8/24/2026 at 4:15:10 PM
by tke248
8/25/2026 at 3:13:01 AM
So it tells me I’m unique and it can track me across different browsers. It also tells me that in a different browser with a different fingerprint. Even private browsing shows more unique fingerprints that are completely different. I don’t think this site is very useful except looking at fancy data.by Semaphor
8/24/2026 at 5:04:15 PM
This doesn’t seem right. 1 in 6.2 billion for Firefox on an iphone, not including ip/network uniqueness?Seems more plausible that anti-fingerprinting is throwing it off?
by dd8601fn
8/24/2026 at 5:29:29 PM
Some of the data seems straight-up wrong.I know this computer has more RAM than reported and it's definitely not on a 4G network either.
by mattkrause
8/24/2026 at 5:40:28 PM
The APIs it's relying on to show you that information do implement some anti-fingerprinting mechanisms - things like available memory will be put into rough buckets rather than returning the exact amount you have.by daveoc64
8/24/2026 at 6:50:15 PM
[dead]by tke248
8/24/2026 at 6:49:08 PM
It got facebook pixel wrong. I see zero DNS requests to facebook.com on NextDNSby DeluluDon
8/24/2026 at 8:35:44 PM
That panel reconstructs what a pixel would send from your own browser values, locally, and never makes the request. NextDNS seeing nothing is the tool working exactly as designed.by tke248
8/25/2026 at 1:11:50 AM
Also 1 in 6.2 billion for Safari on an iPhone. Also the explanation on the bottom is very small and AI generated.by dullcrisp
8/24/2026 at 5:17:35 PM
Yeah seems like it doesn't account for anti-fingerprinting at all.by randomblock1
8/24/2026 at 6:59:25 PM
Also see https://coveryourtracks.eff.org/by gregsadetsky
8/25/2026 at 1:29:49 AM
“ Your browser fingerprint appears to be unique among the 311,902 tested in the past 45 days.” yet every cloudflare protected website blocks me, random human checks and also my bank and government is blocked. Mmmmm grain of salt?by thenthenthen
8/25/2026 at 2:27:56 AM
I think you have it backwards - Cloudflare et al would want to allow the typical user and block the oddballs.That said, it's a further misunderstanding with utilizing such tools in general. Unique is neither good nor bad on its own. The next question is "always the same unique because that's all you share or always unique because certain fingerprintable attributes are randomized over time/visits/sessions". I.e. it's a war between trying to fake an average enough fingerprint and trying to track someone through partial matches, not just a matter of "is the fingerprint unique".
by zamadatix
8/24/2026 at 10:15:55 PM
My understanding is that this tool only compares how identifiable you are compared to the other people who have previously visited the site.by ranger_danger
8/24/2026 at 5:53:35 PM
It's worth noting that you need both uniqueness and some form of stability. If you consistently show up as a diffent fingerprint every time you visit or for every different site, then that is a form of privacy as well.by RandomBK
8/24/2026 at 6:05:51 PM
I just downloaded a fresh install of LibreWolf to test this and it did indeed have a stable UUID for me at 1/62E6. Better than the 1/680E6 from regular Firefox, but still upsetting. Fonts and Audio fingerprinting seems to be where a lot of the entropy is coming from... Even after I enabled some of the flags to resist font enumeration it still is stable and high entropy. I'm not sure what to do to be honest about this, it is very discouraging.by jszymborski
8/24/2026 at 8:37:47 PM
[dead]by elenaviter
8/24/2026 at 6:01:52 PM
Shocking, this site assigned me a UUID and I found it listed here! https://everyuuid.com/by bobbiechen
8/24/2026 at 6:48:07 PM
Pretty sure someone else also promoted Claude to make something like this and posted it a few weeks back.by saaaaaam
8/24/2026 at 7:00:27 PM
Recently discussed prompts:https://news.ycombinator.com/item?id=48727059 [flagged] What any website can see about you
https://news.ycombinator.com/item?id=48062178 A web page that shows you everything the browser told it without asking
https://news.ycombinator.com/item?id=49182352 Show HN: Modern Browsers Don't Need the Cookie Anymore
https://news.ycombinator.com/item?id=46517654 [flagged] Show HN: DevicePrint – device fingerprinting without cookies
https://news.ycombinator.com/item?id=46037031 Show HN: Explore what the browser exposes about you
https://news.ycombinator.com/item?id=45169286 Browser Fingerprint Detector
https://news.ycombinator.com/item?id=49359153 A live browser fingerprinting and bot detection playground
https://news.ycombinator.com/item?id=46674460 Show HN: Anti-Detect.com – Browser Fingerprint Scanner
There are definitely more! Could this be HN's favourite prompt?
