Skip to content

privacy.whattheflip.lol

Scan
Vectors
Tools
Guides
About

Encyclopedia

Tracking vectors

Seven families of tracking technique, plain-English explainers, and what actually defends. Run the live scanner to see your own browser's leaks.

Network

Network

What every HTTP server sees before you render a pixel.

critical very common

IP & geolocation

Your IP address is the rawest piece of identity you broadcast on every request. Here is what it actually leaks.
critical very common

TLS fingerprint (JA4)

Servers can fingerprint your TLS handshake before a single byte of HTTP is exchanged. JA4 is the current state of the art.
high common

DNS leaks & DoH state

Your DNS queries are a real-time log of every site you open. Most VPNs leak them at least some of the time.
high common

WebRTC local IP leak

WebRTC can hand a script your real local network IP, even with a VPN running. Most browsers still ship this enabled.

Fingerprint

Fingerprint

Rendering, hardware, and locale details hashed into a near-unique ID.

critical very common

AudioContext fingerprint

Browsers process a silent audio buffer slightly differently per machine. Sites read the output and hash it for a stable ID.
critical very common

Canvas Fingerprinting

How websites identify you by how your GPU draws text, and what actually stops it.
critical very common

Installed font enumeration

The list of fonts on your machine is one of the highest-entropy passive identifiers. Sites read it without asking.
critical very common

Timezone, language, locale

Your timezone and accepted languages are visible to every script and to every server. They cut the world by 99 percent in one read.
critical very common

WebGL renderer & parameters

WebGL hands any script your exact GPU model and driver version. That is high-entropy, stable, and visible without permission.
high very common

Navigator properties

A grab bag of small JavaScript properties that, joined together, narrow you to a small group of users.
high very common

User-Agent & Client Hints

The User-Agent string is half-deprecated and Client Hints replace it with something arguably worse for privacy.
high common

Screen, viewport, DPR

Window size, screen size, color depth, and device pixel ratio all together pin you to a specific monitor on a specific machine.
high common

WebGPU adapter info

WebGPU is the new graphics API and it leaks even more than WebGL. Most browsers shipped it before adding any privacy mitigation.
medium common

Media device enumeration

Browsers can list your cameras, microphones, and speakers, and the labels alone identify your hardware.
medium common

Speech synthesis voices

The list of TTS voices on your device is a per-OS, per-language identifier readable without permission.

Sensors

Sensors

Physical readings surfaced to JavaScript without a prompt.

medium rare

Battery status API

A short-lived spec that leaked enough to track you for ~30 seconds across cleared cookies. Mostly removed; a few leftovers remain.

Permissions

Permissions

The silent Permissions API bitmap — the shape is the fingerprint.

high common

Permissions API bitmap

Your browser's permission state across geolocation, camera, notifications, and clipboard forms a short, stable fingerprint.

Storage

Storage

What the browser will hand a third-party script and how long it lingers.

high common

Third-party cookies & storage

The oldest cross-site tracker is still here, just rebranded. Third-party cookies, localStorage, and IndexedDB still track you across the web.
medium rare

Supercookies (HSTS / ETag / favicon)

Clearing cookies does not clear every storage surface. HSTS, ETag, and the favicon cache all survive and still identify you.

Behavioral

Behavioral

Signals from what you've installed or how you interact.

high common

Browser extension detection

The extensions you install are a rare fingerprint. Sites detect them via injected scripts, chrome-extension URLs, and behavior probes.

Cross-site

Cross-site

Linkage across origins and the cookies every CDN drops on you.

high common

Referrer & federated-login probes

The Referer header and federated-login buttons silently leak where you came from and which services you hold accounts with.
medium common

CDN bot-management cookies

Cloudflare, Akamai, and PerimeterX set their own cookies on millions of sites. Those cookies are cross-site in practice.

This is not legal advice. We don't use cookies, analytics, or third-party scripts.

Privacy · Affiliate disclosure · Accessibility · DMCA · Changelog