Who Are You
71 sniffers · no permission asked
Probably from , now in . You speak , on with a clock.
You use on : a screen and graphics.
You connect through , ; your DNS resolver is in .
You prefer and . Your fonts say: . Your age: .
CF-Connecting-IPrequest.cf.cityrequest.cf.latituderequest.cf.asOrganizationedns.ip-api.comrequest.cf.timezoneDNS PTRrequest.cf.colorequest.cf.tlsVersion/cdn-cgi/trace · kex, sni/cdn-cgi/trace · warpTLS ClientHelloDate.now()RTCPeerConnection · STUNWebRTC host candidatemyip.ipip.netapi.ip.sbchatgpt.com/cdn-cgi/traceclaude.ai/cdn-cgi/tracewww.cloudflare.com/cdn-cgi/traceCloudflare Radar · IPv4 / IPv6User-AgentAccept-LanguageSec-CH-UASec-CH-UA-PlatformAccept-EncodingDNT · Sec-GPCReferer · document.referrernavigator.languagesIntl.DateTimeFormatIntl …timeZoneIntl …hourCycleIntl.Locale weekInfoIntl.NumberFormatnavigator.keyboardspeechSynthesisuserAgentDatauserAgentData.brands…architecture · bitnessscreen · devicePixelRatiorequestAnimationFramescreen.isExtended · screenXWebGL RENDERERnavigator.gpu adapter.infohardwareConcurrencynavigator.deviceMemorymaxTouchPoints · pointernavigator.getBatterynavigator.connectionenumerateDevicesMediaSource.isTypeSupportedrequestMediaKeySystemAccessstorage.estimateprefers-color-schemeprefers-reduced-motioncolor-gamut · dynamic-rangedoNotTrack · GPCnavigator.cookieEnabledpermissions.querypdfViewerEnablednavigator.webdriverbait elementwindow.ethereum · DOM markshistory.lengthcanvas measureTextcanvas.toDataURLWebGL getParameterOfflineAudioContextfonts → SHA-256SHA-256canvas × 2It runs the same sniffers any website can run the moment you open it, then writes down who that makes you: where you probably come from, where you are, what you use and what you like.
Every blank in the paragraph says on hover which sniffers it came from, and the list below shows each sniffer, how it reads (the API or header in the right column) and what it read. None of them shows a permission prompt.
The city comes from your IP address, looked up in Cloudflare's geolocation database, the same kind of database every ad network uses. With a VPN it's the VPN server's city.
Nationality is a guess from your browser language (zh-TW points to Taiwan, pt-BR to Brazil) and the time zone your system is set to, which a VPN doesn't change. Plain US English is every device's default, so then the time zone decides.
Because nothing in the browser says it. Ad networks estimate age and gender from your behavior: which sites you visit, what you watch and buy, often joined across sites by the same fingerprint or cookies. This page reads none of that, so it says so instead of making something up.
Small differences in how your system draws text and shapes (canvas, WebGL), processes sound, which fonts are installed, plus the screen and settings. Hashed together they come out the same on every site, without cookies, in private windows too.
It doesn't depend on your IP, so a VPN doesn't change it. Browsers that protect against it (Brave, Firefox with resistFingerprinting, Safari in private mode) add noise; the "Fingerprint protection" row tells whether yours does.
When you use a VPN or proxy or change your user agent, sites compare your readings with each other. A system time zone that doesn't match the IP's, a language from another country, a WebRTC address that isn't the VPN's, a data center network, or a user agent that doesn't match the graphics card all stand out.
To look like someone from the VPN's country, set the system time zone to match, turn off WebRTC or use a browser that keeps it inside the VPN, and use a residential exit.
No. This site's server answers one request (/api/me) with what it already sees in it: your address, Cloudflare's data for it and your headers, and keeps no log.
To find your exits and your DNS resolver, the page also asks a few outside services directly (their names are in the right column: IPIP.NET, IP.SB, the Cloudflare trace on chatgpt.com, claude.ai and cloudflare.com, Cloudflare Radar, ip-api's DNS server, two STUN servers). They see your address, as any site you visit does. Everything else is read in your browser and stays there. The code is open source.
The page keeps one thing in your own browser's storage, never sent anywhere: the time, fingerprint and city of your last visit, to show whether you were recognized; the × on the ID card forgets it. A shared link carries the portrait without your address or city.
Not every browser has every API. Keyboard layout, battery, connection type, memory and client hints are Chromium only; Safari and Firefox share less, on purpose. A missing reading is a good sign for privacy.