GlassBox: what your browser reveals to every site you visit
01 Navigator core high signal
userAgent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
platform Linux x86_64
vendor Google Inc.
oscpu—
language en-US
languages en-US, en
hardwareConcurrency 9
deviceMemory (GB)8
maxTouchPoints 0
cookieEnabled yes
doNotTrack null
globalPrivacyControl—
pdfViewerEnabled yes
webdriver no
02 UA client hints medium
brands Chromium 152 · Not?A_Brand 24 · Google Chrome 152
mobile no
platform Linux
architecture x86
bitness 64
model(empty)
platformVersion
uaFullVersion 152.0.7977.64
wow64 no
formFactor
03 Screen & display medium
resolution 1280 × 1280
available 1280 × 1280
avail offset 0 , 0
colorDepth 24
pixelDepth 24
devicePixelRatio 1
orientation landscape-primary / 0°
screen.isExtended no
window inner 1280 × 1280
window outer 0 × 0
window pos 0 , 0
refresh rate 60 Hz (measured)
04 Timezone & locale medium
IANA time zone UTC
UTC offset (min)0 (0h)
observes DST no
locale en-US
calendar gregory
numbering latn
hourCycle—
first weekday—
formatted now Friday, August 28, 2026 at 6:09:32 PM UTC
05 Canvas 2D high signal
toDataURL hash cc89ee08a9ff7a317a…
data length 12746 chars
render!Image 1: canvas fingerprint render
06 WebGL renderer n/a
webgl not available
07 WebGPU adapter n/a
adapter null (unavailable)
08 Audio stack high signal
render sum 124.04347777
audio-fp hash c40eda39b983616b10…
sampleRate 44100 Hz
compressor path osc → compressor → dest
09 Installed fonts high signal
detected 6 of 41 probed
font-set hash ad9a9eaeedb34fdb3f…
queryLocalFonts available (needs user gesture + permission)
detected Arial Courier New Helvetica Times New Roman DejaVu Sans Liberation Sans
10 Media codecs medium
support hash 70539322f334ddb4e8…
MSE AV1 true
matrix H.264 HEVC/H.265 VP9 AV1 VP8 AAC Opus MP3 FLAC Vorbis
11 Speech synthesis voices high signal
voice count 0
voice-set hash e3b0c44298fc1c149a…
default—
detected
12 Media devices medium
audio inputs 0
audio outputs 0
video inputs 0
labels visible no
groupIds 0
13 Network information low signal
effectiveType 4g
downlink (Mbps)10
rtt (ms)0
saveData no
type—
14 WebRTC / IP leak low signal
candidates 2
mDNS masked yes — local address hidden
exposed IPs none leaked
15 Storage & quota medium
localStorage writable
sessionStorage writable
indexedDB available
cookies enabled
Cache API available
quota estimate 2.0 GB
usage 0.00 MB
persisted no
16 Permissions matrix low signal
queried 11 permissions
matrix geolocation·prompt notifications·prompt camera·prompt microphone·prompt clipboard-read·prompt clipboard-write·granted push·n/a midi·prompt background-sync·granted persistent-storage·prompt accelerometer·granted
17 API support matrix high signal
available 24 of 30
matrix hash 2a22264ba40a088071…
matrix
Bluetooth USB Serial HID NFC Idle ContactPicker WakeLock PaymentRequest WebAuthn WebXR WebTransport WebCodecs WebNN FileSystemAccess Gamepad Vibration Battery Gyroscope Accelerometer AmbientLight EyeDropper Share SpeechRecog ScreenWakeLock CredMgmt OffscreenCanvas BroadcastChannel ResizeObserver ReportingObserver
18 CSS media features medium
color-scheme light
reduced-motion no
reduced-transparency no
contrast normal
forced-colors no
inverted-colors no
color-gamut srgb
dynamic-range HDR no
pointer fine
any-hover yes
reduced-data no
scrollbar width 0px
19 Math / JS engine medium
0.1+0.2 0.30000000000000004
sin(1e300)-0.8178819121159
math hash 821078fe14969126c5…
native fn form function sin() { [native cod
error format TypeError: Cannot read pro
20 Timing & compute low signal
now() resolution 0.1000 ms
timeOrigin 1787940571835 ms
2M sqrt loop 7.6 ms
≈ ops/ms 263,158
21 Keyboard layout medium
layout guess QWERTY
sample keys Q→q W→w Y→y Z→z Semicolon→; BracketLeft→[ Quote→'
keys mapped 49
22 Battery status low signal
charging yes
level 100%
charging time 0 s
discharging time Infinity s
23 Automation signals low signal
navigator.webdriver no
headless UA no
plugins empty 5 plugins
languages empty 2 langs
driver artifacts none
window.chrome (on Chrome)present
perm inconsistency consistent
