# SNITCHTEST > SNITCHTEST is a forensic browser privacy audit at https://snitchtest.com. It runs 18+ client-side tests plus server-observed backend probes (real IP, ASN, TLS version/cipher, HTTP protocol, TCP RTT, request header ordering, UA-vs-headers spoof detection) to show every data point a browser leaks to the pages it visits. All tests run in the browser; nothing is logged server-side. ## Network of sibling sites - https://y2kdash.com — Y2KDASH: continuous-monitoring internet speed test measuring latency under load, jitter, packet loss, and bufferbloat. - https://piholekiller.com — PIHOLEKILLER: 103-test adversarial ad-blocker audit across 6 pillars and 3 difficulty tiers, with public leaderboard. - https://adbloat.com — ADBLOAT: ad-tech overhead benchmark with composite A-F letter grade against a naked-Chromium baseline. --- # The Dossier Your Browser Hands Out for Free Source URL: https://snitchtest.com/the-dossier **Summary:** Every site you visit receives an invisible file on you — fingerprint, IP, TLS signature, canvas hash, installed fonts, hardware specs. Here's what's in that file, why your VPN barely reduces it, and why 'anonymous browsing' is mostly theater. > case file · what they already know # the dossier your browser hands out for free You close the curtains. You shred the junk mail. You buy the VPN. Then you open a browser and walk into every website you visit with a nametag, a driver's license, and a short biography pinned to your jacket. Here's what's actually on the nametag, why that thing you just did to hide doesn't hide it, and what to do about it. published 2026-04-19 · ~8 min read · case notes ## 01you were never anonymous The default mental model of "browsing the web privately" is built on two assumptions. First: websites see your IP address, and nothing else useful. Second: incognito mode or a VPN flips you to anonymous. Both are wrong by a very wide margin. Every time a page loads, your browser voluntarily hands the site a long list of technical details it needs to render properly: your screen resolution, your time zone, the fonts you have installed, the graphics card your OS is using, the exact version string of every browser extension's behavior, the pixel noise pattern produced by your GPU when it draws a standard image. Together those details form a fingerprint — a number that, for most real users, is unique. The site then logs that number next to an identifier cookie, and the next time it sees that fingerprint, it knows it's you, cookie or no cookie. Your IP address is one line of the file. The VPN hides that one line. The rest of the file is still stapled to the front. A fingerprint isn't a cookie. You can't delete it. It follows your hardware, not your browser window. ## 02what's actually in the file Here's the short list of what any page you load can read about you, using nothing more exotic than the standard Web APIs that exist so sites can, for example, render correctly on a phone. Every one of these is sent silently, with no permission prompt. data pointhow it leakswhat it tells them public IPTCP connectioncity-level location, ISP, sometimes employer user agentHTTP headerbrowser, version, OS, CPU arch language + timezoneJS + headerscountry, waking hours, travel patterns screen + viewportJS screen.* APIdisplay model, multi-monitor, device class installed fontscanvas enumerationOS + localized app set (Office, Adobe, etc) canvas hashGPU draws a shapeunique to your GPU + driver + OS + browser build audio hashsilent AudioContext renderunique to your audio stack + CPU math WebGL rendererJS getParameterexact GPU make + model string hardware concurrencyJS navigator.*CPU core count device memoryJS navigator.*RAM tier (2/4/8/etc GB) battery stateBattery Status APIlaptop vs desktop, rough uptime local IPs via WebRTCSTUN candidate leakyour LAN IP even behind a VPN TLS fingerprint (JA3/JA4)TLS ClientHello orderyour exact browser build, even on HTTPS Any single entry in that list is mostly harmless. The problem is the combination. Researchers at the EFF's Panopticlick project and successors have shown for over a decade that the combined fingerprint is unique for >95% of browsers in the wild. A unique ID that your browser volunteers to every site is the entire ballgame for tracking. ## 03the canvas trick Canvas fingerprinting is the cleanest illustration of how this works. The site asks your browser to draw a small image — some text, a background, maybe a curve — then reads back the pixels and hashes them. The text rendering uses your OS's font files. The anti-aliasing uses your graphics driver. The color blending uses your GPU's floating-point quirks. Two different machines almost never produce the same pixels. That hash is then stored next to you. Clear your cookies, close your browser, switch to incognito — the same hardware produces the same hash. You're still you. Audio fingerprinting does the same thing with an AudioContext that renders a silent, inaudible signal and reads back the tiny