Where you are, and who connects you
Every website sees the “address” your internet connection uses. From it, a stranger can tell your rough location and which company sells you internet.
Why this matters
Your internet address is a bit like the return address on an envelope. On its own it already points to your town and your internet company — that’s how a website you’ve never visited can somehow know your local weather. Advertisers buy lists that tie these addresses to households, so it becomes a way to recognise you again weeks later, even after you clear everything.
A VPN hides this address. But the “sneakier way” row asks for it through a second door — the technology used for video calls. If you’re on a VPN and the two answers don’t match, the site just found your real location anyway.
The device in your hands
Each of these is common on its own. But stack them together — your exact screen, your battery, your languages — and the combination gets rare fast.
Why this matters
No single line here points to you — millions of people use the same browser. The trick is adding them up. Your exact screen size, plus your battery level, plus the languages you read, quickly narrows “who this could be” from millions down to a handful. And none of it has to be saved on your device: the next website simply asks the same questions and gets the same answers.
Notice a couple of rows are marked “some browsers only.” Browsers really do differ: Chrome and Edge happily share your battery and memory, while Firefox and Safari refuse. A blank row here is your browser protecting you.
A signature that’s basically just you
Take everything above, mix it together, and you get a code so specific it may belong to no other device on Earth. On most browsers it follows you even if you clear everything — though some browsers fight back, as you’ll see.
Why this matters
The page quietly asked your browser to draw a tiny picture and to play a sound too quiet to hear. Because of your particular screen, graphics chip and fonts, the results come out just slightly different from anyone else’s — and the same every time. Add your font list, and it becomes a name your browser answers to without ever being asked.
This is the part that catches people off guard: on an ordinary browser like Chrome, clearing your cookies does nothing to it, and private or incognito mode does nothing to it — it’s the same drawing, the same signature, every single time. The good news is that some browsers fight this directly: Safari and Brave quietly change the drawing so the signature won’t hold still, and Tor makes everyone’s look identical. If your signature above changes when you reopen this page, that’s your browser protecting you.
Little settings that say a lot
Small choices and settings you never think about — where you came from, whether you block ads, how many cameras you own — all readable in an instant.
Why this matters
The page you clicked in from is handed over automatically — that’s how a shop knows you arrived from its ad on a news site. Even whether you block ads is a clue, because fewer people do it, so blocking ironically makes you a bit more recognisable.
Two rows are worth a second look. The page counted your cameras and microphones with no pop-up at all — it just can’t see their names until you say yes. And your accessibility settings, like larger contrast or inverted colours, are readable too, which can quietly hint at things about your eyesight you never chose to share.
What you’re doing, right now
This is happening as you read. Move your mouse, scroll, or type, and watch the numbers change. Real websites record this too — and sell it.
Why this matters
How you move is as personal as how you walk. The rhythm of your typing, the little curve your hand makes toward a button, how long you pause before you buy — real websites record all of this and sell it as “engagement.” Because it’s a habit, it can follow you across accounts: change your name and your login, and you still type the same way.
Some real tools go further than this demo and record every key as you press it — including things you type and then delete before hitting send.
On a phone it gets stranger. Researchers have shown that a website reading your motion sensors can often work out what you’re typing just from the tiny way the phone tilts with each tap — enough to guess a PIN or password, with no access to the keyboard. On Android that sensor is often readable with no permission at all; on iPhone a site has to ask first (try it in the next section).
What a single “allow” gives away
Everything above needed no permission. These three do — one tap each. Try them: whatever comes back stays on your screen and vanishes the moment you leave.
Not your city — close enough to find your front door.
The make and model of every one plugged in, by name.
Reading it needs your OK — but changing it usually needs nothing.
Your phone’s tilt and shake. Researchers have used exactly this to guess what people type.
Why this matters
Those pop-ups are built to be answered fast, and most people tap “allow” just to get to the content. But one yes can turn a rough guess at your city into a pin on your building, and your device names are labels that don’t change when you clear your cookies. Worse, your browser remembers your answer for that site — so a quick yes keeps applying every time you come back.
Recognised — with no account.
That code wasn’t saved on your device, and nobody handed it to you. The page worked it out from the answers your browser gave up in the last few seconds — and on most browsers, the next website you open can work out the very same code. You didn’t sign in. You don’t have an account here. You were recognised anyway.
You can make yourself much harder to follow.
None of this needs any technical skill. Do the first three and you shut down most of what you just saw.
Turn on your browser’s tracking protection
One switch in Firefox or Safari blocks most trackers and the little tests that build that signature. In Firefox it’s “Strict” protection; in Safari it’s already on.
Add one ad & tracker blocker
uBlock Origin is free and stops trackers before they even load. Just one — not five. Extra add-ons can themselves be used to spot you.
Say “no” to permission pop-ups by default
Location, camera, microphone, notifications. If a site truly needs one, you can always allow it later.
Stay ordinary
Rare fonts, unusual screen sizes and lots of customising make you stand out. Default settings hide you in the crowd.
Keep your browser up to date
New protections arrive in updates. An old browser is both less protected and easier to single out.
Know what a VPN does — and doesn’t
It hides your internet address and your provider. It does nothing about that signature. Useful, but not a cloak.
When it really matters, use Tor Browser
Tor hides your address and makes everyone’s signature look the same, so there’s no “you” to pick out. It’s slower and some sites break — but it’s the strongest option there is.