incognot

You're not as incognito as you think.

Any site you open can run these 79 checks in a few seconds, without a single permission prompt. Here's the passport they quietly issue you.

Passport of the internetType P, issued by every site you visit
Likely from
Currently in
Speaks
Time zone
Device
Browser
Screen
Graphics
Network
DNS lookups in
Issued
Expires
P<<<<INCOGNOT<<VISITOR<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<0<<<7001017<<<<<<<<<<<<<<<<<<<<<<<2
0 of 79 checks

What a site writes down about you

Going by your settings, you most likely come from  . The network puts you in   right now. Your browser asks for pages in  , and the system clock is set to   with a   display.

This is  , running  . The screen is  , the graphics come from  , and taken together it looks like  .

Your traffic leaves through  , on  . The DNS server that looks up sites for you sits in  .  

You prefer  , and  .   Your fonts and extensions say  . As for your age,  .

Have we met?

Pass as someone from

 

The fine print

All 79 checks, what each one read, and the browser API or header it read it from. None of them asks for permission.

Seen by the server 15

IP address…X-Forwarded-For
Location…x-vercel-ip-city
Coordinates…x-vercel-ip-latitude
Network (ASN)…api.ip.sb · asn
DNS resolver…edns.ip-api.com
Time zone of the IP…x-vercel-ip-timezone
Reverse DNS…dns.reverse · PTR
Nearest edge…x-vercel-id · Radar colo
HTTP and TLS…nextHopProtocol · trace tls
Key exchange…crypto.cloudflare.com trace
Cloudflare WARP…/cdn-cgi/trace · warp
Round trip…PerformanceResourceTiming
Your clock…Date.now() vs server
WebRTC addresses…RTCPeerConnection · STUN
Local address…ICE host candidate

Exit addresses 6

Site in mainland China…myip.ipip.net
IP service abroad…api.ip.sb
ChatGPT…chatgpt.com/cdn-cgi/trace
Claude…claude.ai/cdn-cgi/trace
Cloudflare…www.cloudflare.com/cdn-cgi/trace
IPv4 and IPv6…Cloudflare Radar check

Request headers 7

User agent…User-Agent
Languages…Accept-Language
Browser brands…Sec-CH-UA
Platform…Sec-CH-UA-Platform
Compression…Accept-Encoding
Do Not Track…DNT · Sec-GPC
Came from…Referer · document.referrer

Language and region 8

Browser languages…navigator.languages
Locale…Intl.DateTimeFormat
System time zone…resolvedOptions().timeZone
Clock format…resolvedOptions().hourCycle
Week starts on…Intl.Locale weekInfo
Number and date format…Intl.NumberFormat
Keyboard layout…keyboard.getLayoutMap
Speech voices…speechSynthesis.getVoices

Fingerprints 7

JS engine…TypeError message
Canvas…canvas.toDataURL → SHA-256
WebGL…getParameter → SHA-256
Audio…OfflineAudioContext
Font list…fonts → SHA-256
Combined fingerprint…SHA-256 of all of it
Fingerprint protection…canvas drawn twice

Device 22

Operating system…userAgentData
Browser…userAgentData.brands
CPU architecture…architecture · bitness
Screen…screen · devicePixelRatio
Refresh rate…requestAnimationFrame
Screens…screen.isExtended · screenX
Window…innerWidth · availHeight
Graphics card…UNMASKED_RENDERER_WEBGL
WebGPU…requestAdapter().info
WebGL limits…MAX_TEXTURE_SIZE · WebGL2
CPU threads…hardwareConcurrency
Memory…navigator.deviceMemory
Touch and pointer…maxTouchPoints · (pointer)
Battery…navigator.getBattery
Connection…navigator.connection
Cameras and mics…enumerateDevices
Audio hardware…AudioContext.sampleRate
Biometrics…PublicKeyCredential
Bluetooth…bluetooth.getAvailability
Video codecs…MediaSource.isTypeSupported
DRM…requestMediaKeySystemAccess
Storage quota…storage.estimate

Browser settings 14

Color scheme…prefers-color-scheme
Animations…prefers-reduced-motion
Display colors…color-gamut · dynamic-range
Accessibility…prefers-contrast · forced-colors
Opened as…display-mode
Privacy signals…doNotTrack · globalPrivacyControl
Cookies…navigator.cookieEnabled
Permissions…permissions.query
PDF viewer…pdfViewerEnabled
Automation…navigator.webdriver
Ad blocker…bait element
Extensions…window globals · DOM marks
Tab history…history.length
Installed fonts…canvas measureText

Share your passport

Questions

What does this page do?

The moment you open any website, it can run a long list of small tests on your browser and connection. This page runs 79 of them, in the open, and writes down who that makes you.

Hover over a filled-in blank in the paragraph to see which sniffers it came from. The list at the bottom shows every sniffer, the API or header it reads, and what it got. None of them shows a permission prompt.

How does it guess where I'm from?

Your current city comes from your IP address, looked up in a geolocation database like the ones ad networks use. With a VPN, that's the VPN server's city.

Where you're from is a separate guess. A browser language with a region (pt-BR, en-IN) or one tied to one country (Japanese, Polish) is the strongest hint. Plain US English is every device's default, so then the system time zone decides, and a VPN doesn't change that.

Why can't it tell my age?

Nothing in the browser says it. Ad networks estimate age from behavior: what you read, watch and buy, joined across sites by cookies or a fingerprint. This page sees none of that, so it says so instead of guessing.

What is a browser fingerprint?

Your system draws text and shapes (canvas, WebGL) and processes sound in slightly its own way. Add the installed fonts, the screen and a few settings, hash it all, and you get an ID that comes out the same on every site, in private windows too, with no cookie.

It doesn't depend on your IP, so a VPN doesn't change it. Brave, Firefox with resistFingerprinting and Tor Browser add noise to it; the "Fingerprint protection" row tells you whether yours does.

How do I read the disguise check?

Sites compare your readings with each other. A system time zone that doesn't match the IP's, a language from another country, a DNS server or WebRTC address outside the VPN, a hosting network, or a user agent that the graphics card and JS engine contradict all stand out.

Green means nothing gives you away. Amber is something a careful site could notice. Red is a clear contradiction. Every amber or red row has a "How to fix" tip.

Do you store any of this?

No. The server answers one request, /api/me, with what it already sees in it: your address, the hosting provider's geolocation for it, your headers and its reverse DNS name. It keeps no log.

To find your exits and DNS resolver, the page asks a few outside services directly (they're named in the right-hand column: IPIP.NET, IP.SB, the Cloudflare trace on chatgpt.com, claude.ai and cloudflare.com, Cloudflare Radar, ip-api's DNS server and two STUN servers). They see your address, as any site you visit does.

Your browser keeps one small record, never sent anywhere: the time, fingerprint and city of your last run, so the page can tell whether it recognized you. The × on the fingerprint card deletes it. A shared link carries the portrait without your address or fingerprint.

Why do some rows say "this browser doesn't say"?

Not every browser has every API. Keyboard layout, battery, memory, connection type and client hints are Chromium only. Safari and Firefox share less on purpose, so a missing reading is good news for your privacy.