Browser Privacy Check

Server assisted New Internet Security & Privacy

The check reads, in your browser, what every site's scripts can read without asking: Do Not Track and Global Privacy Control, cookie and storage access, user agent, languages, time zone, screen, CPU and memory hints, WebGL graphics and canvas readback. It then shows the address, network, user agent and language header the Mutqan server receives from your browser, and points out mismatches such as a time zone that differs from your address. No fingerprint is computed, and the values are neither sent anywhere nor stored.

Privacy: Your IP address and connection details are read from the request your own browser makes to the Mutqan server and shown back to you. They are not stored; a one-way hash of your address is used only for per-minute request limits.

What can a website learn about your browser without asking?

Without asking, any page can read many details of your browser — user agent, languages, time zone, screen, graphics hardware, storage settings — and can read back what it draws on a hidden canvas. Each detail is common on its own, but together they can recognise a browser across sites without cookies, which is browser fingerprinting. Signals such as Global Privacy Control state a preference; only fingerprinting protection in the browser reduces what is readable.

How to use Browser Privacy Check

  1. Open this page in the browser and profile you want to check (private windows and other profiles can give different results).
  2. Press Run the privacy check. The values are read in your browser and the server is asked once what it received.
  3. Read the findings first, then the table of signals with what each one means.
  4. Change a setting (fingerprinting protection, GPC, third-party cookies) and run the check again to see the difference.

Browser Privacy Check features

  • Tracking preferences: Do Not Track and Global Privacy Control, read exactly as pages read them
  • Storage access: cookies, local storage, session storage and IndexedDB
  • Fingerprinting traits: user agent, platform, languages, time zone, screen, CPU cores, memory hint, touch points, plugins, WebGL graphics and canvas readback
  • What the server receives: your public address, network, location of the address, user agent and Accept-Language header, as the Mutqan server sees your request
  • Mismatch checks between what scripts read and what the server receives: user agent, language and time zone
  • Explains what each value means for your privacy; computes no fingerprint and sends none of it anywhere

Inputs and outputs

Inputs

  • Nothing to type: press Run the privacy check in the browser and profile you want to examine.
  • Your browser's current settings, extensions and network — read as they are at that moment.

Outputs

  • What every site sees — public IP address, network, location of the address, and the user agent and language header received by the server.
  • Signals your browser exposes to scripts — each value with what it means for your privacy.
  • Findings — the points worth acting on, including mismatches between what scripts read and what the server receives.
  • Ways to reduce what sites can read — settings to change.

Browser Privacy Check example

Chrome behind a VPN, with Global Privacy Control on

Input:

Chrome on Windows · VPN exit in Germany · system time zone Asia/Riyadh

Output:

What every site sees: 203.0.113.45 · Example VPN Ltd (AS64500) · Frankfurt, Germany
Time zone of the address: Europe/Berlin — your browser's time zone: Asia/Riyadh
Do Not Track: Not set · Global Privacy Control: On · Cookies: Enabled · Local storage: Available
WebGL graphics: Google Inc. (NVIDIA) — ANGLE (NVIDIA, NVIDIA GeForce RTX 3060 Direct3D11 vs_5_0 ps_5_0, D3D11)
Canvas readback: Allowed
Findings: your browser's time zone differs from the time zone of your address · your exact graphics hardware is visible to every page · pages can read back canvas pixels · Global Privacy Control is on

How to read the Browser Privacy Check results

No single value identifies you; the combination does. An exact graphics card, an unusual screen size, many languages or rare settings make a browser easier to recognise across sites.

Global Privacy Control "On" sends a legally meaningful opt-out in some places; Do Not Track "On" is a request most sites ignore.

Canvas readback "Allowed" and an exact WebGL renderer are the classic fingerprinting surfaces. Browsers with fingerprinting protection hide the renderer, add noise to canvas reads or ask first.

A time zone or language that does not match your address is normal when travelling or on a VPN, but it is visible to every site.

A user agent that differs between the server and scripts means an extension or setting changes one of them, which can itself be distinctive.

