When you open a web page, your browser sends some information automatically. Some of it is needed for the page to work; some can be used for tracking. Here is what a website can see — and what it can’t.
Sent with every request
- The IP address of your connection — the network and an approximate area, not you personally. See Can someone find me from my IP address?.
- The user agent: browser, version and operating system. Try the user-agent parser.
- Preferred languages (
Accept-Language). - The referrer: the page you came from, often shortened to the domain.
- Privacy signals such as Do Not Track and Global Privacy Control.
The HTTP headers tool shows exactly which headers your browser sent us.
Readable with JavaScript
Scripts on a page can read more: screen size, time zone, number of CPU cores, installed fonts and how the graphics card draws. Each is harmless on its own, but together they can form a fairly unique fingerprint. Modern browsers limit many of these sources.
Needs your permission
- Precise location (GPS/Wi-Fi) — the browser asks first.
- Camera and microphone.
- Notifications.
Cookies and logins
Cookies let a site recognise you between visits. Third-party cookies from advertising and analytics services let them follow you across sites; in the EU and EEA they require consent. Logging in ties everything to an account, which is often the strongest identifier of all.
WebRTC
Browser video calls use WebRTC, which can reveal addresses. Modern browsers hide local addresses, but with a misconfigured VPN your real public address can leak. Test it with the WebRTC leak test.
What you can do
- Use a browser with built-in tracking protection.
- Decline unnecessary cookies.
- Enable Global Privacy Control.
- Use a VPN if you want to hide your IP address from the site — see VPNs and your IP address.
This site does not log IP addresses or use tracking cookies; read How it works.