How can a site see my extensions?

It can't list them, but it can see what they leave behind: objects like window.ethereum, attributes on the page, elements they insert, scripts they add. Extensions that leave nothing behind stay invisible.

Extensions narrow you down. A crypto wallet, developer tools or a particular translator says something about who you are, and makes your fingerprint more unique.

What does the tampering check have to do with it?

Extensions that change your user agent, language or time zone, or wrap the drawing functions used for fingerprints, rewrite what sites read. That's what the check at the top looks for.

Browser extension check

Many extensions change the page to do their job: a wallet adds an object, a dark mode adds attributes, a translator adds elements, antivirus web protection adds its own script. Any site can read those marks, and they say a lot about you. Here are the ones this page found.

Extensions that change the page

Extensions…
Ad blocker…
JS engine…
User agent…

See your full portrait (115 signals)

You're in the in-app browser of , so the results below are that browser's. To test the browser you normally use, copy the link and open it in Safari or Chrome.You're in an app's in-app browser, so the results below are that browser's. To test the browser you normally use, copy the link and open it in Safari or Chrome.You're in WeChat, so the results below are its in-app browser's. To test the browser you normally use, tap ··· at the top right and choose Open in Browser.

115 signals · no permission needed

Who websites think you are

xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx, and right now you're in xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx. You speak xxxx xxxx xxxx xxxx, and your clock is set to xxxx xxxx xxxx xxxx xxxx, in xxxx xxxx format.

xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx

You're on xxxx xxxx xxxx xxxx xxxx, using xxxx xxxx xxxx xxxx xxxx, with a xxxx xxxx xxxx xxxx screen and xxxx xxxx xxxx xxxx graphics: xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx.

You get online through xxxx xxxx xxxx, xxxx xxxx xxxx xxxx, xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx; the DNS server that looks up sites for you is in xxxx xxxx. xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx.

You prefer xxxx xxxx, and xxxx xxxx xxxx; xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx. xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx. Your fonts drop a hint: xxxx xxxx xxxx xxxx xxxx. As for your age, xxxx xxxx xxxx xxxx xxxx.

To a site, this is xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx. xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx. You opened this page xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx, xxxx xxxx, xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx.

In a crowd, xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx xxxx.

How sites would label you

Browser fingerprint IDThe same on every site, in private windows and behind a VPN

To tell you how many people share your settings, this site keeps anonymous counts: no IP, no full fingerprint, no record of any single visit. ·

Disguise check

–

Reading…

I care about

Fix these first

Time zone vs IP
- Set the system time zone to match the IP
- Windows: Settings → Time & language
- macOS: System Settings → General → Date & Time
Language vs IP
- Put the IP country's language first in the browser
- Not trying to pass as a local? Leave it
System language vs IP
- The system has another language pack installed, and its fonts and voices show it
- Use a system or virtual machine without those languages
- Or pick a region that matches the system's language
DNS leak
- Clash / Mihomo: DNS with fake-ip, or TUN mode
- V2Ray / Xray: send DNS through the proxy too
- Browser: turn on Secure DNS
Split routing
- To hide it, switch to global mode
- If local sites go direct on purpose, leave it
WebRTC leak
- Proxy client: turn on TUN mode
- Or limit WebRTC in the browser (Chrome: WebRTC Network Limiter)
Round trip
- A proxy always adds this extra leg, and sites can measure it
- A server closer to you, with lower latency, narrows the gap
- Home or mobile exits draw less suspicion than data center IPs
Connection fingerprint
- Your system writes the TCP packets: no browser or anti-detect browser changes them, and switching the user agent won't fool this
- A full-tunnel VPN or proxy makes the TCP its server's, which itself shows a proxy
- Capture tools, company gateways and antivirus HTTPS scanning change the TLS and HTTP/2 fingerprints: try turning them off
Data center IP
- Use a home or mobile exit instead
- Streaming, AI and payment sites often block data center IPs
User agent vs system
- Don't change only the user agent: the graphics card gives it away
- Need several identities? Use an anti-detect browser
Tampered environment
- Extensions that change the user agent, language or time zone only change what JavaScript reads; the request headers and the functions underneath stay as they were
- To pass for elsewhere, change the system itself: its language and time zone
- With an anti-detect browser, make sure its settings agree with each other
Anti-detect browser traces
- In an anti-detect browser, pick a user agent version that matches its engine
- Don't rewrite only the page's navigator: a Worker must read the same values (a change in the browser's core, not an injected script)
- Pick system, platform and graphics vendor as one set, not mixed
Trackable fingerprint
- Use Brave (it scrambles the fingerprint)
- Or Firefox with resistFingerprinting
- Or Tor Browser
Automation
- Close Selenium, Puppeteer or other automation tools, then reload

Connection

HTTP/3
- Let the proxy carry UDP (Clash / Mihomo: TUN mode, udp: true)
- Allow UDP 443 in the firewall
- Check that QUIC isn't turned off in the browser
ECH
- Turn on Secure DNS (DNS over HTTPS) in the browser
- Proxy: turn off fake-ip, or have its DNS return HTTPS records
- Use a browser that supports ECH: Chrome, Edge, Firefox
Post-quantum
- Update the browser
- Turn off HTTPS scanning in your antivirus, or ask whether the company proxy decrypts traffic
WARP
- Cloudflare WARP: turn it on or off in the 1.1.1.1 app

Where do you want to seem to be?

Target region

Every signal and the value it read

A signal is something a site can read about you without asking. Any site can read all of these, and none of them shows a permission prompt.

