Browser privacy test
What any website can learn about this browser without asking: your IP address and VPN status, whether WebRTC leaks another address, your browser fingerprint (canvas, WebGL, audio and fonts), and the privacy signals and storage it allows. Each item says why it matters and how to reduce it.
By using these tools you accept the Terms and the Privacy page.
How the browser privacy test works
The test starts as soon as the page loads and takes a second or two, up to about four when WebRTC is blocked. It reads what any page can read without asking for permission, runs the same fingerprinting tricks trackers use, and explains each result with a tip on how to reduce it. Use Run again after changing a setting, and Copy report, Text file or JSON to keep the result; all three are made on your device.
What the test checks
- IP address and location: your address, network and approximate location, and whether it’s a known VPN, proxy, Tor exit or iCloud Private Relay address, from the same check as What’s my IP. Your browser’s time zone is compared with the address’s, which is how sites spot a VPN.
- WebRTC leak: whether WebRTC reveals a public address other than your connection’s, or your local network address.
- Browser identity: the user agent, User-Agent Client Hints (the detailed ones only if the browser hands them out), languages, locale and platform. The user agent and first language in the headers this site’s server received are compared with what scripts read; a mismatch usually means an extension changes one of them.
- Screen and device: screen, window, pixel density, color depth, display and accessibility preferences, processor threads, memory, touch, the number of cameras and microphones (without a permission prompt), battery and network information if the browser exposes them.
- Fingerprints: canvas, WebGL and audio hashes, and which of 58 common fonts are visible.
- Storage and tracking signals: cookies, site storage, the storage quota, your browser’s default for third-party cookies, Global Privacy Control, Do Not Track, the referrer this page received, a content-blocker hint and the TLS version of the connection.
How the fingerprint tests work
The canvas test draws text, an emoji and overlapping shapes, reads the pixels back twice and hashes them with SHA-256 in your browser. It also paints a small pattern of solid rectangles whose exact colours are known: an honest browser returns them unchanged, so any change means the browser adds noise. Two different reads mean noise that changes every time; a blank image means reads are blocked.
The WebGL test reads the graphics vendor and renderer (the unmasked names only if the browser exposes them), hashes the main limits and extensions, and hashes a small WebGL drawing. The audio test renders a short tone through a compressor offline, so nothing plays, twice. The font test measures a sample text in each font against the browser’s default faces. These run one at a time after the page has appeared, in idle moments, so the page stays responsive.
How the summary level works
The level comes from fixed rules, not from a score against other visitors.
- Exposed: WebRTC shows a public address that differs from your connection’s.
- Very identifiable: the canvas and audio results aren’t randomized or blocked, and no VPN, proxy, relay or Tor hides your address.
- Identifiable: the same, but a VPN, proxy, relay or Tor hides your address.
- Partly protected: some results are randomized or blocked, or the browser resists fingerprinting but your address is visible or your time zone gives the VPN away.
- Well protected: the browser resists fingerprinting (timers rounded to 1/60 s, or standard screen values together with altered canvas reads), your address is hidden and the time zones agree.
What it can’t see
Content blockers that only block requests to ad servers can’t be detected without contacting one, and this page contacts none; it only sees blockers that hide page elements. Third-party cookies can’t be tested without loading another site, so the page shows your browser’s documented default. A fingerprint recognizes a browser; it doesn’t reveal your accounts, which strong, unique passwords from the password generator protect. For your connection speed, run the speed test.
Updated · Maintained by Liviu Tanase
Questions
What does my browser reveal to websites?
Without asking, any site can see your IP address and with it your provider and rough location, your browser and operating system, your languages and time zone, your screen, processor threads and touch support, how your device draws text, graphics and sound (a fingerprint), which common fonts you have, and whether cookies and storage are allowed. Some browsers also expose your battery level, connection speed and detailed client hints. This page runs those same checks on your browser and shows the results.
What is a browser fingerprint, and can this test say how unique mine is?
A fingerprint is the combination of values a site can read or measure, such as the exact pixels your device produces when it draws a test image. If those values stay the same, a site can recognize the browser on later visits even after you clear cookies. This test shows whether yours are stable or randomized, but it gives no uniqueness percentage or “1 in N” figure: that would need a database of other visitors’ fingerprints, and tanase.ai keeps none. The summary level comes from fixed rules instead.
Am I being tracked?
This page can’t see what other sites do; it shows what they could use. Trackers combine cookies set by embedded content with your IP address and a fingerprint. If the summary says your browser is easy to recognize and your IP is visible, a site can recognize you across visits. A VPN or Tor hides the address (check it on What’s my IP), and a browser that randomizes or standardizes its fingerprint makes recognition much harder.
How can I reduce my browser fingerprint?
Use a browser that randomizes or standardizes it: Brave randomizes canvas, WebGL and audio by default; Firefox adds canvas noise and hides extra fonts in private windows, and can do so in all windows; Safari’s advanced tracking and fingerprinting protection adds noise and reports standard screen values; Tor Browser makes all its users look alike. Keep extensions to a few well-known ones, keep the browser up to date, fix any WebRTC leak, and pick a VPN server in your own time zone.
What does this page send, and what stays in my browser?
Two requests go to this site: the same address, network and VPN lookup What’s my IP uses, and one that echoes back the Do Not Track, Global Privacy Control, language and client-hint headers your browser sent. tanase.ai doesn’t store or cache your address or these headers; like every request to the site, both appear in Cloudflare’s request logs with your IP address (see the privacy page). The WebRTC test contacts Cloudflare’s STUN server. The fingerprint, font, screen and storage checks run in your browser (the test cookie and storage entries are removed at once) and are never sent anywhere.
Do Do Not Track and Global Privacy Control stop tracking?
They are requests, not blocks. Do Not Track is deprecated and most sites ignore it. Global Privacy Control asks sites not to sell or share your data, and California’s privacy law requires covered businesses to honor it; DuckDuckGo’s browser sends it by default, and Firefox and Brave support it. This page shows both what scripts read and the headers this site’s server received.