Inspect the browser signals, hardware hints, media capabilities, and storage features exposed to any website without asking permission. Audit your browser surface locally and compute a snapshot hash.
The local scan reads browser APIs inside this tab only — no request leaves your device and no third-party script is loaded for it. The server-side check further down is the single opt-in step, and it states its cost before it runs. Every value carries its source, accuracy and privacy class.
{{ scanError }}
Probing runtime capabilities, hardware metrics, WebGL GPU context, media codecs, font detection heuristics, and storage APIs…
{{ sec.hint }}
probably and maybe are the browser's own words — maybe means it will not commit until it sees the file. mse-only means the video element refused the type but Media Source Extensions accepted it.
| Codec / format | MIME tested | Playback support | Status |
|---|---|---|---|
| {{ p.key.replace('media.', '').toUpperCase() }} | {{ p.source }} | {{ p.value }} | {{ p.status }} |
Each family is measured against three generic fonts with two different text samples. A family that matches on one sample but not the other is reported as inconclusive instead of guessed — that is usually what anti-fingerprinting protection looks like. This tests a fixed list of {{ fontSummary.total }} families; it is never the full set of installed fonts.
Canvas and audio rendering hashes are the probes trackers actually use. They run locally with the rest of the scan — nothing is transmitted — and they never enter the snapshot hash, because a browser that randomizes them would change your hash on every visit. Each scene is rendered twice: two different hashes mean the browser is adding noise on purpose, which is more useful than either hash alone.
JavaScript sees what the browser chooses to expose. A server sees the request itself: your IP, the raw User-Agent, Client Hints and every other header. Comparing the two is how a spoofed browser gives itself away.
This is the only part of the page that touches a network. Running it loads Cloudflare Turnstile from challenges.cloudflare.com and then posts to /php/tools/network-inspect.php. The endpoint keeps nothing from the request; the only thing written to disk is a rate-limit counter keyed by a hash of your IP.
{{ serverError }}
| Signal | Seen by JavaScript | Seen by the server | Match |
|---|---|---|---|
| {{ row.label }} | {{ row.client || '—' }} | {{ row.server || '—' }} | {{ row.match }} |
No Sec-CH-UA Client Hints were transmitted in this request.
| Header name | Received value |
|---|---|
{{ h }} | {{ val }} |
These signals sit behind a permission prompt. This tool never asks for them, so no prompt appears at any point — including on re-scan.
Deterministic SHA-256 over the canonical JSON of {{ digestProbeCount }} stable local probes. Values that move on their own — viewport, zoom, orientation, connection estimates, storage tests, fonts and the canvas/audio hashes — are excluded, so re-scanning in the same browser reproduces the same hash. It identifies this configuration, not this machine.
Web Crypto is unavailable — the digest needs a secure context (HTTPS or localhost).
Import a snapshot exported earlier — from a private window, another browser, or this browser last month — to see what actually changed. Both sides are sanitized before the comparison, so the two files are always compared like for like.
{{ importError }}
That snapshot uses a different schema version and cannot be compared with this one.
Nothing changed between the two snapshots.
| Probe key | Change | Previous | Current |
|---|---|---|---|
{{ d.key }} | {{ d.status }} {{ d.oldStatus }} → {{ d.newStatus }} | {{ formatValue(d.oldValue) }} | {{ formatValue(d.newValue) }} |
{{ displayedJson }}What this does. Inspects the browser APIs, hardware parameters, WebGL capabilities, media codecs, font detection heuristics, and storage features currently exposed to websites. It computes a deterministic SHA-256 snapshot hash so you can tell whether a settings change actually altered your browser surface.
Privacy model. The local scan runs entirely in this tab and loads no third-party script — the canvas and audio probes included, since their results are computed and displayed locally and never transmitted. The storage section performs real write tests: one temporary key per storage API, removed again in the same call. Only the server-side header check leaves the browser, and only when you press its button; that endpoint keeps nothing from the request, and its rate-limit counter is keyed by a hash of your IP.
Local scan results never leave this tab — no telemetry, no analytics on collected values, and nothing left in storage beyond the temporary probes described above.
