I Scanned My Own Browser and It Knew Way Too Much

I built a tool that runs about two dozen fingerprinting and data collection techniques against your browser. Then I pointed it at myself. The results were... not great.
You can try it yourself at benploni.com/aboutyou. Fair warning: you might not love what you find.

What the Tool Actually Does

The "About You" page runs a series of client-side checks - no server needed, everything happens in your browser. Each one extracts a different piece of information that websites can (and do) use to identify and track you. I built it to make abstract privacy threats concrete, because telling someone "canvas fingerprinting exists" means nothing until you show them their unique fingerprint.

Here's what it checks and what I found when I ran it on my own setup.

Canvas Fingerprinting

This one's the classic. Your browser draws an invisible image using the Canvas API, and the exact pixel output varies based on your GPU, drivers, OS, font rendering, and anti-aliasing. The result is a hash that's surprisingly unique.

const canvas = document.createElement('canvas')
const ctx = canvas.getContext('2d')
ctx.textBaseline = 'top'
ctx.font = '14px Arial'
ctx.fillText('fingerprint test', 2, 2)
// The toDataURL output differs per machine
const hash = canvas.toDataURL()

My hash was stable across browser restarts, private windows, and even after clearing all cookies. That's the whole point - it survives the stuff people think protects them.

WebRTC IP Leak

This is the fun one. WebRTC - the thing that makes video calls work in your browser - can expose your local and public IP addresses even if you're behind a VPN. It does this through STUN server requests that bypass the browser's normal proxy settings.

const pc = new RTCPeerConnection({
  iceServers: [{ urls: 'stun:stun.l.google.com:19302' }]
})
pc.createDataChannel('')
pc.createOffer().then(offer => pc.setLocalDescription(offer))
pc.onicecandidate = (event) => {
  if (event.candidate) {
    // This string contains your IP address
    const candidate = event.candidate.candidate
  }
}

When I ran this with my VPN on, it still leaked my local network IP. Not my public IP (the VPN caught that), but enough to fingerprint my network topology. Most people don't realize WebRTC even exists, let alone that it's chatting up STUN servers behind their back.\

Audio Context Fingerprinting

This one's sneaky. The AudioContext API processes a silent audio signal, and the output varies based on your audio hardware and driver stack. No sound plays - it's completely invisible.

The fingerprint comes from how your system processes the audio signal at a mathematical level. Different hardware, different drivers, different OS audio subsystems all produce subtly different results. It's another stable identifier that persists across sessions.

My audio fingerprint matched across Firefox and Chrome on the same machine. Different browser, same hardware, same fingerprint. Not ideal.

WebGL Renderer Info

const gl = canvas.getContext('webgl')
const debugInfo = gl.getExtension('WEBGL_debug_renderer_info')
const renderer = gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL)
// Returns something like "ANGLE (NVIDIA GeForce GTX 1070)"

Combined with your screen resolution and color depth, this narrows you down to a pretty small group. My setup - GTX 1070, triple monitors with a portrait display - is not exactly common. That combination alone is probably close to unique.

Social Login Detection

Websites can detect which services you're logged into by attempting to load authenticated resources. If the resource loads, you're logged in. If it fails, you're not.

The technique exploits how browsers handle authenticated image requests and redirects. It doesn't get your credentials - just a yes/no for each service. But knowing that someone is simultaneously logged into Google, GitHub, and Reddit tells you a lot about them.

I was logged into... more things than I expected. Each logged-in service is another data point that narrows your identity.

Installed Fonts

By measuring how your browser renders text in different fonts, sites can figure out which fonts you have installed. The technique creates invisible text elements and measures their dimensions - if the font exists on your system, the dimensions will differ from the fallback.

System-default fonts are boring. But developer fonts (JetBrains Mono, Fira Code), design fonts (Helvetica Neue on macOS), and language-specific fonts all leak information about who you are and what you do.

The Combined Picture

Any single technique is interesting but maybe not devastating. The problem is the combination. When you stack canvas + audio + WebGL + fonts + screen config + installed plugins + timezone + language preferences, the intersection is usually a set of one: you.

I ran the full suite against my own browser and the combination of results was almost certainly unique across the entire internet. Not "one in a million" unique, more like "one in one" unique.

What Actually Helps

After building this thing and seeing my own results, here's what I found actually makes a difference:

Firefox with privacy.resistFingerprinting - This is the nuclear option. It lies about your timezone, screen size, fonts, and a bunch of other things. Breaks some sites but significantly reduces fingerprint uniqueness.

Tor Browser - Designed specifically to make all users look identical. If you need actual anonymity, this is the real answer. Everything else is a half-measure.

Brave's fingerprinting protection - Randomizes canvas and audio fingerprints per-session. Decent middle ground between usability and privacy.

uBlock Origin - Blocks the tracking scripts before they run. Doesn't help against first-party fingerprinting, but most fingerprinting in practice comes from third-party scripts.

What doesn't help as much as people think: clearing cookies, private browsing mode, most VPNs (on their own), and "privacy-focused" browser extensions that don't actually address fingerprinting.

Why I Built This

I got tired of the privacy conversation being abstract. "Companies track you" is too vague to act on. But showing someone their canvas fingerprint, their leaked local IP, and their unique font list - that lands differently.

The whole thing runs client-side. I don't collect or store any of the data. That would kind of defeat the purpose.

Try it at benploni.com/aboutyou and see what your browser is telling every website you visit.





\