewerEnabled mismatch reveal.
WebGL is not just for cool web effects — it can also be used to track users. Learn how WebGL fingerprinting works and how to defend against it.
Compare VPN, proxy, Tor, and the newer privacy relay category (iCloud Private Relay, Oblivious HTTP) to pick the right tool for your threat model.
Even with a VPN active, WebRTC's ICE and STUN candidate gathering can expose your real public IP. How the leak works, how to test it, and how to fix it.
Canvas fingerprinting draws a hidden image in your browser and turns tiny rendering differences into a stable device ID. How it works and what really stops it.
Explore how websites tell bots and crawlers apart from humans, from WebDriver checks and behavioral analysis to cryptographic Web Bot Auth identity.
Container tabs isolate cookies and site storage, not your device. Here's what gets isolated, what stays identical, and what still tracks you across containers.
EFF's Cover Your Tracks measures how unique your browser looks, not whether it's safe or spoofed. Here's what the score does and doesn't mean.
BrowserLeaks is a suite of separate tests, not one score. Here's what WebRTC, DNS, Canvas, WebGL, fonts and TLS actually expose, and what none of them can see.
Whoer's anonymity percentage blends IP, DNS, WebRTC and timezone checks with unpublished weights — and the company scoring you also sells the fix.
AI agents now browse on a user's behalf with real credentials. How sites are learning to classify that traffic into agents, covert bots, and humans.
What bot.sannysoft.com and CreepJS actually test, how to read a result row, and why passing them isn't proof against a site's real detection stack.
CreepJS doesn't read one spoofed value — it cross-checks trusted and untrusted sources for the inconsistencies most spoofing tools can't fully hide.
A VPN changes your IP, not your browser. Here's exactly why VPNs don't stop fingerprinting, when they can backfire, and what actually reduces your exposure.
HTTPS hides page content, not everything. Learn what your ISP, Wi-Fi operator, or carrier can still see: destination IPs, DNS, SNI, and traffic patterns.
CreepJS, entropy checkers, and vendor anonymity scores can call the same browser three different things, because they measure three different quantities.
Your IP shifts because of DHCP lease renewal, CGNAT sharing, or a new network path — not because something broke. Here's the mechanism behind each cause.
How Accept, Accept-Language, and Accept-Encoding values and order fingerprint a browser before JavaScript runs — and why disabling scripts doesn't stop it.
Spoofing your user-agent can shrink your anonymity set and expose mismatches that make you more identifiable — the entropy paradox, and when spoofing helps.
Cross-site login detection uses timing, error events, and redirects to infer which services you're signed into — how it works and how browsers now block it.
Learn how entropy measures fingerprint uniqueness, how bits sum across signals, and what your anonymity set really means for tracking.
navigator.getBattery() leaked battery level and charge estimates with no prompt. Why Firefox pulled it, WebKit never shipped it, and the lesson for new APIs.
Early IPv6 addresses baked in your network card's MAC address, making devices trackable across networks. Here's how privacy extensions fixed that.
Keyboard layout fingerprinting reads getLayoutMap() to see your physical key layout — a silent, Chromium-only signal that hints at locale and barely changes.
DNS requests can leak the websites you visit. Learn about DNS leak mechanics and how to protect your privacy with DNS over HTTPS.
A browser bundles two separate engines: one renders HTML/CSS, the other runs JavaScript. See how Blink+V8, Gecko+SpiderMonkey, and WebKit+JSCore pair up.
Blocked or CAPTCHA'd without touching a VPN? CGNAT, stale IP data, and ASN misclassification cause false-positive VPN detection — here's why.
Chrome's User-Agent Reduction program froze the UA string's minor version, OS detail, and device model. Here's exactly what changed, why, and what replaced it.
How sites score mouse arcs, keystroke rhythm, and focus changes across a whole session to catch bots that look legitimate at any single checkpoint.
Edge, Brave, Opera, and dozens more all run on Chromium's Blink engine. Here's why the monoculture happened, and what it means for privacy and the web.
Tap a link inside WeChat, TikTok, or Instagram and it opens in a WebView, not your real browser. Here's what that means for privacy, tracking, and detection.
Chromium is the open-source project; Chrome is Google's branded build on top. See what Google adds — and why kernel checks report 'Chromium', not 'Chrome'.
Chrome, Firefox, and Edge on iPhone all render with Apple's WebKit engine, not their own. Here's why — and how a kernel check exposes it.
Fast download number but calls and games stutter under load? Bufferbloat — oversized buffers adding delay, not bandwidth — is usually why, and it's fixable.
navigator.connection leaks effectiveType, downlink, and rtt with no permission prompt, and Chromium-only support is itself a fingerprint signal.
navigator.permissions.query() exposes granted/prompt/denied states across ~15 permissions — a support-and-state fingerprint leaked with no user action.
How motion sensors leak a stable per-device fingerprint via calibration noise, why iOS gates it behind a prompt, and why Chrome on Android still doesn't.
privacy.resistFingerprinting spoofs timezone, screen size, fonts, and canvas — the uniformity defense behind Firefox and Tor Browser.
How device attestation proves a device is genuine with hardware-backed keys: Play Integrity, App Attest, Web Environment Integrity, and the privacy tradeoffs.
