This is what your browser gives away.
Read from this browser. No permission prompt.
- User agentReading…
- ScreenReading…
- LocaleReading…
- PreferencesReading…
- CanvasReading…
- GPU stringsReading…
- GPU renderReading…
- Audio stackReading…
- FontsReading…
- CPU and memoryReading…
- PointerReading…
What it reveals.
That address resolves to Columbus, OH. Nobody asked you and nothing prompted: an address is what a connection is made of, so every server you reach gets this much whether or not it does anything with it. This page is telling you because most of them do not.
request · moderate confidence
A city here is where your provider registered the address, which is their equipment rather than you. Measured on 31 July 2026 against a fixed home line: this named a town roughly an hour's drive from the machine making the request, and the same person on a German connection is routinely placed in a neighbouring village. The difference is the provider's block assignment, not the lookup getting cleverer, so the error is worth anywhere from a street to a region depending on who sells you the connection. On a mobile network one gateway can carry a whole region, and behind a VPN it is the exit node. Read from this request and never written, the same as the address above.
Your request arrived from 216.73.217.135. The CDN in front of this page tagged it US.
request · high confidence
Read from the request headers on the server and returned in this one response. It is not written to any table, and there is no column for it in the schema. Act 7 shows that schema.
See the evidence.
Reading this signal…
How rare?
Checking the sample…
Seen before?
Checking previous readings…
Recognition compares signal counts and timestamps. It does not use the rate-limit cookie.
Compare your browser’s local code
Save this code, reload, and compare. It is computed locally and never sent to the server.
- Ten signals, excluding canvas
- measuring
- Including canvas
- measuring
In our Chrome and Edge tests, both codes survived a restart. Firefox 151+ changed the canvas code on restart, so canvas does not count towards recognition.
Try a privacy defence.
These switches model changes against this corpus. They do not change your browser settings.
Waiting for your component counts…
Corpus breakdown
Reading the corpus.
What gets stored.
Separate salted component counts. No raw readings or stored joint fingerprint.
- Timestamps can link readings. That is how the return check works.
- A cookie limits repeat submissions. Recognition does not use it.
- The rate limiter hashes your IP. Those rows expire after ten minutes.
View this visit’s receipt
Waiting for the receipt…
Storage details and prior art
Component values use a 40-bit salted HMAC. Truncation permits collisions; the salt stays on the server. Matching values reveal their previous write time to the submitting browser. Grouping database rows by time can reconstruct which values arrived together.
The rate-limit cookie is called glasshouse_visit_session. IP hashes are keyed HMACs; an earlier version used keyless SHA-256 without expiry. The corpus tables hold no addresses.
Built on known fingerprinting techniques. Prior art: EFF’s Cover Your Tracks, AmIUnique, Webkay and clickclickclick.click.