What any website learns about you before you click anything: address and provider, browser and system, time zone and screen. Shown here plainly — together with what it means.
Everything except geolocation is computed in your browser — nothing is stored in a database or a log
derived from the address, not from satellites — city-level at best
Your IP address
Detecting…
The country, city and provider are resolved by a third party, ip-api.com — our server passes your address and gets the answer back. We do not store the address: neither in a database nor in a log.
02
Browser and device
the browser reports this itself, with no permission asked
03
What you have already sent
headers our server received together with the request for this page
Detecting…
04
Checks
what the tables do not show: substitution, leaks, recognisability
Time zone against the address
—
Nothing to compare: geolocation did not answer or the zone is unknown.
WebRTC leak
The browser returned no candidates — nothing to check.
We do not query a STUN server for the public address: that would send your IP to a third party, which is exactly what this page warns about.
Browser fingerprint
…
Computed in your browser and never sent anywhere. Open this page in private mode — the hash will most likely match.
Estimated from the number of unusual traits, not from a fingerprint database: we have none and will not build one.
05
What it means
An IP gives the city, not the flat
Address geolocation is a database of provider ranges, not satellites. It usually gets the city right and the district wrong; sometimes it shows the provider's node hundreds of kilometres away. House-level accuracy happens only with mobile carriers, and not always.
The time zone beats the VPN
An address is easy to substitute, the browser clock is not — you would have to change it by hand. That is why a zone/country mismatch gives the substitution away better than the address itself. Bank and shop anti-fraud systems work exactly this way.
Cookies are not the main thing
Fingerprinting works without them: the combination of version, screen, fonts and graphics card is nearly unique. Rejecting cookies is useful, but it does not switch recognition off — and neither does private mode.
Do Not Track means nothing
The header asks not to be tracked and obliges no one. Google, Meta and most ad networks ignore it, while the very fact that it is on adds another rare trait to your fingerprint — that is, makes you slightly easier to single out.
Headers arrive before you do
User-Agent, language and Sec-CH-UA reach the server with the request for the page — before any JavaScript and before any consent. They cannot be switched off: without them the site does not know what to serve you.
What actually helps
Against the address — a VPN or Tor; against the fingerprint — a browser that averages it out (Tor Browser, Safari with protection, Firefox with resistFingerprinting). There is no universal remedy: the stronger the protection, the more you differ from the crowd.
06
Frequently asked questions
Your IP address and the country, city and provider derived from it; the browser, its version and your operating system; language, time zone, screen and window size; cookie support and a dozen technical traits. All of it travels with the ordinary request for the page — before you click anything and regardless of whether you accepted cookies.
Often yes, and not from the address itself. The clearest signal is a time-zone mismatch: the address says Amsterdam while the browser clock runs on Moscow time. This page puts both values side by side and labels the mismatch plainly. A match proves nothing, but a mismatch gives the substitution away at once.
WebRTC powers calls in the browser, and to connect it exposes the addresses of your network interfaces — the local one, and historically the real public one straight past a VPN. Modern browsers replace the local address with a name like `8f2c….local`; if that is what you see, there is no leak. A real address here means the page can see your home network.
A set of traits you never chose: browser version, operating system, resolution, fonts, graphics card, core count. Harmless one by one, together they form a nearly unique combination that identifies you without any cookie, including in private mode. We show your fingerprint so that this becomes visible; the hash is computed in your browser and never sent anywhere.
From history on your own device, yes. From recognition by a website, barely. Same IP, same time zone, same screen and fonts; a fingerprint taken in private mode usually matches the ordinary one. Incognito erases traces on the computer, not on the network — two different jobs, and confusing them is expensive.
Geolocation is resolved by a third party, `ip-api.com`: our server passes your address and gets back the country, city and provider. It says so right in the address block, because staying quiet about it on a privacy page would be odd. We do not store the address — it goes neither into the database nor into logs.