Post-quantum key exchange adds a new group to the TLS ClientHello. Here's how ML-KEM and ML-DSA reshape JA3/JA4 fingerprints and what it means for detection.
Do Not Track (DNT) let browsers ask sites not to track you, but adoption collapsed. See how the header worked, why it failed, and how GPC replaced it.
Session replay tools like FullStory and Hotjar record your mouse, keystrokes, and scrolling. See how they work, how to spot them, and how to limit the risk.
CNAME cloaking uses a DNS record to make a third-party tracker look first-party, sidestepping cookie blockers that key off the domain in your address bar.
The HTTP ETag header exists to save bandwidth on cache revalidation — but a unique per-visitor ETag turns your browser cache into a tracking ID.
CSS media queries and @font-face rules can leak dark mode, pointer type, screen resolution, and even installed fonts — without a line of JavaScript.
How HTTP/3 and QUIC fingerprinting works: transport parameters in the QUIC Initial packet, the h3 ALPN signal, and how it differs from HTTP/2 fingerprinting.
Your download speed looks great but calls glitch and games lag? Jitter and packet loss, not bandwidth, are usually why. Here is what causes them.
speechSynthesis.getVoices() exposes your installed text-to-speech voices with no permission prompt — a stable, rarely-blocked fingerprinting signal.
navigator.mediaDevices.enumerateDevices() exposes device counts, IDs, and labels before you ever grant camera or mic access. Here's how trackers use it.
Bounce tracking routes your clicks through a tracker's own domain to plant first-party identifiers, sidestepping third-party cookie blocking entirely.
How sites detect Puppeteer, Playwright, and Selenium through Chrome DevTools Protocol side effects like the Runtime.enable serialization leak.
How anonymous credentials let you prove you're human online without a trackable identity or a fingerprint, and where Mozilla's new PACT proposal fits in.
WebRTC fingerprinting reads your codec list and SDP offer, not your IP. Learn how it works, how it differs from a WebRTC leak, and how to reduce it.
A VPN changes your IP, but not your browser timezone or language. Learn how apps combine these signals to detect your real region — and how to check your own.
Why a fingerprint-based visitor ID survives cookie clears, private mode, and VPNs — and which signals actually make it stick.
A plain-English guide to the User-Agent string: what it looks like, how to read each token, why it still says Mozilla, and how to check yours in seconds.
A neutral, detection-side listicle of the 12 signals — TLS, canvas noise, fonts, UA-CH, and more — that separate a real browser from an anti-detect profile.
Chrome's IP Protection masked your IP from trackers in Incognito via a two-hop proxy — until Google announced its retirement. Here's how it worked.
A step-by-step checklist to audit your own browser fingerprint for UA, timezone, GPU, font, and automation-flag mismatches before a detector does.
How mobile browsers get fingerprinted: device-pixel-ratio, sensors, Android WebView vs iOS Safari quirks, and why phones carry less GPU and font entropy.
getClientRects() and getBoundingClientRect() expose sub-pixel layout differences that fingerprint your device — without ever touching a canvas.
GPU renderer strings, OS builds, and fonts have to agree. Learn which combinations are physically impossible — and why they instantly flag spoofed profiles.
Private windows don't just hide history — they change how storage APIs behave, and that difference is exactly what sites use to detect Incognito mode.
Your browser's timezone and language settings can contradict your IP's location. Here's how the mismatch happens, and how sites use it to flag VPNs.
How User-Agent Client Hints (UA-CH) work: low- and high-entropy hint tiers, Accept-CH header negotiation, and what the API means for browser fingerprinting.
WebGPU exposes adapter name, vendor, and architecture without any debug extension. Learn how it creates a new fingerprinting surface and what defenses exist.
Canvas fingerprint noise backfires unless done carefully. Learn why naive randomization is detectable and how Brave's farbling avoids the trap.
Learn how sites detect Selenium, Puppeteer, and Playwright via navigator.webdriver, CDP artifacts, missing features, and rendering tells.
How TCP/IP fingerprinting works: how TTL, window size, MSS, and TCP option order reveal your OS from the handshake — and how p0f and JA4T read them.
Learn how HTTP/2 fingerprinting works: SETTINGS frames, pseudo-header order, and how the Akamai fingerprint complements JA3/JA4 to detect bots.
Learn how websites detect anti-detect browsers and fingerprint spoofing — from canvas noise patterns to GPU renderer mismatches and JS engine tells.
Learn why mismatched browser signals — a spoofed UA that contradicts your GPU, timezone, or locale — trigger fraud and bot detection systems.
Learn how TLS fingerprinting works, how JA3 and JA4 expose bots and intercepting proxies at the network layer, and how to test your own TLS handshake.
Audio fingerprinting identifies your device via the Web Audio API — no microphone needed. Learn how AudioContext fingerprints work and how to defend.
Changing your user-agent rarely fools anyone. Learn how sites detect spoofing via header order, client hints, JS engine probes, and fingerprint mismatches.
Font fingerprinting identifies you by the fonts installed on your device. Learn how font enumeration and measurement work — and how to reduce what you expose.
Websites detect VPNs and proxies via IP blocklists, geo mismatches, and packet inspection. Learn the main methods — and why you hit blocks and CAPTCHAs.
HTTP vs SOCKS, residential vs datacenter — proxy types differ in how they route traffic and how easily they're detected. A clear guide to which is which.
