BrowserLeaks is a suite of separate tests, not one score. Here's what WebRTC, DNS, Canvas, WebGL, fonts and TLS actually expose, and what none of them can see.
Search "browserleaks" and you'll land on a page of individual test tiles — IP, WebRTC, Canvas, WebGL, fonts, TLS — each one opening into its own report. First-time visitors often expect a single number, the way a credit score or a trust rating works, and come away confused when there isn't one. That confusion isn't a design flaw. It's the correct response to a genuinely different kind of tool: a probe suite where every test measures one surface of your browser in isolation, and none of them is trying to summarize the others.
Key Takeaways
- BrowserLeaks-style suites run one independent test per surface — IP/WebRTC, DNS, Canvas, WebGL, fonts, TLS — there is no single combined score to chase.
- Each test answers "what is exposed here," not "how identifiable does this make me overall." Those are different questions with different answers.
- A clean result on every individual test does not mean you're hard to track — it means none of the surfaces tested leaked something unexpected on their own.
- The structural blind spot of any browser-side test: nothing running inside your browser can compare your timezone or language against the IP address a server actually saw your connection arrive from.
- Reading results test-by-test is the right approach; ranking or scoring the suite as a whole imports a precision it was never built to provide.
A Suite of Tests, Not a Score
The reason BrowserLeaks-style tools feel disjointed next to a vendor anonymity score is that they're solving a different problem. A composite score compresses many signals into one number a vendor has chosen how to weight. A test suite does the opposite: it keeps every surface separate on purpose, because a webcam-permission leak, a stale DNS resolver, and a distinctive canvas hash are three unrelated failure modes with three different fixes. Collapsing them into one grade would hide which one actually matters to you.
That means reading a suite's output well is less about the topline result and more about walking each panel and asking two questions: what does this specific test expose, and does it matter for what I'm trying to protect? The next section walks the major panels in that order.
What Each Panel Actually Exposes
IP and WebRTC. The WebRTC panel checks whether your browser's real-time communication stack — built for peer-to-peer video and voice — leaks your real public IP address even when a VPN is active. WebRTC negotiates connections using the ICE framework, which gathers every network path your device can be reached on, including ones your VPN doesn't route through, and can hand that list to any page that asks. A WebRTC leak defeats the entire point of a VPN for the one thing people usually run it for: hiding their IP. WebRTC Leak Protection: A Must for VPN Users covers exactly how the leak happens and how to close it without breaking video calls.
DNS. The DNS panel checks which resolver actually handled your domain lookups — your VPN's encrypted resolver, or your ISP's, leaking every hostname you visit outside the tunnel you thought was protecting you. This test exists because a VPN can quietly fail to redirect DNS even while it correctly routes your other traffic, and the failure is invisible unless something specifically checks for it. DNS Leak Prevention: Hide Your Browsing Footprint explains the mechanics and how DNS over HTTPS closes the gap.
Canvas. The canvas panel draws hidden text and shapes to an off-screen Canvas element and hashes the resulting pixels — a value that differs subtly by GPU, driver, OS, and font engine, and stays stable across visits without needing a cookie. This test tells you whether that hash is being generated and how stable it looks across reloads; it says nothing on its own about how common or rare your particular hash is among other visitors. Canvas Fingerprint Detection: How Websites Identify Your Device goes into how the pixels diverge and why some popular defenses backfire.
WebGL. The WebGL panel queries your graphics hardware directly — GPU vendor and renderer strings, supported extensions, numeric limits — and can also render a 3D scene and hash the output the same way canvas does. It's checking whether that hardware fingerprint is exposed and how much detail it contains, not whether the exposure is dangerous by itself. WebGL Fingerprint Deep Dive: How Your GPU Reveals Your Identity has the full mechanics.
Fonts. The font panel enumerates or measures which fonts are installed on your system, one of the more distinctive signals a stock browser exposes simply by having a particular OS, language pack, and set of installed applications. It reports what's detectable, not how much it narrows you down against everyone else. Font Fingerprinting: How Installed Fonts Expose You covers enumeration versus measurement and why the two techniques leak different amounts.
TLS and the network layer. The TLS panel looks one level below anything JavaScript can see: the exact order and content of the cipher suites, extensions, and elliptic curves your TLS client offers during the handshake, summarized into a JA3/JA4-style hash. This is the one panel that isn't reading browser APIs at all — it's reading how your TLS stack negotiates a connection, which is why it can tell a real browser apart from a scripted HTTP client even if every other signal is spoofed correctly. TLS Fingerprinting Explained: How JA3/JA4 Identify Your Client breaks down what the handshake actually contains.