floating-point differences. The user never hears anything. The site gets another unique-per-machine hash to combine with the canvas one. ## 04webrtc: the worst-behaved api on the web WebRTC is the browser API built for video calls. Its job includes figuring out every possible network path the call might take, which means asking your operating system for all your network interfaces and their IPs, then offering those to the other side of the call in something called "ICE candidates." Done correctly, that's fine. Done by a random webpage with no call in progress, that's a leak. The page quietly opens a PeerConnection it never intends to complete, asks for candidates, and receives back: your LAN IP, your VPN's internal IP, your physical NIC's IP, and in many configurations your real public IP even while a VPN is active. Most commercial VPNs don't stop this because they can't — it's not traffic that flows through their tunnel, it's your OS talking to your browser. Browser-level defenses (the force-relay setting in Chrome, uBlock Origin's "Prevent WebRTC from leaking local IP addresses") actually work, but most users never touch them and most VPN apps don't set them. If your VPN's marketing promises privacy and your browser still leaks your real IP via WebRTC, the VPN is shipping the privacy part as your problem to solve. ## 05tls fingerprinting is invisible and unfixable TLS (the S in HTTPS) opens every secure connection with a message called the ClientHello. It contains the cipher suites your browser supports, in the order your browser prefers them, plus a handful of extensions. That list is so distinctive that each major browser version has its own recognizable signature. Researchers give those signatures names: JA3 and the newer JA4. Unlike most of the tracking surface, TLS fingerprinting works server-side, with no JavaScript required, on the very first packet of the connection. Even sites you block scripts on can log your JA4. Tor and some hardened browsers deliberately mimic a common fingerprint to blend in; most users never think about it. This is why the "I use Brave / LibreWolf / Mullvad Browser" crowd still gets fingerprinted. Swapping browsers shifts your JA4 into a different bucket but doesn't empty the bucket. If your browser choice is rare enough, it makes you easier to track, not harder. ## 06what VPNs and incognito actually do A VPN hides the TCP-layer public IP your ISP assigned you. That's it. That's one field out of thirteen in the dossier above. Everything else — canvas hash, WebGL renderer, installed fonts, TLS JA4, WebRTC-leaked LAN IP — a VPN does nothing about. A reputable VPN does make it harder to correlate your activity with your physical location. That's real. It also means the marketing that says "privacy" instead of "IP-layer unlinkability" is doing heavy lifting. Incognito mode is even narrower. It stops the browser from writing cookies and history to disk on this machine. It does nothing on the network. Every request you send looks identical to a non-incognito request from the same browser. Fingerprinting works exactly the same. toolhides IP?hides fingerprint?hides TLS signature? incognito modenonono commercial VPNyesnono uBlock Origin + medium modenopartialno Brave / LibreWolfnoreduces uniquenessshifts bucket Tor Browseryesyes (standardized)yes (standardized) ## 07what actually moves the needle If you want to reduce the dossier, the interventions that work — roughly in order of effort vs. payoff — are: - Turn on your browser's fingerprinting defense. Firefox has privacy.resistFingerprinting. Brave ships with "strict" fingerprint protection. These lie to sites about canvas, WebGL, and fonts — not perfectly, but enough to collapse your uniqueness meaningfully. - Disable WebRTC peer discovery or set the force-relay policy. Chrome extensions like WebRTC Network Limiter do this. uBlock Origin has a one-checkbox version. - Use uBlock Origin in medium mode. It blocks third-party scripts and frames by default, which stops most fingerprinting libraries from loading at all. - Tor Browser, for the sessions that matter. Its whole design philosophy is to make every Tor user look identical. You pay for this in speed and some site breakage. For the subset of your life that actually needs anonymity, that tradeoff is usually worth it. - Accept that you will still be fingerprinted by state-level actors. These defenses raise cost. They don't make you invisible to anyone with real resources. The useful goal is not being cheap to track at scale, not zero information leakage. ## 08how to read your snitchtest result SNITCHTEST runs 18 live tests in parallel when you click the button. Each row shows the data point, the value the test extracted from your browser, and a factual note. Red rows are leaks that expose you. Amber rows are neutral telemetry. Green rows are tests you passed — defenses in place, a signal blocked, a request refused. What to scan for first: - WebRTC local IP row. If it shows your LAN IP while you're on