by Retr0id
8/24/2026 at 7:12:21 PM
Haha! Well done for putting in the effort to find those. I was sure I’d seen it more than once but didn’t want to overrreach!by saaaaaam
8/24/2026 at 7:21:22 PM
The trick is that in most cases, someone links https://coveryourtracks.eff.org/by Retr0id
8/25/2026 at 1:50:54 AM
[dead]by tke248
8/24/2026 at 6:06:30 PM
Cool tool, but the language is painfully characteristic of AI. Maybe we are collectively getting over caring about that, but if not, it's worth a pass of "make this sound a little less like AI."E.g., the guide page ends with
> The honest bottom line. Perfect anonymity [...]
by strbean
8/25/2026 at 1:18:14 AM
I was >60% sure it would be AI given the combination of calendar year and the wording "what the browser reveals" that I saw on the HN front page - and only when I clicked did I realise how wrong I was, because the actual probability is 100%.(Not to suggest that browser fingerprinting isn't a useful issue to highlight.)
by tom_
8/24/2026 at 7:46:35 PM
Not just the language. Its like all LLM front end design is working off one of three templates.by MeetingsBrowser
8/24/2026 at 6:17:46 PM
* You're absolutely right! ;-)by moonlighter
8/24/2026 at 5:23:23 PM
It's horrifying to see that our browsers give up anything at all. I feel like we need a new model where we just get served the content, and we don't serve up anything to the content provider. I feel ill.by bravoetch
8/24/2026 at 5:34:58 PM
How would you prevent that? If you want to use a feature, you need to know if that feature is available. So you add methods/functions to ensure that you can fail gracefully when something is not available. That availability is the fingerprint. I don't blame the browsers as much as asshats using the tool for malicious purposes. We're not going to ban hammers because someone uses them for things other than driving nails.by dylan604
8/24/2026 at 7:58:14 PM
Another one is "draw text, read back pixels" which is simultaneously a really effective fingerprint, and also cuts to the core of what we want a web browser to do. We can't refuse to draw text.by StilesCrisis
8/24/2026 at 6:48:08 PM
need to license swe just like real engineers and make them have a responsibility to the publicby drsalt
8/24/2026 at 7:11:35 PM
And what about SWE from outside whatever jurisdiction that body issues those licenses? You cannot regulate your way out of tech problem if everyone is not subject to said regulations. Why people keep making comments like this is beyond me.by dylan604
8/24/2026 at 7:23:21 PM
[dead]by smohare
8/24/2026 at 5:52:23 PM
In the old days, we just sent the content and let the client figure out what to do with it. If you navigated to homestarrunner.com and you didn't have flash installed, you just got a message saying to install it, or worst case, a broken icon in a frame.We figured it out just fine.
by fooqux
8/24/2026 at 7:14:00 PM
Right, but the client side did a query to see what was available and gracefully displayed a message. People are now sending the truthy response of the feature's availability back. You could be doing that as a legit bit of logging, or you could be doing that to be an asshat and deanonymize the user. The browser doesn't know the intent of being asked about a feature. And yes, it has been figured out just fine as a way for making someone money by selling information about youby dylan604
8/24/2026 at 10:01:05 PM
The solution for me is not to be more common. The solution is to create a very unique profile each and every time.by cgio
8/25/2026 at 12:41:06 AM
There should be a browser that lies to websites instead of cavingby Obscurity4340
8/25/2026 at 1:45:18 AM
Off topic: I like the presentation of this site!by geoffbp
8/24/2026 at 11:09:38 PM
I don't have JS enabled and it looks like they don't know anything about me at all.by autoexec
8/24/2026 at 5:28:29 PM
If your ISP issues an IPv6 address, isn't that pretty much game over for anonymity/uniqueness?by dylan604
8/24/2026 at 7:17:19 PM
Not usually, if you're comparing it to IPv4. Many ISPs give each customer a persistent IPv4 address that doesn't tend to change over time. Because most people use NAT (internal IP address != external IP address), a server you connect to can't identify the specific computer or device.With IPv6, it's true that in many cases servers will see you as connecting from the specific IPv6 address of your computer/device. However, IPv6 addresses contain many parts, like:
2001:db8:1234:5600 : abcd:1234:5678:9abc
So in many cases, the ability for a server to individually fingerprint your device solely based on the IP address is roughly equivalent between IPv4 and IPv6. (This isn't the case if the ISP does CGNAT on IPv4, where you're sharing your IPv4 address with many customers - this would be similar in magnitude to a VPN in terms of the ability for a server to fingerprint you based on IP.)
by keito
8/25/2026 at 12:51:59 AM
>But in most OSes the right part is randomly generated and changes on some cadence (e.g. daily).>So in many cases, the ability for a server to individually fingerprint your device solely based on the IP address is roughly equivalent between IPv4 and IPv6.