What the server sees20

IP address…CF-Connecting-IP

Location…request.cf.city

Coordinates…request.cf.latitude

Network (ASN)…request.cf.asOrganization

DNS resolver…edns.ip-api.com

Time zone of the IP…request.cf.timezone

Reverse DNS…DNS PTR

Nearest data center…request.cf.colo

HTTP and TLS…request.cf.tlsVersion

Key exchange…/cdn-cgi/trace · kex, sni

Cloudflare WARP…/cdn-cgi/trace · warp

TLS fingerprint…TLS ClientHello

TCP/IP fingerprint…probe.1ms.dog · TCP SYN

TLS fingerprint (JA4)…probe.1ms.dog · JA4

HTTP/2 fingerprint…probe.1ms.dog · HTTP/2 SETTINGS

QUIC fingerprint (HTTP/3)…probe.1ms.dog · HTTP/3 · QUIC JA4

Your clock…Date.now()

WebRTC addresses…RTCPeerConnection · STUN

Local address…WebRTC host candidate

IPv6 leaking the MAC…IPv6 EUI-64 (ff:fe)

Exits6

Site in mainland China…myip.ipip.net

IP service abroad…api.ip.sb

ChatGPT…chatgpt.com/cdn-cgi/trace

Claude…claude.ai/cdn-cgi/trace

Cloudflare…www.cloudflare.com/cdn-cgi/trace

IPv4 and IPv6…Cloudflare Radar · IPv4 / IPv6

Sent with every request (headers)7

User agent…User-Agent

Languages…Accept-Language

Browser brands…Sec-CH-UA

Platform…Sec-CH-UA-Platform

Compression…Accept-Encoding

Do Not Track…DNT · Sec-GPC

Came from…Referer · document.referrer

Language and region9

Browser languages…navigator.languages

Locale…Intl.DateTimeFormat

System time zone…Intl …timeZone

Clock format…Intl …hourCycle

Week starts…Intl.Locale weekInfo

Number and date format…Intl.NumberFormat

ICU data…Intl.supportedValuesOf

Keyboard layout…navigator.keyboard

Speech voices…speechSynthesis

Fingerprints23

JS engine…Error.message

Engine's real version…JS feature probes

Lie detection…Function.prototype.toString · iframe

CSS feature level…CSS.supports

Font smoothing…canvas text antialiasing

Canvas…canvas.toDataURL

WebGL…WebGL getParameter

Audio…OfflineAudioContext

Math fingerprint…Math.* → SHA-256

System emoji version…emoji measureText

Font list…fonts → SHA-256

Element sizes (DOMRect)…getClientRects · Range

SVG text sizes…SVG getBBox · getComputedTextLength

Text metrics…measureText actualBoundingBox

WebGL rendering…WebGL readPixels

Engine API count…window · HTMLElement · CSS keys

Timer precision…performance.now() resolution

Call stack depth…recursion depth

Combined fingerprint…SHA-256

Hardware ID (across browsers)…screen · cores · GPU · fonts → SHA-256

Cache ID (ETag)…HTTP cache · ETag / If-None-Match

Fingerprint protection…canvas × 2

Whose protection…navigator.brave · noise · lies

Device30

Operating system…userAgentData

Browser…userAgentData.brands

CPU architecture……architecture · bitness

Screen…screen · devicePixelRatio

Refresh rate…requestAnimationFrame

Screens…screen.isExtended · screenX

Window…innerWidth · availHeight

Scrollbar width…offsetWidth − clientWidth

Graphics card…WebGL RENDERER

WebGPU…navigator.gpu adapter.info

WebGPU capabilities…GPUAdapter limits · features

WebGL capabilities…WebGL2 · MAX_TEXTURE_SIZE

CPU cores…hardwareConcurrency

Memory…navigator.deviceMemory

JS memory limit…performance.memory

Touch and pointer…maxTouchPoints · pointer

Battery…navigator.getBattery

Precise location (asks)…geolocation (on request)

Motion sensors (asks)…devicemotion (on request)

Connection…navigator.connection

Cameras and mics…enumerateDevices

Audio hardware…AudioContext.sampleRate

Biometrics…PublicKeyCredential

Bluetooth…bluetooth.getAvailability

Video codecs…MediaSource.isTypeSupported

WebRTC codecs…RTCRtpSender.getCapabilities

Recording formats…MediaRecorder.isTypeSupported

Hardware video decoding…mediaCapabilities.decodingInfo

DRM…requestMediaKeySystemAccess

Storage quota…storage.estimate

Browser settings20

Color scheme…prefers-color-scheme

Animations…prefers-reduced-motion

Display colors…color-gamut · dynamic-range

Accessibility…prefers-contrast · forced-colors

Default font size and accent color…font-size: medium · AccentColor

Opened as…display-mode

Privacy signals…doNotTrack · GPC

Cookies…navigator.cookieEnabled

Permissions…permissions.query

Sensitive APIs…usb · serial · hid · IdleDetector …

PDF viewer…pdfViewerEnabled

Automation…navigator.webdriver

navigator in a Worker…Worker · navigator

Ad blocker…bait element

Tracker blocking test…7 tracker scripts (on request)

Extensions…window.ethereum · DOM marks

Extension scan…chrome-extension:// files

Tab history…history.length

Stored traces…localStorage · IndexedDB · Cache · window.name

Installed fonts…canvas measureText

Browser extension check

Extensions that change the page

Who websites think you are

You and your friend, side by side

Where do you want to seem to be?

Every signal and the value it read

What the server sees20

Exits6

Sent with every request (headers)7

Language and region9

Fingerprints23

Device30

Browser settings20

Help

How can a site see my extensions?

Why does it matter?

What does the tampering check have to do with it?

Browser extension check

Extensions that change the page

Who websites think you are

You and your friend, side by side

Where do you want to seem to be?

Every signal and the value it read

What the server sees20

Exits6Full check

Sent with every request (headers)7

Language and region9

Fingerprints23

Device30

Browser settings20

Exits6