Explore cutting-edge technologies in browser fingerprinting, privacy protection, and cybersecurity
A User-Agent string is free text anyone can send. How sites verify a crawler claiming to be Googlebot really is one: DNS, IP ranges, signatures, registries.
performance.now() is deliberately clamped to block Spectre-style timing attacks. How the clamp works, why isolation restores precision, and what it costs.
How sites tell a real handset from a rented Android instance: GPU renderer strings, missing sensors, hardware uniformity, and no web attestation fallback.
navigator.plugins no longer lists real plugins - specs hard-code it now. Here's what an empty array, extra entries, or a pdfViewerEnabled mismatch reveal.
WebGL is not just for cool web effects — it can also be used to track users. Learn how WebGL fingerprinting works and how to defend against it.
Compare VPN, proxy, Tor, and the newer privacy relay category (iCloud Private Relay, Oblivious HTTP) to pick the right tool for your threat model.
Even with a VPN active, WebRTC's ICE and STUN candidate gathering can expose your real public IP. How the leak works, how to test it, and how to fix it.
Canvas fingerprinting draws a hidden image in your browser and turns tiny rendering differences into a stable device ID. How it works and what really stops it.
Explore how websites tell bots and crawlers apart from humans, from WebDriver checks and behavioral analysis to cryptographic Web Bot Auth identity.
Container tabs isolate cookies and site storage, not your device. Here's what gets isolated, what stays identical, and what still tracks you across containers.
EFF's Cover Your Tracks measures how unique your browser looks, not whether it's safe or spoofed. Here's what the score does and doesn't mean.
BrowserLeaks is a suite of separate tests, not one score. Here's what WebRTC, DNS, Canvas, WebGL, fonts and TLS actually expose, and what none of them can see.
Whoer's anonymity percentage blends IP, DNS, WebRTC and timezone checks with unpublished weights — and the company scoring you also sells the fix.
AI agents now browse on a user's behalf with real credentials. How sites are learning to classify that traffic into agents, covert bots, and humans.
What bot.sannysoft.com and CreepJS actually test, how to read a result row, and why passing them isn't proof against a site's real detection stack.
CreepJS doesn't read one spoofed value — it cross-checks trusted and untrusted sources for the inconsistencies most spoofing tools can't fully hide.
A VPN changes your IP, not your browser. Here's exactly why VPNs don't stop fingerprinting, when they can backfire, and what actually reduces your exposure.
HTTPS hides page content, not everything. Learn what your ISP, Wi-Fi operator, or carrier can still see: destination IPs, DNS, SNI, and traffic patterns.
CreepJS, entropy checkers, and vendor anonymity scores can call the same browser three different things, because they measure three different quantities.
Your IP shifts because of DHCP lease renewal, CGNAT sharing, or a new network path — not because something broke. Here's the mechanism behind each cause.
How Accept, Accept-Language, and Accept-Encoding values and order fingerprint a browser before JavaScript runs — and why disabling scripts doesn't stop it.
Spoofing your user-agent can shrink your anonymity set and expose mismatches that make you more identifiable — the entropy paradox, and when spoofing helps.
Cross-site login detection uses timing, error events, and redirects to infer which services you're signed into — how it works and how browsers now block it.
Learn how entropy measures fingerprint uniqueness, how bits sum across signals, and what your anonymity set really means for tracking.
navigator.getBattery() leaked battery level and charge estimates with no prompt. Why Firefox pulled it, WebKit never shipped it, and the lesson for new APIs.
Early IPv6 addresses baked in your network card's MAC address, making devices trackable across networks. Here's how privacy extensions fixed that.
Keyboard layout fingerprinting reads getLayoutMap() to see your physical key layout — a silent, Chromium-only signal that hints at locale and barely changes.
DNS requests can leak the websites you visit. Learn about DNS leak mechanics and how to protect your privacy with DNS over HTTPS.
