Unasked

Nothing leaves your device unless you ask

The file your browser keeps on you

You told this page
nothing.
It read this anyway.

No clicks, no permission prompts, no cookies. Every line below was read from your browser as the page opened, the way any website can read it. Then it watches what you do.

Nothing leaves your device. No server, no analytics, no third-party code. One button, further down, makes a single request if you press it. Nothing else ever does. Check it yourself

    07Live

    What you are doing right now

    Everything above is what you have. This is what you do. A page receives every movement of your pointer, every scroll, every key, every time you look away. Recording scripts send it home. This one only shows you.

    Your pointer, since you arrivedwaiting for you to move

    08Only if you ask

    The one thing I cannot read

    Your address on the internet. Every site you visit sees it, and from it your town and your provider. I cannot, because this page has no server. To show you, I would have to ask one for you.

    Press the button and this page makes one request to ipinfo.io, a company that looks up addresses. It will see your address, as any site does, and nothing from this file. The answer is shown here and kept nowhere. Do not press it and nothing is ever sent.

    Requests to anyone but this site, so far

    0

    09The sum of it

    No single line names you. Together they might.

    Millions of people share your time zone. Millions share your screen. A fingerprint asks for everything at once, and each answer splits the crowd again, until the group giving all the same answers as you is very small.

        holds still between visits changes by the minute your browser refused

        Next time

        How distinctive is it? I cannot say.

        To tell you that you are one in so many, I would need everybody else's answers to set beside yours, and that means collecting them. This page collects nothing, so it has no crowd to measure you against. A page that does give you a number has sent your answers to a server that holds other people's.

        Two measurements that were made with consent: in 2010, 83.6% of 470,161 browsers tested by the EFF had a fingerprint no other browser shared. In 2018, among 2,067,942 visitors to one large French website, 33.6% did. The answer depends on the crowd and on the questions asked.

        What can be said: bits.

        An answer that half of all browsers give is worth one bit: it halves the crowd. An answer one browser in a thousand gives is worth about ten. When answers are unrelated their bits add up, and 33 are enough to tell apart everyone alive.

        Real answers overlap. A phone's screen predicts its processor, a language predicts a time zone. So the true total is less than the sum, and only a real crowd can measure it.

        33 yes-or-no answers tell apart 8,589,934,592 people. There are about 8.2 billion of us.

        10What you can do

        Be one of many.

        1. Turn on the protection your browser has.

          Most current browsers have a setting against fingerprinting, often under privacy or tracking. It works in one of two ways: by giving every user the same answers, or by adding a little noise to each. Every line above marked "kept back" is that protection working.

        2. Block the scripts that ask.

          Fingerprinting and session recording are done by code, and most of it comes from a small number of third parties. Tracker blocking stops that code before it runs, which beats disguising the answers afterwards.

        3. Customise less than you would like.

          Extra fonts, unusual settings and rare extensions each split you from the crowd. The same holds for privacy tweaks that few people use. Defaults are a disguise.

        4. Keep separate things in separate browsers.

          A fingerprint links what one browser does. A second browser, or a second profile on a second device, has a different one. Use that for the parts of your life you want kept apart.

        5. Stay up to date.

          Browsers keep closing these windows: frozen labels, rounded numbers, trimmed lists, removed APIs. Several lines of this file were more revealing a few years ago. Updates carry that work.

        6. Know what the usual tools do not do.

          A private window forgets cookies and history but answers these questions the same way. A VPN hides your address and nothing else on this page. Clearing cookies does not change a fingerprint.

        11The promise, and how to check it

        Nothing left your device.

        Everything above was worked out by your own browser and shown only to you. There is no server behind this page, no analytics, no fonts or scripts from anyone else. You do not have to take my word for it.

        1. Watch the network. Open your browser's developer tools, choose Network and reload. You will see this page's own files arrive, then nothing, however long you stay, unless you press the address button.
        2. Read the policy. View the page source. The Content-Security-Policy at the top names one outside address, ipinfo.io, and no other. Your browser refuses anything else this page tries to send.
        3. Pull the plug. Once the page has loaded, switch your connection off. Every line still turns over, the live figures still count and the mark still draws.
        4. Read the code. It is public, and every library it uses is bundled into the page.

        Two things to be exact about. The host, GitHub Pages, delivered these files and, like every web server, saw your address and your browser's label when it did. And the page keeps one small note in this browser's own storage so that it can show you what being recognised looks like. It is never sent, and the erase button above removes it.

        Your browser's own record of what this page fetched

          Sent or fetched since the page opened0