That still makes ipv6 strictly worse, if you consider that a device is always uniquely identifiable at any given time, whereas with ipv4 NAT they can't be individually identified.
by gruez
8/24/2026 at 7:14:45 PM
A VPN or Tor swaps it out entirely, which your browser fingerprint survives. It is a strong identifier, not a permanent one.by tke248
8/24/2026 at 5:50:34 PM
Fascinating visualization , as someone building productivity extensions, it is always sobering to see exactly how much surface area the browser exposes.by anishvarghese
8/24/2026 at 6:46:33 PM
Interesting work! Would randomnize the least frequent used fonts, apis and settings be an way to anti-fingerprinting?by ZihengQin
8/24/2026 at 7:11:10 PM
Fun fact: some malware won't execute if it sees a Russian/Ukrainian keyboard layout, because the authors avoid hitting victims in their own jurisdiction.by tke248
8/24/2026 at 7:39:32 PM
https://krebsonsecurity.com/2021/05/try-this-one-weird-trick...by latexr
8/24/2026 at 9:55:14 PM
> 1 in 7.6 billion browsers share this profileI always knew I was so unique
by sajithdilshan
8/24/2026 at 11:07:59 PM
unique is ideal, as long as you're differently unique to each site you visitby autoexec
8/24/2026 at 6:36:42 PM
This does not account for anti fingerprinting. Also, are there any new tricks that are not in fingerprintjs?by f311a
8/24/2026 at 6:51:47 PM
[dead]by tke248
8/24/2026 at 8:18:23 PM
Lying AI slop. Says I am unique among 7.2B devices and shows me a different fingerprint every time.Idk how this vibe coded slopware made it to the front page of HN
by water-drummer
8/24/2026 at 8:41:40 PM
If it changes every load, that's your browser farbling canvas/audio per-read (Brave or Firefox), which means the anti-fingerprinting is working. We missed crediting that in v1, so it should read lower now if you reload.by tke248
8/24/2026 at 5:58:56 PM
The "Hardware & Environment" part which supposedly links me across different browsers doesn't work — it differs between Safari, Firefox and Chromium.In a private Safari window, it's not even stable across reloads.
by janfoeh
8/24/2026 at 7:46:35 PM
[dead]by tke248
8/24/2026 at 4:15:45 PM
I built this after a thread here about Alibaba using an audio-context trick to fingerprint visitors. I knew a fair number of fingerprinting methods but not that one, and I wanted to see all of them in one place, running against my own browser.GlassBox runs ~31 probes (canvas, WebGL/WebGPU, audio, fonts, the WASM feature set, math/engine quirks, WebRTC IP, timezone/locale, the permission and API matrices, an incognito heuristic, cross-site login-state, and so on) and shows the raw values plus an estimate of how identifiable you are.
A few deliberate choices:
- One static HTML file, no dependencies, no build step. Everything runs client-side and nothing is sent, with one opt-out exception: IP geolocation, which calls a public API. I didn't want a privacy tool that phones home.
- The "identifiability" number is an honest model, not a measurement. It sums published per-signal entropy (Panopticlick / AmIUnique / Cover Your Tracks), discounts signals your browser masks, and caps at the ~33 bits needed to single out one person on Earth. A no-server tool can't compute true rarity against a live population, so I label it an estimate instead of pretending. For real population numbers, Cover Your Tracks and AmIUnique have the datasets.
- There's a companion guide on lowering your fingerprint, with the caveat that uniqueness isn't privacy: blending into a big crowd (Tor at its default size) beats a bespoke hardened setup that makes you the only one who looks like that.
Source (MIT): https://github.com/HotStartLabs/glassbox
I'd genuinely like to know which vectors I'm missing, especially from the anti-fraud / detection side.
by tke248
8/25/2026 at 12:56:57 AM
You even used an LLM to write your comment.If you’re ESL, that’s not an excuse. You can write something in your own language and use a translator or even an LLM to translate it.
But using an LLM to write is delegating your cognition to a machine. At that point, you’re acknowledging that your own cognition has no value, so why are you trying to inflict a faked version of it on the rest of us?
by antonvs
8/24/2026 at 6:21:32 PM
[dead]by rafram