Browser/session exposure map

What Websites Can See About Me

Loading a page hands over three things before a single line of script runs: an IP address, a set of request headers, and whatever cookies that domain already set. Everything past that point is something a script chose to ask for, and most of it arrives without a prompt.

Run Public Exposure Report Check browser privacy

Visible signals Safe receipt Not a certification

Arrives automatically

Your public IP address and everything derivable from it, the request headers the browser attaches to every request, and any cookies that domain set on an earlier visit. No script and no prompt are involved.

Available for the asking

Screen and locale values, hardware bands, canvas, WebGL, audio and font behavior, stored data, and WebRTC candidates. A script reads these silently and no permission dialog appears.

Requires you to agree

Precise geolocation, camera, microphone, notifications and clipboard reads sit behind a browser prompt. The distance between this short list and the long one above it is the part most readers underestimate.

Layer one

What the connection reveals before any script runs

These arrive with the request itself. Blocking scripts, refusing cookies and browsing in a private window change none of them.

Your public IP addressAnd through public registry data, the network holding it: the ASN, the organization that operates it, and the country of registration. That is usually enough to name your ISP, your employer, or the hosting company or VPN provider you are routing through. Check yours with the IP Geolocation Lookup.

A location estimate, inferred rather than measuredCity-level placement comes from a commercial database that maps address ranges to places. It is an inference about the network, not a reading from your device, and it can be wrong by a country. It is a different thing entirely from the Geolocation API, which cannot return anything until you approve a prompt. How IP geolocation works.

Your request headersUser-Agent, the languages you accept, and the low-entropy Client Hints. See exactly what your browser is sending with the HTTP Headers Checker.

Where you came from, but only in partChrome has defaulted to the strict-origin-when-cross-origin referrer policy since version 85 in 2020, and Firefox since March 2021. A cross-site referrer now carries the origin alone, so the destination learns you arrived from example.com and not which page of it you were reading.

Cookies that domain already setAnything it stored on a previous visit comes back attached to the request. This is the one item on the list you can clear, which is also why tracking moved on to the items you cannot.

Layer two

What a script can collect once the page loads

None of the following opens a dialog. They are ordinary web APIs doing what they were specified to do, and the privacy question is about the combination rather than any single value.

Device and locale valuesScreen dimensions, color depth, device pixel ratio, timezone, your full accepted-language list, touch support, logical core count, and a coarse memory band. Timezone and language are the two that most often contradict a VPN exit in another country.

Rendering behaviorThe same canvas drawing, WebGL scene or audio buffer comes out subtly different across GPU, driver and operating-system combinations, which is what makes the result identifying. The Browser Fingerprint Test estimates the combined surface.

Your font setWhich fonts resolve reveals the operating system and often the software installed on top of it.

High-entropy Client Hints, on requestDevice model, full version list, architecture and platform version are withheld until a site asks for them, either with an Accept-CH response header or by calling getHighEntropyValues(). The Client Hints Checker shows which ones your browser will hand over.

WebRTC ICE candidatesThe one item here that can carry a network address rather than a device characteristic. Candidate gathering asks the operating system for interface addresses from inside the browser process, with no prompt, which is why it can reveal an address a VPN is otherwise masking. What a WebRTC leak is, and the WebRTC Leak Test.

Storage it wrote earlierCookies, localStorage and IndexedDB for that origin, all readable on return.

The other side of the ledger

What a page load does not give away

The list of exposures is long enough that the boundaries are worth stating plainly, because overestimating them leads people to ignore the real ones.

Files on your device, or other tabsThe same-origin policy keeps one site's script out of another site's pages and away from the local filesystem. A page cannot enumerate your documents or read what you have open elsewhere.

Your browsing elsewhere, unless the same script is there tooA first-party site sees its own pages. Cross-site history is assembled by third-party scripts that run on many sites and recognize the same visitor, which is why the embedded script matters more than the site you are looking at.

Your name, address or accountsUnless you have given them to that site, or are signed in to it.

Anything outside the browserOther applications, system files and local network devices are out of reach of a page load.

To see the whole inventory against your own session rather than in the abstract, run the Public Exposure Report once now as a baseline, then again after changing a browser or network setting. If a VPN is meant to be carrying this session, check that it actually is before drawing conclusions from the IP line.

Safe Receipt limits

Safe Copy reduces the inventory above to categories: it removes the raw IP address, the exact city, the full User-Agent string, raw DNS resolver addresses and raw WebRTC candidates. Share the reduced form rather than the raw one.

Review the Safe Privacy Receipt model before sharing diagnostics.

FAQ

Questions this page answers

Can a website see my exact address from my IP?

No. Placement comes from a database that maps address ranges to locations, so it describes the network rather than the device, and it is routinely wrong at city level and occasionally wrong at country level. A street address requires the Geolocation API, which cannot return anything until you approve a permission prompt.

Can a website read files on my computer?

No. A page cannot reach the filesystem or another tab; the same-origin policy blocks both. It can read what you upload through a file input, and what it previously stored in cookies, localStorage or IndexedDB for its own origin.