a VPN, that's a leak, full stop. Fix it before you fix anything else. - Canvas + audio + WebGL rows. If all three show unique values, you're a fingerprinting bullseye. Installing a fingerprint-defense extension or switching to Brave will visibly change those values on your next run. - Timezone + language vs. IP country. A mismatch (IP in Frankfurt, timezone America/New_York, language en-US) is a signal you're on a VPN — not a leak, but a classification signal advertisers use. - DNT / GPC rows. These are privacy-signal standards your browser can send. Most sites ignore them, but the laws pointing at some of them (CCPA, Colorado Privacy Act) are starting to treat them as opt-out. Turning them on costs nothing. ## 09faq ### What is browser fingerprinting? A tracking technique that combines dozens of technical details a browser voluntarily reports (screen size, timezone, fonts, GPU, audio stack, TLS signature, and many more) into a single identifier that is unique to most individual browsers. Unlike cookies, a fingerprint cannot be deleted because it follows the hardware and browser, not the storage. ### Can a VPN stop browser fingerprinting? No. A VPN hides your public IP address only. Everything else a fingerprinting script reads (canvas hash, WebGL renderer, installed fonts, TLS JA4, language, timezone, hardware details) is untouched by a VPN. Your fingerprint is identical with or without the VPN connected. ### Does incognito or private browsing stop tracking? No. Incognito mode prevents the browser from writing cookies and history to local disk on your computer. It does nothing on the network side. Every request from an incognito tab carries exactly the same fingerprint as a normal tab. ### What is a WebRTC leak? WebRTC is the browser API for video calls. It enumerates all of your operating system's network interfaces to find call routes, which means it can expose your LAN IP and often your real public IP even while a VPN is active. A WebRTC leak happens when a website silently opens a WebRTC connection it never completes, just to collect the IPs it returns. ### What is canvas fingerprinting? A technique where a page asks the browser to draw a small image using HTML canvas, then hashes the pixel data. Different combinations of GPU, driver, OS, and browser produce subtly different pixel output. The hash is unique to the machine and survives clearing cookies or switching to incognito mode. ### What is TLS fingerprinting (JA3 / JA4)? TLS fingerprinting identifies the software making an HTTPS connection by inspecting the TLS ClientHello packet's cipher suite list and extension order. Every browser version has a recognizable signature. JA3 is the older format, JA4 is the newer. Unlike JavaScript-based fingerprinting, TLS fingerprinting works server-side on the first packet and cannot be blocked by an extension. ### What actually stops browser fingerprinting? Enabling browser-level fingerprint protection (Firefox privacy.resistFingerprinting, or Brave Shields with Strict fingerprinting), installing uBlock Origin to block third-party scripts, and blocking WebRTC peer discovery. For the strongest anonymity, Tor Browser makes every user look identical but costs speed and site compatibility. Full walkthrough: How to Actually Stop Fingerprinting. ## 10the short version The web was not designed to be private. It was designed to let pages render correctly across an impossible diversity of machines, and the APIs that enable that correctness are also the APIs that turn your machine into a uniquely shaped key. Hiding your IP without hiding anything else is the online equivalent of putting a hat on before a fingerprint scan. The goal isn't paranoia. The goal is knowing what's actually leaking so you can decide what to patch, what to accept, and when to stop trusting tools whose marketing is writing checks their engineering doesn't cash. > run the audit see your own file SNITCHTEST runs all of the tests above live in your browser. Nothing is sent to a server. Click, watch the data come back, and decide what to do about it. > RUN SNITCHTEST → --- # How to Actually Stop Browser Fingerprinting (Without Breaking Every Site) Source URL: https://snitchtest.com/how-to-stop-fingerprinting **Summary:** Browser fingerprinting isn't stopped by incognito or by most VPNs. Here's what actually works: the exact Firefox, Brave, Chrome, and Safari settings, which extensions matter, and how to verify the fix with a leak test. > countermeasures · the actually-works list # how to actually stop browser fingerprinting The defenses that work aren't the ones in the marketing. Incognito doesn't help. A VPN barely helps. The things that collapse you from uniquely identifiable to blandly anonymous are a short list of specific browser settings and two specific extensions. Here's the complete list, in order of effort vs. payoff, plus what to expect to break. published 2026-04-21 · ~9 min read · protocol notes ## 01the honest cost/benefit Every defense on this page costs