Device information

What a web page can read — and what it cannot

Open any page and the browser hands it a surprising amount of detail before you type a single character. Some of it is necessary: a server cannot send a sensible layout without knowing the viewport, and it cannot serve the right language without knowing your locale. The rest is simply available because a browser has to describe itself in order to work.

The most familiar field is the user agent string, which advertises the browser and operating system. It is also the least trustworthy — it has been spoofed for decades, and modern browsers are deliberately freezing it, so treat it as a hint rather than a fact. Below it sit more reliable signals: the screen’s real and available resolution, the device pixel ratio, the colour depth, the number of CPU cores, the time zone and its UTC offset, and the list of languages you prefer.

Then come the hardware and capability fields, which is where most people are surprised. WebGL can report the graphics renderer, the media APIs can enumerate cameras and microphones, the battery and network information APIs describe connection type and round-trip latency, and storage APIs reveal whether cookies and client-side databases are available. None of these ask for permission on their own — they are simply readable.

Device fingerprinting is what happens when those individually weak signals are combined. Fonts, canvas rendering, audio processing and screen metrics vary between machines in ways that are stable over time, so together they identify a browser with high accuracy even without cookies. That is the technique advertisers use to track users who have cleared their storage, and the reason privacy-oriented browsers deliberately normalise these values.

Two fields do ask first. Precise location triggers a permission prompt and can use GPS or Wi-Fi positioning, which is far more accurate than anything an IP address can give. Media device enumeration usually returns names only after camera or microphone access has been granted — before that you typically see blank labels.

Everything on this page is computed in your browser and rendered locally. Nothing you see is transmitted or stored, and a refresh clears it completely. If you want to reduce what pages can read, use a private window, install a fingerprinting-protection extension, and decline optional permissions.

Frequently asked questions

Is any of this uploaded anywhere?

No. Every field is read from browser APIs and rendered on this page. Nothing is sent to a server and nothing is stored, so refreshing the page clears it.

Why does the location need my permission?

Approximate location comes from your IP address and needs no permission. Precise location uses the browser geolocation API, which always asks first and can be denied without affecting anything else on the page.

What is a device fingerprint?

A value derived from many small characteristics — fonts, canvas rendering, screen metrics, audio stack and so on. Individually they are weak; combined they identify a browser with surprising accuracy, which is why privacy-focused browsers try to flatten them.

Can I reduce what sites can read?

Partly. Private or incognito windows, blocking fingerprinting extensions, disabling third-party cookies and refusing optional permissions all lower the amount of detail available. You cannot hide everything — a browser has to describe itself to serve a page.