A browser bundles two separate engines: one renders HTML/CSS, the other runs JavaScript. See how Blink+V8, Gecko+SpiderMonkey, and WebKit+JSCore pair up.
Blocked or CAPTCHA'd without touching a VPN? CGNAT, stale IP data, and ASN misclassification cause false-positive VPN detection — here's why.
Chrome's User-Agent Reduction program froze the UA string's minor version, OS detail, and device model. Here's exactly what changed, why, and what replaced it.
How sites score mouse arcs, keystroke rhythm, and focus changes across a whole session to catch bots that look legitimate at any single checkpoint.
Edge, Brave, Opera, and dozens more all run on Chromium's Blink engine. Here's why the monoculture happened, and what it means for privacy and the web.
Tap a link inside WeChat, TikTok, or Instagram and it opens in a WebView, not your real browser. Here's what that means for privacy, tracking, and detection.
Chromium is the open-source project; Chrome is Google's branded build on top. See what Google adds — and why kernel checks report 'Chromium', not 'Chrome'.
Chrome, Firefox, and Edge on iPhone all render with Apple's WebKit engine, not their own. Here's why — and how a kernel check exposes it.
Fast download number but calls and games stutter under load? Bufferbloat — oversized buffers adding delay, not bandwidth — is usually why, and it's fixable.
navigator.connection leaks effectiveType, downlink, and rtt with no permission prompt, and Chromium-only support is itself a fingerprint signal.
navigator.permissions.query() exposes granted/prompt/denied states across ~15 permissions — a support-and-state fingerprint leaked with no user action.
How motion sensors leak a stable per-device fingerprint via calibration noise, why iOS gates it behind a prompt, and why Chrome on Android still doesn't.
privacy.resistFingerprinting spoofs timezone, screen size, fonts, and canvas — the uniformity defense behind Firefox and Tor Browser.
How device attestation proves a device is genuine with hardware-backed keys: Play Integrity, App Attest, Web Environment Integrity, and the privacy tradeoffs.
Post-quantum key exchange adds a new group to the TLS ClientHello. Here's how ML-KEM and ML-DSA reshape JA3/JA4 fingerprints and what it means for detection.
Do Not Track (DNT) let browsers ask sites not to track you, but adoption collapsed. See how the header worked, why it failed, and how GPC replaced it.
Session replay tools like FullStory and Hotjar record your mouse, keystrokes, and scrolling. See how they work, how to spot them, and how to limit the risk.
CNAME cloaking uses a DNS record to make a third-party tracker look first-party, sidestepping cookie blockers that key off the domain in your address bar.
The HTTP ETag header exists to save bandwidth on cache revalidation — but a unique per-visitor ETag turns your browser cache into a tracking ID.
CSS media queries and @font-face rules can leak dark mode, pointer type, screen resolution, and even installed fonts — without a line of JavaScript.
How HTTP/3 and QUIC fingerprinting works: transport parameters in the QUIC Initial packet, the h3 ALPN signal, and how it differs from HTTP/2 fingerprinting.
Your download speed looks great but calls glitch and games lag? Jitter and packet loss, not bandwidth, are usually why. Here is what causes them.
speechSynthesis.getVoices() exposes your installed text-to-speech voices with no permission prompt — a stable, rarely-blocked fingerprinting signal.
navigator.mediaDevices.enumerateDevices() exposes device counts, IDs, and labels before you ever grant camera or mic access. Here's how trackers use it.
Bounce tracking routes your clicks through a tracker's own domain to plant first-party identifiers, sidestepping third-party cookie blocking entirely.
How sites detect Puppeteer, Playwright, and Selenium through Chrome DevTools Protocol side effects like the Runtime.enable serialization leak.
How anonymous credentials let you prove you're human online without a trackable identity or a fingerprint, and where Mozilla's new PACT proposal fits in.
WebRTC fingerprinting reads your codec list and SDP offer, not your IP. Learn how it works, how it differs from a WebRTC leak, and how to reduce it.