something. Some cost speed. Some break sites. Some cost convenience. The goal isn't "maximum paranoia." The goal is shedding uniqueness — moving your browser from a snowflake that can be identified across sessions to a flake that looks like everyone else in its bucket. You can keep shopping, streaming, banking, and watching YouTube while doing this. You just stop being a person-shaped dossier. defenseeffortsite breakageuniqueness drop WebRTC peer-discovery block1 minalmost nonemedium Brave Shields Strict fingerprinting30 secalmost nonelarge Firefox resistFingerprinting1 minsomelarge uBlock Origin + medium mode10 minsome (fixable)large Arkenfox user.js (Firefox)30 minsomevery large Tor Browser5 minnotablelargest The best browser for anti-fingerprinting isn't the one that hides the most signals. It's the one whose users all look identical. Blending in beats hiding. ## 02seal the webrtc leak first This is the single most important fix, because it's the one that leaks your real IP while your VPN is on. If you're on a VPN and your WebRTC Local IP row in SNITCHTEST shows your actual LAN or public IP, everything else on this list is secondary. ### chrome, edge, brave, opera, arc (chromium family) Install the WebRTC Network Limiter extension published by Google itself. Open its options and pick "Use my proxy server (if present); otherwise use any other routes". That setting forces Chrome to route WebRTC through your VPN or not at all, which eliminates the leak without breaking video calls. ### firefox Visit about:config, accept the warning, and set: media.peerconnection.ice.default_address_only = true media.peerconnection.ice.no_host = true The first setting makes WebRTC use only the default route (the VPN, if active). The second stops WebRTC from enumerating local interfaces at all. Together they close the leak without disabling video calls. ### safari Safari disables the leak by default for non-HTTPS origins and routes conservatively on HTTPS. There's no knob. Verify with a leak test. ## 03enable browser-level fingerprint protection ### brave (easiest) Settings → Shields → Block fingerprinting: Strict. That's it. Brave randomizes canvas, audio, WebGL, and font enumeration per site per session, which breaks cross-site tracking without breaking the sites themselves. The default is "Standard," which is good enough for most users; Strict is better. ### firefox Visit about:config, set privacy.resistFingerprinting = true. This activates Mozilla's Tor-derived anti-fingerprinting code, which standardizes values (screen size, fonts, timezone, more) so that every user with the setting on looks like every other user with the setting on. Cost: timezone reports as UTC, your window is forced into discrete sizes on resize, some fonts appear as "missing." A handful of sites will render slightly wrong. Most won't notice. If you want the anti-fingerprint protection without the timezone spoof (the most annoying part), use privacy.fingerprintingProtection = true in recent Firefox builds, which is a softer variant. ### chrome and edge Chrome has no built-in anti-fingerprinting and no roadmap for one. Edge has a few heuristic defenses under Tracking Prevention → Strict, but they don't rival Brave or Firefox. If you want Chromium's compatibility with real anti-fingerprinting, use Brave. This is the actual answer. ### safari Settings → Advanced → Show Develop menu. Turn on Intelligent Tracking Prevention (it's on by default since Safari 13). Turn on "Hide IP address from trackers" (Safari 15+). Safari's fingerprint defense is weaker than Brave's but it's built in and on by default, which is not nothing. ## 04install ublock origin (still) uBlock Origin is the single highest-leverage privacy extension. Most fingerprinting happens inside third-party scripts loaded by tracking SDKs. Stop the scripts from loading and the fingerprinting doesn't run. Default mode is fine. Medium mode is better. Open uBlock → Dashboard → Settings → "I am an advanced user." Back on the main popup, click the padlock next to "3rd-party scripts" and "3rd-party frames" and set both to globally blocked. Use the per-site padlocks to allow scripts on sites that actually need them. This breaks things until you adjust, then it settles into a much cleaner browsing experience. ## 05the firefox power-user path: arkenfox Arkenfox user.js is a community-maintained set of about:config overrides that turn a stock Firefox into something approaching Tor Browser's protection, without the network anonymization. It's overkill for most people and it costs real convenience (you'll log into some sites every day, because it clears cookies on close). For the right user, it's the best non-Tor option that exists. ## 06what about a different browser entirely? ### brave The practical recommendation for most users. Chromium-compatible (extensions work, sites work) but with real fingerprint defenses on by default. Pick Strict shields and you're ahead of 99% of the internet without doing anything else. ### librewolf / mullvad browser Firefox forks with Arkenfox-level defenses baked in. LibreWolf is general-purpose; Mullvad Browser is a Tor-Project-collaborated build specifically aimed at non-Tor users who want Tor-style fingerprint protection. ### tor browser The gold standard. Every user looks identical by design. Use it for the specific sessions that need it, not for everything, because pages are slower and a lot of sites challenge Tor traffic. ### safari on iPhone Under-rated. iCloud Private Relay, if enabled, is effectively a lightweight Apple-run proxy that strips your IP from the first hop. Safari's default tracking prevention is solid. The iPhone's narrow hardware variety means your canvas/WebGL hash is already shared with millions of other iPhones. ## 07what doesn't work - Incognito / InPrivate mode. Hides cookies from the local disk. Changes nothing about the network or the fingerprint. Most useful trick is testing a site while signed out. - "Privacy-focused" search engines. Valuable for search history, irrelevant for fingerprinting. - Consumer VPNs alone. They change your IP. The fingerprint is still yours. - Deleting cookies every session. Cookies are the least interesting part of the dossier. The fingerprint re-identifies you inside a second. - Fake User-Agent extensions. They change one field that servers compare against twelve other fields. Most just make you weirder and thus more unique. ## 08verify with a leak test After any change, confirm it actually took effect. Run SNITCHTEST (you're on the site), EFF's Cover Your Tracks, or creepjs. The specific rows to watch for improvement: - WebRTC local IP — should show blocked / default route only. - Canvas / WebGL / Audio fingerprint — should change between sessions on Brave (randomized) or show standardized values on Firefox RFP. - Timezone + language — should no longer disagree with your VPN exit country if you enabled resistFingerprinting. - Installed fonts — the detected count should drop sharply. Full list should not be exposed. Re-run after each change, one at a time, so you know which defense did what. When you're done, your SNITCHTEST grade should shift noticeably from red toward green. ## 09faq ### Does incognito mode prevent fingerprinting? No. Incognito only stops the browser from writing history and cookies to the local disk. Every network request still carries the same browser fingerprint, the same TLS signature, and the same IP address. Sites cannot tell an incognito tab from a regular tab by looking at its fingerprint. ### Does a VPN hide my browser fingerprint? No. A VPN hides your public IP address. Browser fingerprinting uses canvas, WebGL, audio, font enumeration, TLS signature, and other surfaces that a VPN has no effect on. Your fingerprint is identical whether or not the VPN is connected. ### What actually stops browser fingerprinting? The two changes that move the needle most are enabling your browser's built-in fingerprint protection (Firefox privacy.resistFingerprinting, Brave Strict fingerprinting) and installing uBlock Origin with third-party scripts disabled. Those two together typically drop a browser from uniquely identifiable to a common bucket. Tor Browser is the gold standard but comes with speed and site-compatibility costs. ### Is Brave or Firefox better for anti-fingerprinting? Both are strong and target slightly different threat models. Brave randomizes values per site per session, which confuses cross-site tracking. Firefox standardizes values so that users of the same Firefox build look identical, which is closer to the Tor approach. Either is substantially better than stock Chrome or Safari. ### Why is WebRTC leaking my IP while the VPN is on? WebRTC asks your operating system directly for every network interface, including the real one your VPN is tunneling over. That enumeration bypasses the VPN tunnel and goes straight to the web page. The fix is browser-level: block or limit WebRTC peer discovery via a browser flag or an extension. Most VPN apps do not do this for you. ### Does hardening my browser break websites? Some strict settings do break a small number of sites, mostly ones that depend on WebRTC, third-party scripts, or precise canvas rendering. Most breakage can be resolved by allowlisting a site in uBlock Origin. The default Brave Strict setting breaks far fewer sites than Firefox resistFingerprinting does, because Brave randomizes rather than freezes values. ### Should I use Tor Browser for everyday browsing? Generally not. Tor Browser's anti-fingerprinting is the strongest on the web but the price is slow pages, more CAPTCHAs, and some site breakage. A common pattern is to run Brave or hardened Firefox for daily browsing and keep Tor Browser installed for the subset of sessions that require stronger anonymity. > verify your changes run snitchtest again After you change a setting, run the audit again. The red rows should shift toward green. That's the whole feedback loop. Nothing is logged server-side. > RUN SNITCHTEST →