What Do Websites Know About Me?
Read in plain sentences what any website learns the moment you open it, and what it cannot see without asking you first.
A website you visit sees…
What a site learns the moment you open it, written as sentences rather than fields.
Your address
You are connecting from 216.73.216.7, an IPv4 address.Roughly where you are
A geolocation database places that address near Columbus, Ohio, United States, and labels the estimate approximate.Who carries your traffic
Your traffic leaves through Anthropic, PBC (AS16509), which looks like a hosting or data centre connection.What your browser volunteers
Your browser introduces itself as ClaudeBot 1.0 on an unrecognised system, and asks for content in no stated language.Where you came from
This request carried no referrer, so nothing told us which page you came from.How the connection was made
You reached us over HTTP/2 with TLSv1.3.What a site cannot see
Your name, your street address, your files, your other tabs and your precise location.Privacy score
Informational only, and it decides nothing.
Your setup is unremarkable, which on the open web is the state you want. Three of the rows below still need values from your browser. They are counted as soon as this page finishes loading them.
This number gates nothing. It unlocks nothing, and no offer on this site depends on it. It exists so you can see which signals matter and check the arithmetic against the published rubric.
The privacy score rubric
The score is informational. It never gates a feature, never unlocks anything, and never triggers an affiliate offer. It exists so you can see which signals matter and why, and the full rubric is published here so you can check our arithmetic.
The score starts at 100 and subtracts for signals that make you easier to single out.
| Signal | Deduction | Where the value comes from | Reason |
|---|---|---|---|
| Address classified as residential or mobile, not a VPN, proxy, or relay egress | -10 | Server, from the AS type | Your ISP address is stable and ties to a subscriber record your ISP holds |
| Public address is not shared (no CGNAT, no relay) | -5 | Server, from the address range | A shared address puts you in a crowd; a dedicated one does not |
| IPv6 address present with a stable interface identifier | -5 | Server, only when this page arrived over IPv6 | A stable /64 plus a stable suffix follows you across sites |
| More than two entries in Accept-Language | -5 | Server, from the request header | Long language lists are uncommon and therefore distinctive |
| Screen resolution outside the twenty most common sizes | -5 | Your browser, after the page loads | Rare resolutions narrow the group fast |
| Device pixel ratio other than 1, 2, or 3 | -3 | Your browser, after the page loads | Fractional DPRs are uncommon on the open web |
| Browser more than three minor versions behind current | -5 | Not checked here | Old builds are a small and identifiable population |
| WebRTC exposes a public address that differs from the connection address | -15 | Not checked here; run the WebRTC leak test | A live leak, and the largest single deduction here |
| DNS resolvers do not match the network your traffic egresses from | -10 | Not checked here; run the DNS leak test | Another live leak, visible to any site that runs a leak test |
| Third-party cookies accepted | -5 | Not checked here | Cross-site tracking works by default |
| No Global Privacy Control signal sent | -3 | Your browser, after the page loads | GPC is a legally recognised opt-out in several jurisdictions |
Nothing is added back. A score above 80 means your setup is unremarkable, which on the open web is the desirable state. A score below 50 usually points at one of the two leak deductions, and both of those are fixable.
Rows marked “not checked here”
Four rows are listed for completeness and deduct nothing on this page, and the page labels them as unchecked rather than passing them silently.
- WebRTC and DNS resolvers are live leak tests. Measuring them means opening peer connections and issuing DNS probes, which belongs on the leak-test pages rather than on a page that describes what arrives passively. Run them there and read the verdicts.
- Browser version currency would need a table of current release numbers shipped in the page and kept fresh. We do not ship one, so scoring it would be guesswork with a number attached.
- Third-party cookies cannot be probed without loading a third-party frame. Loading one to test whether third-party loading works is exactly the behaviour this page is about.
The twenty screen sizes
A resolution counts as common if it matches one of these, in either orientation.
1920×1080, 1366×768, 1536×864, 1280×720, 1440×900, 1600×900, 1280×1024, 1024×768, 2560×1440, 1680×1050, 360×800, 390×844, 393×873, 414×896, 375×667, 412×915, 428×926, 360×640, 430×932, 384×854.
The interface identifier test
An IPv6 suffix counts as stable when it contains the ff:fe marker of an EUI-64 address derived from a MAC address, or when the last 64 bits hold at most two non-zero groups, which is what a hand-assigned address such as 2001:db8::1 looks like. A suffix generated by SLAAC privacy extensions (RFC 8981) looks random and does not match either test.
What the score deliberately ignores
It does not count canvas, audio, or font fingerprinting, because measuring those requires running them, and running them is the behaviour we are describing as a problem. It does not count your operating system, since every OS is common enough to be uninteresting on its own. It does not count “you visited a website”, which is not a finding.
Why there is no red banner
A number on a page cannot tell you whether your setup is safe, because safety depends on who you are avoiding and why. A journalist under state surveillance and a person avoiding a retargeting ad have nothing in common except the word privacy. Scores that flash red exist to sell something. This one is a checklist with arithmetic attached.
About this tool
This page reads the signals every website gets from you and writes them out as sentences rather than fields. It covers your address and approximate location, your ISP, the headers your browser sends, your languages, and what your TLS and HTTP versions imply, and it says plainly what a site cannot see without asking you first. It ends with a privacy score explained by a published rubric, which gates nothing.
How to read the result
- Your address and approximate location
- The source address of your connection, plus the city, region, and country a geolocation database associates with its prefix. It is labelled approximate because it reflects ISP routing location rather than a street address.
- Your network
- The ISP name and the autonomous system announcing your prefix, plus a classification of residential, mobile, business, or hosting.
- What your browser volunteers
- User-Agent, Accept-Language, the Sec-CH-UA client hints, fetch metadata, and referrer information. None of this needs permission, and it rides along on every request your browser makes.
- What your protocol reveals
- Your TLS version, cipher preference order, and HTTP version. The ordering inside the TLS ClientHello is stable enough per browser build to work as a coarse fingerprint, which is how some anti-bot systems tell curl from Chrome.
- What we cannot see
- Your name, your device identifiers, your street address, your other tabs, the files on your machine, and anything behind a permission prompt, such as precise geolocation, the camera, or a clipboard read.
- Privacy score
- A count of the signals that make you less distinct, scored against the rubric published below. It is informational only, it gates nothing on this site, and it never triggers an offer.
Questions people ask
- Can a website see my exact location?
- Not without permission. Geolocation from your address is approximate and reflects ISP routing, often the wrong city and never a street. Precise location comes from the browser Geolocation API, which shows a permission prompt first and uses GPS, Wi-Fi, and cell data.
- Can a website see my name or email?
- Not from the connection itself. Those become visible only when you type them, when you are logged in to that site, or when a third-party script matches you to an identity from a previous login elsewhere. None of that is what this page measures.
- Does incognito or private browsing hide any of this?
- Almost none of it. Private windows discard cookies and history when you close them. Your address, headers, language, screen size, and protocol fingerprint are identical to a normal window.
- Does a VPN stop websites from seeing all this?
- A VPN replaces the address and therefore the location and ISP. It changes nothing about your browser headers, languages, screen size, or protocol fingerprint. Sites that fingerprint the browser can still recognise the same visitor across VPN servers.
- What is the single most identifying thing on this page?
- For most people it is the combination rather than any one item. A common browser on a common OS in a common country is unremarkable; an unusual language list, an unusual screen size, or a rare browser version narrows the group quickly. That is why the rubric below rewards being ordinary.
Related
Last reviewed 2026-09-05.