Exposure Is Not the Same Question as Uniqueness
Every panel above answers "is this signal exposed, and what does it contain." None of them answers "how identifiable does the combination of all these signals make me." Those are genuinely different questions, and conflating them is the single most common misreading of a leak-test suite: a clean WebRTC panel and a clean DNS panel don't tell you anything about whether your canvas-plus-fonts-plus-WebGL combination is, taken together, rare enough to track you across sessions without any cookie at all.
Browser Fingerprint Entropy and Anonymity Sets Explained covers how individual signals combine into a single uniqueness figure — the calculation a per-surface suite deliberately doesn't attempt. And if you've compared a leak-test suite's output against a vendor's anonymity percentage and found them hard to reconcile, that's expected rather than a sign one of them is wrong: Why Fingerprint Test Tools Disagree About You walks through why exposure checks, uniqueness scores, and coherence checks are three different measurements wearing the word "score."
The Blind Spot Every Browser-Side Suite Shares
Every panel discussed so far runs entirely inside your browser, reading what JavaScript (or, for TLS, the client stack) can see from the inside. That gives all of them the same structural limit: nothing running in your browser knows where your network connection actually terminated on the other end. Intl.DateTimeFormat().resolvedOptions().timeZone reports what your browser is configured to say, not the route your packets took or the IP a server watched the connection arrive from.
Comparing your browser's claimed timezone and language against your IP's actual geolocation catches a specific, common failure: a VPN that changes your visible IP but leaves your system clock and locale untouched, producing a browser that looks coherent internally while contradicting where it claims to be. Timezone and Locale Leaks: When Your Browser Contradicts Your IP covers exactly how that mismatch happens and how detection systems use it. Closing it requires a server that observed your connection arrive, which sits outside every test that only reads browser attributes — no amount of adding more browser-side panels to a suite will surface it.
Reading Your Own Results
None of this is a case against running a leak-test suite — walking each panel independently is genuinely the right way to find a specific, fixable exposure, like a WebRTC leak your VPN missed or a DNS resolver that's bypassing your tunnel. The mistake is expecting the set of panels to add up to one verdict about how trackable or safe you are overall.
If what you actually want is that combined view — your signals checked together for internal consistency, plus the network-side comparison a browser-only suite structurally can't make — run BrowserInsight's fingerprint check alongside the VPN and proxy check. Between them they cover the same underlying surfaces (canvas, WebGL, fonts, TLS on the fingerprint side; WebRTC and DNS on the VPN side) and add the timezone-versus-IP comparison, presented as consistency verdicts rather than a set of isolated panels. If you only want the network half, the IP address check shows the geolocation, ISP, and ASN a server sees for your connection.
Frequently Asked Questions
Does a clean result on every BrowserLeaks-style test mean I'm anonymous?
No. Each test only reports whether its own specific surface is exposed — a clean WebRTC and DNS result says your VPN isn't leaking on those two channels. It says nothing about whether your canvas, WebGL, and font combination is rare enough, taken together, to track you across visits without a cookie. That's a separate uniqueness question, covered in Browser Fingerprint Entropy and Anonymity Sets Explained.
Why doesn't BrowserLeaks give one overall score like some other tools do?
Because a per-surface suite is built to isolate and diagnose one leak at a time, not to summarize them. A combined score requires choosing weights for how much each signal matters, which is a vendor's judgment call rather than a measurement — see Why Fingerprint Test Tools Disagree About You for how that judgment call varies between vendors.
Which single test matters most if I only have time to check one thing?
It depends on what you're protecting. If you're relying on a VPN to hide your IP, the WebRTC and DNS panels catch the two most common ways a VPN leaks despite otherwise working correctly. If you're worried about being tracked across sites without cookies, canvas, WebGL, and font tests matter more than either of those.
Can a browser-based test suite ever catch a VPN with a mismatched timezone?
Not on its own. That comparison needs a server-side observation of the IP your connection actually arrived from, matched against what your browser reports for timezone and locale — something no page running purely in your browser can see. Tools that combine a browser check with a server-side IP lookup, such as a dedicated VPN and proxy check, can make that comparison; a browser-only leak suite structurally cannot.
Recommended Reading
- WebRTC Leak Protection: A Must for VPN Users
- DNS Leak Prevention: Hide Your Browsing Footprint
- Canvas Fingerprint Detection: How Websites Identify Your Device
- WebGL Fingerprint Deep Dive: How Your GPU Reveals Your Identity
- TLS Fingerprinting Explained: How JA3/JA4 Identify Your Client
- Browser Fingerprint Entropy and Anonymity Sets Explained
- Timezone and Locale Leaks: When Your Browser Contradicts Your IP
- Why Fingerprint Test Tools Disagree About You
