Session Context — what a web page knows about you

This page uncovers what a web page can infer about a user, in the sequence that matters. Each fact is based on raw data, with no permission required. The insights manifest as soon as the final analysis completes. A single interaction is needed for the outcome to appear, below the box. Input the sentence provided. The page gauges typing rhythm instead of word count, then records the pattern.

Re-typing confirms whether the same individual is at the keyboard. A reduction in entropy halves the population size. Nineteen bits distinguishes one person from half a million others; thirty-three would distinguish one person globally. This page refrains from stating specific probability percentages, as they necessitate a database of other visitors for comparison, which contradicts the page's intended purpose.

The following details represent what researchers discovered when they retained a database: entropy per signal across 118,934 browsers, with the maximum a single signal could contribute being 16.9 bits. In 2016, the dominant desktop signal, now largely irrelevant: browser plugins limited the plugin list to a fixed set due to results like this.

Still significant but diminished since: Chrome and Safari now freeze most of the strings. Version details migrated to client hints, requiring server-side request. Measured through Flash in the original study. Width-measurement detection, utilized by this page, reveals fewer fonts but the permission-gated API reveals all. Among the highest-entropy signals then and now.

Firefox and Safari have since introduced randomization; Chrome has not. Your ordered language list remains unchanged since the study and is sent with every request, regardless of script execution. Display geometry, encompassing color depth, remains unchanged and now includes device pixel ratio and refresh rate. Sent headers, in their original order and without gating, provide enough information to pinpoint your geographical region.

Now frozen alongside the user agent in most browsers. Accepted compression formats indicate the browser's version. The content types you accept, along with their quality values, hold minimal value now, as browsers have removed that feature. Despite its rarity, its presence stores valuable information. The least informative item on this list: almost no users disable cookies.

Combining these factors yields 63 bits, indicating one browser among 7 quintillion—a staggering figure, but a cautionary warning. Entropy is only additive when signals are independent, and these signals are highly correlated, making the combined figure far lower than the 63 bits suggest. No consent prompts were displayed, and no consent was given.

These are the capabilities that request permission initially. Each capability outlines what it reveals and what this page has already deduced without permission—select one to view the distance between those two factors. Geolocation: pinpointing your location within a few meters using satellite data, nearby Wi-Fi networks, and cell towers.

How it works: unknown, without asking. Browser model and its identifiers, which remain constant across visits. How it works: unknown, without asking. Clipboard content: everything you have recently copied—potentially sensitive data like passwords, addresses, or private messages. How it works: unknown, without asking. All installed desktop applications: software you have never shared with any website.

How it works: unknown, without asking. Permission details, which cannot be revoked via this page, as the revoke() function was removed from browsers years ago. Only your browser can undo the permissions.