Is your browser linkable?

How this check works: it contacts our server and Cloudflare’s STUN server

To compare your browser with your connection, the page asks our server what that connection looks like from outside: your IP address, the country, city and timezone it maps to, and the network it belongs to. The answer comes straight back to your browser, and the check stores nothing. The WebRTC test contacts Cloudflare’s public STUN server, which sees your IP address like any server you connect to. Everything else runs in your browser. Visits to this page are counted like any other, as the privacy policy describes.

What this test checks

A site can link two accounts by recognising the device behind them, or by noticing that a connection doesn’t fit the browser using it. This page checks both, with signals any site can read.

Your fingerprint

The canvas hash is a digest of a small image your browser draws; the graphics card, drivers and fonts make it differ from machine to machine. The WebGL strings name your graphics hardware. Platform, CPU cores, memory, screen, timezone and languages narrow it down further. None of this needs your permission, and none of it changes when you clear cookies or open an incognito window.

Timezone vs IP

A site can look up roughly where your IP address is and compare that place’s timezone with your browser’s clock. We compare the two by their current UTC offset, so two names for one zone, such as Asia/Calcutta and Asia/Kolkata, count as a match. A proxy in New York with a browser on London time is one of the most common giveaways.

Language vs IP country

Your browser sends its preferred languages with every request. A language that doesn’t fit the IP’s country proves little on its own, since many people browse in a second language, so this check only adds a note.

WebRTC

WebRTC lets a page open direct connections for calls and file transfers. To set one up, the browser asks a STUN server for its public address, and the page can read the answer. If that request goes around your proxy, the page learns the IP the proxy was meant to hide. We ask Cloudflare’s STUN server and compare its answer with the IP your connection used. An IPv6 address next to an IPv4 connection isn’t automatically a leak, because a network with both has one of each. Behind a proxy that only carries IPv4, though, an IPv6 address there is your own.

Network type

Addresses from Amazon, Google Cloud, Hetzner, OVH and other hosting companies are easy to spot, because those networks don’t serve homes. We match the network’s name against a list of hosting companies. It is a heuristic: a small host can be missing from the list.

Automation flag

navigator.webdriver is true when automation software controls the browser, and sites treat it as a bot signal.

What it doesn’t check

Audio, fonts, WebGL limits and the TLS handshake. Sites can read those too. The test results page lists the ones an XDLogin profile can’t change yet.