# GlassBox

**Every measurement a website can take from your browser, run live and shown back to you.**

GlassBox is a client-side browser-fingerprinting bench. It runs ~31 families of fingerprinting and device-enumeration probes against *your own* browser, shows you the raw values, and estimates how identifiable you are. These are the same signals tracking and anti-fraud scripts collect, surfaced instead of hidden.

🔗 **Live demo:** https://glassbox.codecanary.org
📖 **Anonymization guide:** https://glassbox.codecanary.org/guide
📰 **Featured in [The Register](https://www.theregister.com/security/2026/08/24/browser-fingerprint-tool-shows-how-easy-you-are-to-track-using-the-latest-sneaky-tricks/5292015)**

![GlassBox — example capture with synthetic data](docs/screenshot.png)

<sub>Example capture with **fabricated** data — documentation-range IP/ASN, invented hashes and GPU. GlassBox displays the *viewer's own* IP, location, and hardware, so this illustrative shot uses synthetic values rather than a real fingerprint. Run the [live demo](https://glassbox.codecanary.org) to see your own.</sub>

## What it measures

- Navigator core, UA client hints, screen & display, timezone & locale
- Canvas 2D, WebGL / WebGL2, WebGPU, and audio-stack fingerprints
- Installed fonts, media codecs, speech-synthesis voices, media devices
- WebRTC / IP leak, storage & quota, permissions matrix, API-support matrix
- CSS & media features, JS-engine math, timing / compute, keyboard layout, battery
- Automation / bot signals, cookies, a locally-reconstructed tracking pixel, and a fingerprint-resistance check
- Opt-in: public IP intelligence (geo / ASN / VPN detection), behavioral capture, and cross-site login-state

Signals fold into four tiers — hardware, engine × hardware, browser build, and session — plus a headline **estimated identifiability** score.

## Privacy

Every probe runs in your browser and **its results are never uploaded**. What does leave the page, all of it visible in the source: on load, the IP panel asks three public IP-intelligence APIs (ipwho.is, ipapi.is, geojs.io) and two STUN servers (Google, Cloudflare) about your address, network and VPN status, and toggling **Geo** off stops that, including requests still in flight. The login check loads one image from each service it tests, only when you press its button. The hosted copy also carries two page-view counters, neither of which sees anything a probe measures: a first-party one (`/_hb/s.js`, same origin, no cookies, records the page path and referrer, opt-out at `/_hb/optout`) and Cloudflare Web Analytics, injected by the host (cookie-free, page views and load timings).

### About the identifiability %

The headline percentage is an honest **model, not a live-population measurement** — a no-server tool can't compute true rarity against real visitors. It sums published per-signal entropy (Panopticlick, AmIUnique, EFF Cover Your Tracks), counts only what your browser actually exposes (masked canvas / GPU are discounted), applies a correlation discount, and caps at the ~33 bits needed to single out one person among ~8 billion. Treat it as an order-of-magnitude indicator. One honest wrinkle: a browser that blends into a big crowd (Tor Browser at its default size) is *safer* than its bit-count suggests, because everyone there reports the same values. For numbers measured against a live population, compare with [EFF Cover Your Tracks](https://coveryourtracks.eff.org) and [AmIUnique](https://amiunique.org).

## Run it

A single static file — no build step, no dependencies. Any static host works:

```bash
# locally
python3 -m http.server 8000      # then open http://localhost:8000

# Cloudflare Pages
node tools/csp-hash.mjs      # refresh the CSP script hash in _headers after any edit to index.html
npx wrangler pages deploy . --project-name=glassbox
```

Host it at its own `https://` origin for the full surface — some probes (WebRTC, media devices, permissions, login-state) are limited on `file://` or inside an embedded frame.

## Files

| File | Purpose |
|------|---------|
| `index.html` | The app — all probes plus the identifiability estimate, fully self-contained |
| `guide.html` | Anonymization how-to guide (served at `/guide`) |
| `_headers`   | Security headers for Cloudflare Pages |

## Prior art & credit

Inspired by and worth comparing to [EFF Cover Your Tracks](https://coveryourtracks.eff.org), [AmIUnique](https://amiunique.org), Panopticlick, and [browserleaks.com](https://browserleaks.com). Built as part of [CodeCanary](https://codecanary.org).

## License

[MIT](LICENSE) © HotStart Labs