The promise
Every tool here runs in your browser or against this site's own server. Nothing about you is logged or stored. There is no access log recording your IP, no database row with your name on it, no fingerprint kept on our side. Each tool has a "what leaves your browser" box telling you exactly what it sends and why.
For running costs we keep one thing: anonymous aggregate counters, for example "the password tool ran 412 times today". These are counts of events, never people. No IP, no user agent, no fingerprint, and none of the passwords, emails, or email headers you type. There is no per-visitor record because none is ever written. It is the honest version of analytics, and you can confirm all of it by reading the source.
One tool keeps a little more, and only because the data is already public: the security-headers scanner shows a public board of recently and most-checked domains. A website's response headers are public to anyone, so this stores just the domain, its grade, and how many times it was scanned. It is never linked to whoever ran the scan, paths and query strings are stripped, and scans of raw IP addresses are kept off the board.
How each tool works
- /ip
- Your request reaches our server, as every web request must. We read the IP and headers, look up the ISP, ASN and location against a database stored on this box (no third-party lookup), and return it. Nothing is stored.
- /dns
- Your browser resolves a set of unique hostnames under our domain. Our own name server records which resolver asked, so we can show you which DNS provider your traffic really uses. The record is held in memory only and expires within minutes.
- /webrtc
- The passive test reads only the candidates your browser generates locally and sends nothing. The opt-in full test uses our own STUN server (never a third party) to discover your public address over WebRTC, then compares it to your normal IP. Neither is stored.
- /fingerprint
- Everything is read and hashed in your browser. The fingerprint and the signal values never leave your device. The per-signal entropy figures are estimates from published research (below), not a live population measurement.
- /password
- Strength is analysed entirely in your browser. For the breach check, your password is hashed with SHA-1 in your browser and only the first five characters of that hash are sent, using the k-anonymity model, to be forwarded to the Have I Been Pwned range API. The password and full hash never leave your device.
- /scan and /email
- The header scanner fetches a URL you provide from our server and grades the response headers. The email analyzer parses headers you paste entirely in your browser, uploading nothing.
Where the numbers come from
Fingerprint entropy estimates are drawn from the studies below (Eckersley 2010, AmIUnique 2016) and are labelled as estimates because true uniqueness depends on the population you are measured against. For a dataset-backed measurement, use EFF Cover Your Tracks or amiunique.org.
IP geolocation and ASN data are from DB-IP Lite, licensed CC-BY 4.0. Location is city-level at best and often wrong by a city or two.
The evidence
Browser fingerprinting has been measured, peer-reviewed, and found in the wild for over fifteen years. These are the studies the field is built on. All are free to read.
The founding study. Collected 470,161 fingerprints and found 83.6% were unique, 94.2% when Flash or Java was present. The fingerprint carried about 18.1 bits of entropy: roughly 1 in 286,777 others share a given fingerprint.
The first proof that canvas fingerprinting was already deployed in the wild: over 5% of the top 100,000 websites were running it, mostly through a handful of third-party scripts. Also documented "evercookies" that respawn after deletion.
Princeton crawled the top one million sites and measured tracking as it actually exists, including the first documentation of audio fingerprinting. The takeaway: fingerprinting is infrastructure, concentrated in a few third-party companies across the web.
Re-ran the uniqueness question with 118,934 fingerprints: 89.4% unique. The attributes had shifted, but the conclusion held. Their site still runs a live dataset you can test against.
On a general-audience French site of 2 million visitors, only 33.6% were unique. Uniqueness depends on the crowd. But commercial fingerprinters combine fingerprints with IP, behaviour and time. Fingerprinting is weaker than the scariest headline and stronger than the most comfortable one.
What the law says
Last updated: July 2026 · reviewed manually, not auto-generated
There is no US federal privacy law. What exists is a patchwork:
As of 2026, twenty states have comprehensive privacy laws in effect. Twelve require businesses to honor Global Privacy Control, a browser signal that opts you out of data sales automatically. None meaningfully stop fingerprinting itself; they regulate what companies do with the data after collecting it.
Unusually broad: no revenue threshold. Requires opt-in consent for sensitive data and has honored GPC since January 2025. Texas won a $1.4 billion settlement from Meta and $1.375 billion from Google, and filed the first lawsuit under a state privacy law against Allstate. Catch: no private right of action, only the state AG can sue.
The reason cookie banners exist. Under GDPR, a fingerprint that can single you out is personal data. In practice enforcement has focused on cookies, which is why fingerprinting persists as the quieter workaround.
The pattern across all of it: the law regulates the visible tracking. The passive layer this site demonstrates, the data your browser volunteers before any consent question, is largely still the wild west.
What actually works
In rough order of effect: Tor Browser makes everyone's fingerprint look identical, the strongest defence and the least convenient. Brave randomizes fingerprint values per site. Firefox with resistFingerprinting uses uniform values at some usability cost. Blocking third-party scripts (uBlock Origin) stops most fingerprinting code from loading. Enabling Global Privacy Control gives you the legal opt-out in the states that must honor it. A VPN, on its own, changes your IP and nothing else on the fingerprint page.