A VPN changes your IP, but not your browser timezone or language. Learn how apps combine these signals to detect your real region — and how to check your own.
Why a fingerprint-based visitor ID survives cookie clears, private mode, and VPNs — and which signals actually make it stick.
A plain-English guide to the User-Agent string: what it looks like, how to read each token, why it still says Mozilla, and how to check yours in seconds.
A neutral, detection-side listicle of the 12 signals — TLS, canvas noise, fonts, UA-CH, and more — that separate a real browser from an anti-detect profile.
Chrome's IP Protection masked your IP from trackers in Incognito via a two-hop proxy — until Google announced its retirement. Here's how it worked.
A step-by-step checklist to audit your own browser fingerprint for UA, timezone, GPU, font, and automation-flag mismatches before a detector does.
How mobile browsers get fingerprinted: device-pixel-ratio, sensors, Android WebView vs iOS Safari quirks, and why phones carry less GPU and font entropy.
getClientRects() and getBoundingClientRect() expose sub-pixel layout differences that fingerprint your device — without ever touching a canvas.
GPU renderer strings, OS builds, and fonts have to agree. Learn which combinations are physically impossible — and why they instantly flag spoofed profiles.
Private windows don't just hide history — they change how storage APIs behave, and that difference is exactly what sites use to detect Incognito mode.
Your browser's timezone and language settings can contradict your IP's location. Here's how the mismatch happens, and how sites use it to flag VPNs.
How User-Agent Client Hints (UA-CH) work: low- and high-entropy hint tiers, Accept-CH header negotiation, and what the API means for browser fingerprinting.
WebGPU exposes adapter name, vendor, and architecture without any debug extension. Learn how it creates a new fingerprinting surface and what defenses exist.
Canvas fingerprint noise backfires unless done carefully. Learn why naive randomization is detectable and how Brave's farbling avoids the trap.
Learn how sites detect Selenium, Puppeteer, and Playwright via navigator.webdriver, CDP artifacts, missing features, and rendering tells.
How TCP/IP fingerprinting works: how TTL, window size, MSS, and TCP option order reveal your OS from the handshake — and how p0f and JA4T read them.
Learn how HTTP/2 fingerprinting works: SETTINGS frames, pseudo-header order, and how the Akamai fingerprint complements JA3/JA4 to detect bots.
Learn how websites detect anti-detect browsers and fingerprint spoofing — from canvas noise patterns to GPU renderer mismatches and JS engine tells.
Learn why mismatched browser signals — a spoofed UA that contradicts your GPU, timezone, or locale — trigger fraud and bot detection systems.
Learn how TLS fingerprinting works, how JA3 and JA4 expose bots and intercepting proxies at the network layer, and how to test your own TLS handshake.
Audio fingerprinting identifies your device via the Web Audio API — no microphone needed. Learn how AudioContext fingerprints work and how to defend.
Changing your user-agent rarely fools anyone. Learn how sites detect spoofing via header order, client hints, JS engine probes, and fingerprint mismatches.
Font fingerprinting identifies you by the fonts installed on your device. Learn how font enumeration and measurement work — and how to reduce what you expose.
Websites detect VPNs and proxies via IP blocklists, geo mismatches, and packet inspection. Learn the main methods — and why you hit blocks and CAPTCHAs.
HTTP vs SOCKS, residential vs datacenter — proxy types differ in how they route traffic and how easily they're detected. A clear guide to which is which.
What is a browser engine, and how do Blink, Gecko, and WebKit differ? See which engine your browser really uses — and why the user-agent can lie about it.
Your speed test shows download, ping, and jitter — what do they mean? Learn bandwidth vs latency vs jitter and what good values look like.
Speed test numbers jumping around? Here's why results vary by server, time, device, and tool — plus how to get a reliable baseline you can actually trust.
Your IP address can reveal your approximate location. This article analyzes IP geolocation accuracy and how to protect your location privacy.
Browser extensions may have access to all your web data. Learn how to evaluate extension safety and protect your browsing privacy.
