What Your Browser Tells Every Website You Visit (And Why I Finally Checked Mine)
Today I opened AmIUnique.org in my browser just to see what it would say. The first line on the screen was:
"Yes! You are unique among 5,635,779 fingerprints in our entire dataset."
My first reaction was, wait, is that good or bad? I use Brave. I use a VPN. I work in security every day. I thought I had this covered. So I sat down and went through the results line by line. That's why I'm writing this. Most people never look at what their browser is sharing, and once you do, you start to see the internet differently.
So what is a browser fingerprint?
Every time you open a website, your browser introduces itself. It doesn't ask permission. It just tells the site things like:
Your operating system (Windows, Mac, Linux)
Your browser and its exact version
Your language and time zone
Your screen size
The fonts installed on your machine
How many CPU cores and how much memory you have
What your graphics card draws when asked to render a hidden image (this is called canvas and WebGL fingerprinting)
On its own, each item is boring. Millions of people run Windows. Millions use 1920x1080 screens. But put 50 of these small details together and you get a combination that is often unique to you. That combination is your fingerprint.
The scary part is that it doesn't need cookies. You can clear your cookies, open a private window, and a site can still recognize you from your fingerprint.
What I found when I tested my own browser
Here is roughly what AmIUnique showed me:
OS: Windows, which 44% of their users share
Browser: Chrome-based (Brave), shared by 48%
Language: English, shared by 66%
Time zone: UTC+1, shared by 15%
Canvas fingerprint: 0.00%. Nobody else matched.
Plugins: names like "ufu2EhvX" and "LNGqVpz". That one made me laugh.
CPU cores: 29. I don't have 29 cores.
That's when it clicked. Those weird values weren't my real machine.
Brave was lying for me on purpose.
It changes the values each time a site reads them, so I look unique on every visit, but differently each time. A tracker can't link Monday's visit to Tuesday's because the fingerprint keeps changing.
The site also showed that no similar fingerprint had been seen in the last 90 days, not even from my own earlier visits. That's exactly what you want.
So being "unique" isn't always bad. Unique and stable is bad, because that's trackable. Unique and changing every time is protection.
What still gave me away
Even with Brave doing its job, a few things still leaked:
IP address. This is the big one. Every site sees it. In my case it was a VPN address, not my home connection, so that one was covered.
Time zone. My browser said UTC+1. If my VPN says I'm in the US but my clock says Central Europe, any site that compares the two can see it.
Language vs. location. An en-US language with a UTC+1 time zone is a slightly unusual pairing, and unusual means easier to pick out.
Fonts. The standard Windows font set shows up clearly.
Do Not Track. Ironically, turning it on adds one more small detail about you.
None of these are a disaster on their own, but they add up.
Why this matters, especially if you do investigations
For a normal user, this is about privacy and ad tracking. For anyone doing OSINT, threat research or incident response, that's a different level.
Think about it. You're investigating a phishing site, a scam shop or a threat actor's forum. You open their page in your normal work browser. What did you just tell them?
Your real time zone, which hints at your country
Your company's IP address, unless you're on a VPN
Your language settings
A fingerprint they can match the next time you visit
If the person on the other side is paying attention, and good ones do, you might have just told them someone is looking at them and roughly where that someone sits. Some actors block or redirect visitors who look like researchers. Some serve different content. Some just quietly take notes.
And this goes both ways. Sometimes you don't want to look hidden. A browser that is too locked down also stands out. If every visitor to a forum is on default Chrome on Windows and you arrive on hardened Firefox from a Linux VM with no fonts and a strange time zone, you're the odd one in the room.
So the goal isn't always "maximum privacy." The goal is to choose what you look like based on what you're trying to do:
Blend in when you want to look like a normal visitor
Lock down when you don't want to leave a trail
Stand out on purpose in rare cases where you want to be noticed
You can only make that choice if you know what your browser is sending in the first place.
How to check yours
It takes five minutes. Open these in the browser you actually use:
AmIUnique.org. Shows your full fingerprint and how rare each piece is.
CoverYourTracks.eff.org. From the EFF. Tells you whether your fingerprint is unique, and whether it's randomized (good) or stable (bad).
BrowserLeaks.com. Goes deep on WebRTC, canvas, fonts and more.
ipleak.net. Checks your IP, DNS and WebRTC leaks, which is useful if you use a VPN.
Do it once on your normal browser, then once on a fresh browser or VM, and compare. The difference will surprise you.
What I changed (and what you can do)
You don't need to become paranoid. A few sensible steps go a long way:
Use a browser that fights fingerprinting. Brave randomizes by default. Firefox has "resist fingerprinting" options. The Tor Browser makes everyone look the same.
Use a VPN, and check it actually works. Test for DNS and WebRTC leaks. A VPN that leaks your real IP through WebRTC is just giving you false confidence.
Match your time zone to your VPN location when it matters for an investigation.
Keep investigation work separate. Use a dedicated VM or browser profile for research, never your personal or work browser.
Use user-agent switchers carefully. They help you blend in, but a Windows user agent sitting on top of Linux fonts doesn't fool anyone who looks closely.
Re-test after changes. Settings get reset by updates. Check again every now and then.
Why I'm writing this
Honestly, because I almost didn't check. I assumed my setup was fine because I knew the tools. When I finally looked, most of it was fine, but some of it wasn't, and I only knew because I tested.
That's the whole point. Your browser talks to every site you visit, all day, every day. You don't have to stop that. But you should know what it's saying, and you should be the one deciding what it says.
Go run the test. Then come back and tell me what surprised you.
----------------------------------------------------Dean------------------------------------------------
Comments