24 Behavioral capture medium
status idle (opt-in)
pointer moves 0
path length (px)0
clicks 0
keystrokes 0
scroll events 0
device-motion samples 0
25 Cookies low signal
navigator.cookieEnabled yes
first-party cookie writable
cookies on this page 0
cookieStore API present
requestStorageAccess present (3P gated)
hasStorageAccess present
26 Your IP · location · network n/a
status resolving…
27 Resistance & spoof check high signal
WebGL renderer—
timer resolution 0.100 ms
canvas per-read stable
audio per-read stable
signals detected none — hardware fully exposed
resistance verdict off / bypassed
28 Tracking pixel · what a 3rd party sees high signal
your IP your IP (from your connection)
Referer (the page)https://glassbox.codecanary.org/
cookies on this origin 0 (none set)
3rd-party cookie browser attaches the tracker's own cookie automatically — this page can't read it (cross-origin)
Facebook pixel GET https://www.facebook.com/tr?id=1234567890&ev=PageView &dl=https%3A%2F%2Fglassbox.codecanary.org%2F &rl=(none%20%2F%20direct) &sw=1280&sh=1280&ts=1787940572812
+ request headers Host: www.facebook.com User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Referer: https://glassbox.codecanary.org/ Accept-Language: en-US,en;q=0.9 sec-ch-ua: "Chromium";v="152", "Not?A_Brand";v="24", "Google Chrome";v="152" sec-ch-ua-platform: "Linux" Cookie: c_user=<your Facebook user-id>; xs=<session> ← attached automatically
Google Analytics GET https://www.google-analytics.com/g/collect?v=2&tid=G-XXXXXXX&en=page_view &dl=https%3A%2F%2Fglassbox.codecanary.org%2F&dr=(none%20%2F%20direct) &sr=1280x1280&ul=en-us
29 Login state · who recognizes you n/a
status not run
30 WebAssembly medium
features 6 of 7
wasm profile 9626b9672d1f0754a4…
compile+instantiate 0.055 ms (avg 40)
matrix streaming compile SIMD exception handling type reflection Global Memory Table
31 Private / incognito guess low signal
storage quota 2.00 GB
persistent storage no
signals none
verdict likely a normal window
32 Layout / ClientRects high signal
DOMRect values 12
SVG getBBox 0.000, 7.000, 263.750, 32.000
SVG text length 263.7500 px
geometry hash 3284f12559e9d9e1ff…
33 Text metrics high signal
metric fields 10 of 12 exposed
sample width 161.8438 px
values collected 250
text-metrics hash 6a50a58d897cffa7d7…
**What this is.** A diagnostic mirror. Each panel runs one family of fingerprinting or device-enumeration technique and reports the raw values plus a rough identifying power rating. Individually, most signals are weak; combined, they routinely single out one browser in millions. That combination is the whole game.
**The identifiability % is a model, not a measurement.** Signal ratings (High / Medium / Low) reflect research consensus — canvas, WebGL, audio, font lists and the API matrix are consistently strongest. The headline % sums published per-signal entropy, counts only what your browser actually exposes (masked canvas/GPU are discounted), applies a correlation haircut, and caps at the ~33 bits needed to single out one person among ~8 billion. True rarity needs a live population dataset to compare against — the one thing a no-server tool can't compute on its own — so treat this as an order-of-magnitude indicator. One honest wrinkle: a browser that blends into a big crowd (Tor Browser at its default window size, say) is _safer_ than its bit-count here suggests, because everyone in that crowd reports the same values and this model can't see that. For live-population numbers, compare with EFF Cover Your Tracks and amiunique.org.
**Sandbox caveat.** If you are viewing this inside an embedded frame, some probes (WebRTC, media devices, permissions, sensors) may be blocked by the frame's permissions policy and will report _blocked_ rather than a real value. Host the file at its own origin for the full surface. Shortcuts: E expand · R re-run.
**From CodeCanary.** GlassBox is a companion to codecanary.org, a passive scanner that grades a site's security headers, verifies its JavaScript hasn't drifted, and checks MCP servers. Source on GitHub.