When to use Browser Privacy Check

  • Seeing what a site's analytics or advertising scripts can read about your browser without asking.
  • Checking that a privacy setting, GPC or a fingerprinting protection really takes effect.
  • Comparing browsers or profiles before choosing one for sensitive work.
  • Showing a team, in a privacy or security review, what client-side data a page can collect.

Troubleshooting

  • WebGL graphics shows "Not available" — WebGL is disabled, blocked by an extension, or hardware acceleration is off. That is less visible, not a fault.
  • Local storage shows "Blocked" — the browser blocks site data for this site (or all sites); many sites will not work fully this way.
  • The server part shows an error — the comparison is skipped but the browser signals are still listed; press the button again later.
  • Values differ between runs — some browsers randomise values such as canvas output on purpose; that is fingerprinting protection at work.

Frequently asked questions about Browser Privacy Check

Does this check send my browser fingerprint anywhere?

No. The values are read by code running in your browser and shown only on this page; no fingerprint or hash is computed, and nothing is sent to the Mutqan server or stored. The only request asks the server what it received from you: your address, network, user agent and language header.

Can it tell me how unique my browser is?

No. Uniqueness can only be measured against a large collection of other browsers' values, which this page does not gather. It shows which traits are visible and which ones tend to be distinctive, such as an exact graphics card or unusual settings.

Does "Do Not Track: On" protect me?

Hardly. Do Not Track is a request most sites ignore, it has no legal force in most countries, and the W3C group that worked on it closed in 2019. Global Privacy Control is the newer signal, and some laws, such as California's, require businesses to honour it.

Why does the time zone matter?

Your browser reports its time zone to every page. With a VPN in another country, a time zone that does not match the address is one of the simplest signs that a visitor uses a VPN.

How can I reduce what sites can read?

Turn on fingerprinting protection (Firefox's strict tracking protection, Brave Shields, Safari's advanced fingerprinting protection), block third-party cookies, enable Global Privacy Control where offered, and keep extensions and settings close to the defaults so your browser looks like many others.

Technical notes

Every value is read with standard web APIs any page can call without a permission prompt: navigator (userAgent, languages, doNotTrack, globalPrivacyControl, hardwareConcurrency, deviceMemory, maxTouchPoints, plugins), screen, Intl.DateTimeFormat for the time zone, the Web Storage and IndexedDB APIs, WebGL with the WEBGL_debug_renderer_info extension, and a canvas toDataURL readback.

The W3C note "Mitigating Browser Fingerprinting in Web Specifications" explains why such traits matter: each one alone is common, but together they can single out a browser without cookies. Global Privacy Control is specified by the W3C GPC draft; Do Not Track was a header the W3C stopped developing.

The server side is the page's own request as the Cloudflare edge received it (GET /api/v1/internet/me): the address, the network and location Cloudflare attaches to it, and the User-Agent and Accept-Language headers (RFC 9110) the browser sent.

Limitations and methodology

It cannot measure how unique your browser is: that needs a large set of other browsers' values, which this page does not collect.

It reads the common traits, not every possible one (fonts, audio processing, sensors and extension detection are not tested).

The result describes this browser profile at this moment; private windows, other profiles and other devices can differ.

Security and privacy

The signals are read by code in your browser and shown only to you; no fingerprint is computed and nothing is sent to the Mutqan server or stored. Pressing Run the privacy check sends one request to the Mutqan server, which shows back the address, network and headers it received; those are not stored either.

References

  • Mitigating Browser Fingerprinting in Web SpecificationsW3CWhat browser fingerprinting is, which kinds of traits enable it (passive headers, active JavaScript APIs, cookie-like storage) and how specifications try to limit it.
  • Global Privacy Control (GPC)W3CThe Sec-GPC header and the navigator.globalPrivacyControl property a browser uses to tell sites not to sell or share the user's data.
  • Privacy on the web — MDNMDN Web Docs (Mozilla)How browsers protect user privacy — tracking protection, third-party cookie restrictions, fingerprinting defences — and what that means for the data a site can read.