Detection Guide
Every site you visit builds a profile of your device in the first few milliseconds. Here is exactly how — with the receipts, live from your own browser.
Websites layer three detection methods: HTTP headers (User-Agent, Accept-Language, Client Hints) sent with every request, JavaScript APIs (screen, GPU, hardware) that run after the page loads, and CSS media queries that adapt layout. Combined, they can identify your browser, OS, device class, screen, GPU, timezone, language and hardware capability within milliseconds — usually enough to fingerprint you uniquely.
Below is a live readout of every signal your browser is currently exposing to this page. Each row is tagged with the technique used to obtain it, so you can see the difference between a passive HTTP header, an active JavaScript query, and a fingerprinting probe.
Detection is not a single trick — it's a stack. Each layer runs earlier than the next, and each collects a different kind of data. Understanding the stack is the fastest way to understand what a specific site can and cannot know.
Server-side detection uses HTTP headers that your browser sends before any page code runs. Client-side detection uses JavaScript APIs that run after the HTML loads. They see very different things.
✓ = available. Server-side wins on speed and always-on. Client-side wins on richness — but only if JavaScript runs.
Chromium is quietly freezing the classic User-Agent string. Instead of parsing "Mozilla/5.0 (Windows NT 10.0…) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/…", sites are expected to request structured Client Hint headers explicitly.
The design goal is to reduce passive fingerprinting — sites now have to ask for high-entropy data instead of getting it for free in every request. In practice most large sites request everything on first visit, so the privacy gain is smaller than advertised.
Detection becomes tracking when the combined signals are unique enough to re-identify you across visits — with no cookies required. This is measured in bits of entropy : each independent signal contributes bits, and roughly 33 bits is enough to single out one person on Earth.
The signals aren't fully independent — a Retina display correlates with macOS, which correlates with Safari — so the practical total is lower than the sum. But most desktop browsers still leak 18-25 bits without any exotic probing. That's enough to narrow 8 billion people down to a few hundred.
Try the browser fingerprint checker to see how many bits your setup leaks.
"Randomized" means the browser adds noise per site so hashes don't match across origins. "Standardized" means every user reports the same values — the Tor Browser approach.
"Incognito mode hides my device." — It hides history and cookies. Every fingerprint signal (UA, screen, GPU, canvas) is identical to normal browsing.
"A VPN stops device detection." — A VPN changes only your IP. Every header and JS signal is untouched, and your fingerprint still ties sessions together across IPs.
"Spoofing my user-agent makes me anonymous." — Naive spoofing creates inconsistency (Chrome UA + Safari-only APIs), which is itself a strong fingerprint.
"Detection only happens when I log in." — Detection runs on the very first byte of the very first request, before any interaction.
The live panel above shows everything at once. If you want to inspect one specific signal in depth, each has a dedicated tool:
On mobile, often yes — the user agent string typically identifies the model (e.g. 'iPhone15,3' or Samsung's 'SM-S928B'). On desktop the answer is usually no: websites see the OS family and CPU architecture, but not whether you're on a Dell XPS, a MacBook Pro, or a custom build. WebGL renderer strings can leak the GPU model, which narrows it further.
Server-side detection reads HTTP headers (User-Agent, Accept-Language, Client Hints) before the page is even sent. It's fast, works without JavaScript, but is limited to what the browser volunteers in headers. Client-side detection runs JavaScript after the page loads and can query dozens of APIs — screen size, GPU, audio hardware, installed fonts. It's richer but only works if JS is enabled.
You can reduce detection but not eliminate it. Tor Browser standardizes almost every signal so users look identical. Brave and Firefox with 'resistFingerprinting' block canvas, WebGL and audio fingerprints. User-agent spoofing extensions only fool naive scripts — client hints and JS APIs still leak the truth. Disabling JavaScript blocks client-side detection but breaks most modern sites.
Client Hints are structured HTTP headers (Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Mobile, etc.) that Chromium browsers send instead of stuffing everything into the User-Agent string. They're opt-in per site via the Accept-CH header, and split into low-entropy hints (sent by default) and high-entropy ones (only on request). They give sites cleaner data while reducing passive fingerprinting.
Roughly 33 bits. There are about 8 billion people, and log₂(8,000,000,000) ≈ 33. Every independent signal a site collects — timezone (~5 bits), screen resolution (~4-8 bits), fonts (~10-15 bits), canvas hash (~10+ bits) — adds together. Most desktop browsers leak 18-25 bits without any exotic fingerprinting, which is enough to shortlist you to a few hundred people worldwide.
For basic detection — user agent, screen size, timezone, language — no. That data is available to any script the page loads. Sensor-level access (geolocation, camera, microphone, motion) does require explicit permission via a browser prompt. Fingerprinting sits in between: it's technically allowed, but Safari's ITP and Firefox's ETP now block known fingerprinting scripts by default.
No. Responsive design uses CSS media queries (max-width, prefers-color-scheme) to adapt layout — the server sends the same HTML to every device, CSS does the reshuffling. Device detection actively identifies what you're using so the server or JS can change behavior. Modern sites combine both: responsive CSS for layout, minimal detection for edge cases like push notifications on iOS.
Because cookies are per-domain, blockable, and clearable. Fingerprinting produces a signature that survives across sites, incognito windows, and cookie wipes — it's what powers cross-site tracking, ad attribution, and fraud detection. Regulators (GDPR, ePrivacy) treat fingerprinting like cookies: consent required for tracking. Enforcement is patchy.