What Your Browser Reveals About You (and What It Doesn't)

Without asking, a page can read your user-agent string (browser, engine and operating system), your preferred languages, screen and window dimensions, device pixel ratio, colour depth, time zone, and your light-or-dark theme preference. It can also see coarse hardware hints such as the number of logical CPU cores and an approximate memory tier, whether the screen is touch-capable, and — through a throwaway WebGL context — the name of your graphics adapter.

Individually these look harmless, and they are exactly the values DeviceScope shows you on the Browser & System panel. They exist for good reasons: a site needs your viewport size to lay out responsively and your language to pick a translation.

The privacy concern is not any single value but the combination. When you put your fonts, screen size, GPU string, time zone and language together, the result is often unique enough to recognise your browser again later without any cookie — a technique called fingerprinting. The more unusual your configuration, the more identifiable you are.

Browsers are pushing back. Modern Chrome ships a deliberately reduced user-agent string, Safari rounds or withholds several signals, and Firefox offers resist-fingerprinting modes. That is also why some values on a device checker read as "not available": the browser is protecting you, not malfunctioning.

Not every signal is equally revealing. Researchers measure fingerprinting surfaces in bits of entropy — how much each one narrows the field of possible browsers — and a handful of them dominate the total. Canvas rendering is one: ask the browser to draw the same text and shapes offscreen, read the pixels back, and small differences in font rasterisation, anti-aliasing and graphics driver produce a hash that is stable for your machine and different on most others. The WebGL renderer string is another, because it names one specific adapter out of thousands. An audio context can be measured the same way — process a known waveform and the floating-point output varies subtly across hardware and audio stacks.

Font enumeration is a third. A page cannot ask for a list of your installed fonts, but it can measure the rendered width of a test string in a few hundred candidate families and infer which ones resolved; the resulting set says a great deal about your operating system and the software you have installed. Screen metrics round out the picture — an unusual resolution, a fractional device pixel ratio left over from browser zoom, or a non-default colour depth each add bits of their own. The pattern is that none of these are secrets in isolation. They leak because they are measurable, repeatable, and rarely identical between two machines.

Browser vendors have pushed back by making several readings deliberately blunt. navigator.hardwareConcurrency reports logical CPU cores, but it is clamped in places: Firefox's resist-fingerprinting mode returns a fixed 2, and Safari caps the figure on some devices, so a powerful machine can honestly report far fewer cores than it has. navigator.deviceMemory is coarser still — it is rounded to a short list of buckets (0.25, 0.5, 1, 2, 4 and 8 gigabytes) and capped at the top, so a workstation with 64GB simply reports 8. The value is a tier for deciding how much work to attempt, not a specification of your RAM.

Other readings have been withdrawn altogether. The Battery Status API, which exposed charge level and charging state, was removed from Firefox and never shipped in Safari, after researchers showed that a precise discharge figure can act as a short-lived identifier linking one session to the next. It survives in Chromium, which is why a battery reading appears on some devices and is absent on others. When DeviceScope shows a rounded bucket or an empty field, it is showing you the browser's real answer — the shape of the privacy defence, not a gap in the tool.

Here is the line a browser-only tool cannot cross. Your public IP address is only known to a server you connect to, so a page with no backend simply cannot display it — DeviceScope does not, because doing so would require sending your traffic somewhere. Your precise location, camera, microphone, clipboard contents and files all sit behind an explicit permission prompt, and other browser tabs, your browsing history and saved passwords are completely walled off.

So if a site claims to reveal your IP or exact address without any server and without asking, be sceptical: it is either quietly contacting a backend or making it up. An honest local tool tells you plainly when something is simply out of reach.