Log in

your connection🇺🇸United StatesAMAZON-02

Reading 55 checks on this browser

Nothing here needs a click.

One thing at a time

Each of these runs on its own, without the full check.

Connection fingerprintJA4, the HTTP/2 profile and the raw header order: everything your browser sends before a line of JavaScript runs.WebRTC leakWhich addresses a peer connection reveals. Obfuscated local names are the protection, not the leak.DNS leakWhich resolvers actually look up a name for you, measured with a one-time label so nothing can be cached.Time zoneNot just the name: the offset at two dates of the year, because a name without its daylight-saving rule was set from outside.Client hintsThe high-entropy values on three paths at once (JavaScript, HTTP headers and the handshake) and whether they agree.Your networkCountry, operator and network type from local copies of free datasets. No lookup leaves this server.Measure a browser you are not sitting atFor a headless run on another machine: open a one-time address with your own automation and read the report here.

Three checks we deliberately do not run

  • Port scanning your machine. An open port is not a program. One widely used checking page probes local ports over WebRTC to guess at installed software and reported Docker on port 3001 as a competing anti-detect browser. We do not guess at what is on your machine.
  • Detecting your extensions. It works, and that is the problem: it makes users of assistive technology remotely identifiable. Having extensions also speaks for a human rather than against one.
  • Detecting a private window. Every reliable method has been closed. What is left produces false results often enough that showing it would be worse than saying nothing.

Where the numbers come from

Every reading is shown next to a control value, what a stock browser reports in the same place, with its source, the date it was taken and the date it expires. Browser references age: the handshake fingerprint and the client hints move roughly with every major release, the HTTP/2 profile survives several. When a control expires, its group drops out of the count and says so. That is our gap, not yours.

The whole set is machine-readable at /check/controls.json, and the contract this page counts under is chk-2. When the groups or the control values change, that version rises and a changelog appears. Comparing two results across a version boundary compares two different rules.

Rarity figures from testing pages like this one are self-selected and run high. One study of two million visitors to an ordinary website found 33.6 % of fingerprints unique on desktop and 18.5 % on mobile, against over 80 % in studies that measured visitors to testing pages. Being rare is a privacy property, not a fault: screen readers, specialist hardware and older devices all make people rare, entirely legitimately.

A corporate proxy, an antivirus with HTTPS inspection or a CDN terminates the connection and opens its own. When that happens, the first layer describes that software and not your browser. An ordinary VPN does not change it, only your address.

One warning worth more than any number here: changing single values makes things worse. A user agent edited by hand, a spoofed time zone or a blocked canvas produces a rarer and more contradictory combination than the one you started with. That is what this page counts, and it is what detection systems count too.

What is kept

The measurement runs in your browser and the result is assembled there. Nothing is stored unless you tick one of the three boxes before starting, and if you tick none, you still get the complete measurement and the complete result. Ticking a box is what sends the values to our server, which hashes each of them with a secret key and discards the originals. A key kept in your browser would sit in the shipped code, and the hash could be reversed; that is why the raw values travel and not the hashes.

A stored measurement expires after 90 days and a return visit extends it. The rarity counters carry no link back to anyone and stay. A shared result link expires, carries noindex and can be revoked from the page it lives on.

The connection layer is the one exception, and it always has been: it cannot be measured from inside your browser. Your browser opens a connection to a measurement host, that host reads the handshake and hands the result back once. The reading is held in memory only and discarded when it is collected.

We keep no access log. The server in front of this site is not configured to write one, so there is no running record of which address asked for which page. What it does write are fault diagnostics, and a connection that breaks can carry the address it broke from. Those files are rotated and then deleted seven days later, by a job that runs every night. Legal basis: our legitimate interest in a working service, Art. 6(1)(f) GDPR. The same basis covers the measurement itself and the counts kept from it, neither of which carries your address, a cookie or any identifier of you. You can object at any time; the full record is in our privacy policy.

Run by Scalebrowser. This tool measures your browser, nothing else. It makes no claim about ours. scalebrowser.net