---
title: "Security check"
summary: "What your browser gives away to any site, measured live."
last_verified: 2026-10-25
---

# Security check

What your browser tells any website, measured here in your browser. Each row names the API it came from, so you can check it.

## Browser

Your browser's name, version and operating system, read from `navigator.userAgentData` on Chromium and from the user-agent string elsewhere.

## Known bugs

Whether your browser predates the fix for CVE-2023-4863, the libwebp heap overflow exploited in 2023. Fixed in Chrome 116.0.5845.187, Firefox 117.0.1, Firefox ESR 115.2.1, iOS 16.6.1 and macOS 13.5.2. A version check only, no exploit code.

## Spectre

How coarse your browser keeps its clock, measured from `performance.now()`, and whether `SharedArrayBuffer` is on. Coarse timers and no shared memory are the Spectre mitigations.

## Fingerprint

Screen size, pixel ratio, CPU threads, memory, touch points and graphics card, as any script can read them.

## Fingerprint ID

A hash of a drawn canvas, a test for whether your browser adds noise to canvas reads, and a short SHA-256 of everything on these pages.

## Connection

TLS version, cipher, HTTP version and the IP address this server saw, echoed back by `/whoami`. JavaScript can't see these on its own.

## Headers

The security headers this site sends: HSTS, Content-Security-Policy, Referrer-Policy, Permissions-Policy, COOP and nosniff.

## Privacy

Global Privacy Control, Do Not Track, cookie support, a content blocker test with a bait element, and whether this device could use a passkey.

## Leaks

Your local IP as WebRTC exposes it (host candidates only, no STUN request), and the rough location your time zone and languages give away without a prompt.