FIRST CONNECTION
Start here.
- IPv4 endpoint
- Not captured
- Dual-stack endpoint
- Not captured
- Captured at
- —
Know your IP.
Read your
digital trail.
One clear view of your connection, browser and website signals. Check an address, compare a route, and keep the evidence that helps you take the next step.
YOUR SIGNAL SPACEMEASURING
SIGNALS—measured locally
CONNECTIONPublic endpointInspect the route
BROWSERMeasuring…Open the snapshot
DISPLAYMeasuring…Inspect the viewport
PREFERENCESReading signals…Review preferences
PUBLIC ADDRESS
Checking…This request checks your public address.
Browser environment
- System
- Measuring…
- Timezone
- Measuring…
- Language
- —
- CPU threads
- —
- Cookies
- Snapshot
- Preparing…
A SMALL EXPERIMENT, CLEARER ANSWERS
A different route.
What actually changed?
Capture your connection, switch Wi-Fi or VPN, then capture it again. Compare the addresses observed by two public endpoints.
01 → 02
Keep both observations together.
Each capture checks an IPv4 endpoint and a dual-stack endpoint. Different results describe those requests; they are not a verdict on every app.
Start with your current connection. Captures stay in this tab.
IP requests go directly to ipify. No location request or account is needed.
SECOND CONNECTION
Then change your route.
- IPv4 endpoint
- Not captured
- Dual-stack endpoint
- Not captured
- Captured at
- —
Two observations make a more useful comparison than one screenshot.
THE ADDRESS LAB
One address.
Find the dividing line.
Move the prefix and watch an IPv4 address split into network and host bits. The boundaries below are calculated in your browser.
Open the full subnet calculatorIPv4 / LIVE CALCULATION/26
Explore ordinary subnet prefixes from /16 to /30.
Network Host
- Network address
- 192.0.2.128
- Broadcast address
- 192.0.2.191
- Usable host range
- 192.0.2.129 – 192.0.2.190
- Usable hosts
- 62
01 / FIND YOUR STARTING POINT
A question first.
The right tool next.
Choose what you want to understand. We’ll lay out a useful path through the workbench.
THE WORKBENCH
Follow the signal.
Find your next step.
Start with one question: an unexpected address, a changed browser signal or a website that will not connect. Use the measured fields to decide what to check next.
BROWSER IDENTITY
See the profile a website can assemble.
Browser, display, graphics and privacy signals collected into one searchable report.
Open browser inspectorCanvaspixel hashWebGLrendererPermissionssite access
EVIDENCE, NOT THEATREA finding should show its work.
- Measured fields
- Practical findings
- Explicit limitations
DOMAIN INTELLIGENCE
DATA & CRYPTOGRAPHYFollow a request from DNS to browser policy.
Inspect the public trail instead of treating headers, certificates and records as isolated checks.
Encrypt the file. Keep the context.
AES-256-GCM with authenticated metadata and a password-derived key.
Open file vaultCOMPARE SESSIONSChange one thing.
Change one thing.
See what moved.
Save a baseline, repeat the check and isolate the signal groups that changed.
02 / THE SIGNAL EXPLORER
Small details.
A bigger picture.
Explore the building blocks of a browser snapshot. This is a guide to the signals; run a scan to see your own values.
SIGNAL GUIDE
The environment behind the tab.
Browser family, language and timezone help describe the environment a page sees. Shared values are common; they do not identify one person.
- Browser family
- Software context
- Language & timezone
- Regional settings
- Display & pixel ratio
- Screen configuration
A browser update, a different screen or a timezone setting can change this part of a snapshot.
Inspect these signalsSIGNAL GUIDE
The way your device draws.
Canvas output and WebGL capabilities reflect a mix of browser, graphics drivers and privacy settings. Some browsers deliberately mask these details.
- Canvas digest
- Rendered pixel output
- WebGL renderer
- Reported graphics context
- Extensions & limits
- Available capabilities
Graphics driver updates, hardware acceleration and anti-fingerprinting settings can affect the result.
Inspect these signalsSIGNAL GUIDE
A signal without a recording.
An offline audio graph processes a controlled signal inside the browser. The check neither records your microphone nor plays sound.
- Offline graph
- Oscillator & compressor
- Output digest
- Hash of generated samples
- Repeatability
- Comparison of two runs
Browser processing differences and privacy protections can alter or block the output.
Inspect these signalsSIGNAL GUIDE
A view of this site’s access.
Queryable permission states describe this origin. They do not reveal every permission granted to other sites or installed applications.
