I built this after a thread here about Alibaba using an audio-context trick to
fingerprint visitors. I knew a fair number of fingerprinting methods but not that
one, and I wanted to see all of them in one place, running against my own browser.
GlassBox runs ~31 probes (canvas, WebGL/WebGPU, audio, fonts, the WASM feature
set, math/engine quirks, WebRTC IP, timezone/locale, the permission and API
matrices, an incognito heuristic, cross-site login-state, and so on) and shows the
raw values plus an estimate of how identifiable you are.
A few deliberate choices:
- One static HTML file, no dependencies, no build step. Everything runs
client-side and nothing is sent, with one opt-out exception: IP geolocation,
which calls a public API. I didn't want a privacy tool that phones home.
- The "identifiability" number is an honest model, not a measurement. It sums
published per-signal entropy (Panopticlick / AmIUnique / Cover Your Tracks),
discounts signals your browser masks, and caps at the ~33 bits needed to single
out one person on Earth. A no-server tool can't compute true rarity against a
live population, so I label it an estimate instead of pretending. For real
population numbers, Cover Your Tracks and AmIUnique have the datasets.
- There's a companion guide on lowering your fingerprint, with the caveat that
uniqueness isn't privacy: blending into a big crowd (Tor at its default size)
beats a bespoke hardened setup that makes you the only one who looks like that.
If you’re ESL, that’s not an excuse. You can write something in your own language and use a translator or even an LLM to translate it.
But using an LLM to write is delegating your cognition to a machine. At that point, you’re acknowledging that your own cognition has no value, so why are you trying to inflict a faked version of it on the rest of us?
Fun fact: some malware won't execute if it sees a Russian/Ukrainian keyboard layout, because the authors avoid hitting victims in their own jurisdiction.
If it changes every load, that's your browser farbling canvas/audio per-read (Brave or Firefox), which means the anti-fingerprinting is working. We missed crediting that in v1, so it should read lower now if you reload.
That panel reconstructs what a pixel would send from your own browser values, locally, and never makes the request. NextDNS seeing nothing is the tool working exactly as designed.
GlassBox runs ~31 probes (canvas, WebGL/WebGPU, audio, fonts, the WASM feature set, math/engine quirks, WebRTC IP, timezone/locale, the permission and API matrices, an incognito heuristic, cross-site login-state, and so on) and shows the raw values plus an estimate of how identifiable you are.
A few deliberate choices:
- One static HTML file, no dependencies, no build step. Everything runs client-side and nothing is sent, with one opt-out exception: IP geolocation, which calls a public API. I didn't want a privacy tool that phones home.
- The "identifiability" number is an honest model, not a measurement. It sums published per-signal entropy (Panopticlick / AmIUnique / Cover Your Tracks), discounts signals your browser masks, and caps at the ~33 bits needed to single out one person on Earth. A no-server tool can't compute true rarity against a live population, so I label it an estimate instead of pretending. For real population numbers, Cover Your Tracks and AmIUnique have the datasets.
- There's a companion guide on lowering your fingerprint, with the caveat that uniqueness isn't privacy: blending into a big crowd (Tor at its default size) beats a bespoke hardened setup that makes you the only one who looks like that.
Source (MIT): https://github.com/HotStartLabs/glassbox
I'd genuinely like to know which vectors I'm missing, especially from the anti-fraud / detection side.