Every measurement a website can take from your browser, run live and shown back to you.
GlassBox is a client-side browser-fingerprinting bench. It runs ~31 families of fingerprinting and device-enumeration probes against your own browser, shows you the raw values, and estimates how identifiable you are. These are the same signals tracking and anti-fraud scripts collect, surfaced instead of hidden.
🔗 Live demo: https://glassbox.codecanary.org 📖 Anonymization guide: https://glassbox.codecanary.org/guide 📰 Featured in The Register
Example capture with fabricated data — documentation-range IP/ASN, invented hashes and GPU. GlassBox displays the viewer's own IP, location, and hardware, so this illustrative shot uses synthetic values rather than a real fingerprint. Run the live demo to see your own.
- Navigator core, UA client hints, screen & display, timezone & locale
- Canvas 2D, WebGL / WebGL2, WebGPU, and audio-stack fingerprints
- Installed fonts, media codecs, speech-synthesis voices, media devices
- WebRTC / IP leak, storage & quota, permissions matrix, API-support matrix
- CSS & media features, JS-engine math, timing / compute, keyboard layout, battery
- Automation / bot signals, cookies, a locally-reconstructed tracking pixel, and a fingerprint-resistance check
- Opt-in: public IP intelligence (geo / ASN / VPN detection), behavioral capture, and cross-site login-state
Signals fold into four tiers — hardware, engine × hardware, browser build, and session — plus a headline estimated identifiability score.
Every probe runs in your browser and its results are never uploaded. What does leave the page, all of it visible in the source: on load, the IP panel asks three public IP-intelligence APIs (ipwho.is, ipapi.is, geojs.io) and two STUN servers (Google, Cloudflare) about your address, network and VPN status, and toggling Geo off stops that, including requests still in flight. The login check loads one image from each service it tests, only when you press its button. The hosted copy also carries two page-view counters, neither of which sees anything a probe measures: a first-party one (/_hb/s.js, same origin, no cookies, records the page path and referrer, opt-out at /_hb/optout) and Cloudflare Web Analytics, injected by the host (cookie-free, page views and load timings).
The headline percentage is an honest model, not a live-population measurement — a no-server tool can't compute true rarity against real visitors. It sums published per-signal entropy (Panopticlick, AmIUnique, EFF Cover Your Tracks), counts only what your browser actually exposes (masked canvas / GPU are discounted), applies a correlation discount, and caps at the ~33 bits needed to single out one person among ~8 billion. Treat it as an order-of-magnitude indicator. One honest wrinkle: a browser that blends into a big crowd (Tor Browser at its default size) is safer than its bit-count suggests, because everyone there reports the same values. For numbers measured against a live population, compare with EFF Cover Your Tracks and AmIUnique.
A single static file — no build step, no dependencies. Any static host works:
# locally
python3 -m http.server 8000 # then open http://localhost:8000
# Cloudflare Pages
node tools/csp-hash.mjs # refresh the CSP script hash in _headers after any edit to index.html
npx wrangler pages deploy . --project-name=glassboxHost it at its own https:// origin for the full surface — some probes (WebRTC, media devices, permissions, login-state) are limited on file:// or inside an embedded frame.
| File | Purpose |
|---|---|
index.html |
The app — all probes plus the identifiability estimate, fully self-contained |
guide.html |
Anonymization how-to guide (served at /guide) |
_headers |
Security headers for Cloudflare Pages |
Inspired by and worth comparing to EFF Cover Your Tracks, AmIUnique, Panopticlick, and browserleaks.com. Built as part of CodeCanary.
MIT © HotStart Labs