- Granted
- Previously allowed here
- Prompt
- May ask when used
- Unavailable
- Not exposed by this browser
Changing a site permission or switching browser profiles can change the states reported here.
Inspect these signals03 / A REQUEST, LAYER BY LAYER
One website.
Several stories.
A DNS record, a valid certificate and a browser policy answer different questions. Follow the path to see how they fit together.
https://example.com ILLUSTRATED REQUEST PATH
01 / RESOLVE
Find the address.
DNS maps a name to records. Inspect the answer, record type and cache lifetime.
DNS → IP addressExplore DNS 02 / CONNECTCheck the identity.
TLS presents a certificate. Check the hostname, chain and negotiated connection.
TLS → CertificateInspect TLS 03 / RESPONDRead the rules.
HTTP headers tell the browser how to handle content, framing and other policies.
HTTP → Response policyRead the headersThese checks run from the site server. The destination can see the server’s request.
A CLEANER WAY TO INVESTIGATE
Observe. Compare.
Decide with context.
No vague grade and no inflated promise. The workbench keeps the raw observation beside the useful interpretation.
How the checks workStart with the actual signal.
Read the values the browser, resolver or remote server returned.
BROWSER · DNS · TLS · HTTPKeep a baseline close.
Repeat the same check after a setting change or deployment.
BEFORE · AFTER · CHANGED FIELDSLeave with evidence.
Search the data, export the report and share the part that matters.
JSON · PRINT · SAVED REPORT04 / A LITTLE STRUCTURE GOES A LONG WAY
Turn a check
into a useful habit.
Three practical ways to combine the tools. Keep the input and conditions clear so your next result is easier to interpret.
After changing your VPN.
Check the route your browser actually uses, then compare the addresses you observe.
- Record the public IP before the change.
- Reconnect and repeat the IP check.
- Compare WebRTC candidates separately.
After shipping a website.
Verify the public endpoint that visitors reach after your deployment or renewal.
- Inspect DNS records for the hostname.
- Read the live TLS certificate.
- Check final response headers and redirects.
Before opening a download.
Check whether the downloaded bytes match the publisher’s expected digest.
- Get the checksum from a trusted source.
- Select the same digest algorithm.
- Compare the complete checksum value.
FROM THE BLOG
Real questions.
Useful field notes.
Worked scenarios, comparison methods and deployment notes for the signals you can inspect here.
Two IP checks disagree. Which connection did each one measure?
Compare IPv4, dual-stack requests and VPN changes using a small connection record instead of an unexplained screenshot.
The extra address in a WebRTC result: a practical investigation
Read ICE candidate types, mDNS names and STUN observations before deciding whether a call followed an unexpected route.
A website works but its email fails: follow the DNS evidence
Separate website records, mail routing and resolver caches when a domain behaves differently across services.
Your homepage headers pass. What happens on a redirect or an error?
Build a small response matrix that tests security policies across the routes and status codes users actually receive.
A readable JWT payload is not an accepted login token
Build a verification decision from a trusted key, expected issuer and audience, expiry and the algorithm policy.
06 / GOOD TO KNOW
A little more
clarity.
Good tools leave room for good questions. Start with these, or read how each diagnostic works.
Explore the methodologyIs a browser fingerprint my real identity?
No. A fingerprint is a digest of the signals measured in a browser snapshot. People can share signals, and one person’s signals can change. This workbench does not collect a reference population or calculate how unique you are.
Does opening the homepage start a scan?
No. The live preview begins when you press “Run a quick scan”. The signal explorer explains the types of information available. It does not inspect your browser until you choose to run a check.
Which checks stay in my browser?
Browser fingerprinting, graphics and audio checks, pasted policy and token analysis, and file tools run locally. IP, WebRTC, password-breach and server-assisted network tools contact the services named beside their controls. The privacy notice explains each route.
Why can a result change between browsers?
Browsers expose different APIs and apply different privacy policies. Updates, extensions, drivers, display settings and browser profiles can change an observation. Compare runs under the same conditions before drawing a conclusion.
Can I export and compare my results?
Yes. Tool reports include JSON export, copy and print. The browser fingerprint tool also accepts a previous report as a baseline. Keep the extended-audit option consistent when you compare runs.
Does a matching checksum or trusted certificate mean “safe”?
A matching checksum means the file matches the supplied digest. A trusted certificate means the connection passed the checks described by that tool. Neither result establishes that a file is harmless or that a website’s owner is trustworthy.
YOUR NEXT USEFUL ANSWER
Make the invisible
legible.
Start with a live browser snapshot, then follow the evidence wherever it leads.