What is Audit?
A browser transparency tool showing what this page can observe in your current browser context. No account is required. Some signals are restricted, rounded, or unavailable.
What it surfaces
Audit groups browser-visible observations into panels. This is not a complete hardware inventory or a measurement of how uniquely identifiable you are. Connection information comes from Cloudflare's trace endpoint; browser APIs supply the other observations:
- User-Agent string parsed into browser, engine, OS, and device type
- Browser-reported user agent, languages, and privacy preferences, separately from unobserved outgoing request headers
- Browser-reported logical processor count, approximate memory, screen dimensions in CSS pixels, color depth, pixel ratio, touch points, color gamut, and dynamic range
- OS preferences: timezone, locale, language list, dark mode, reduce motion, reduce transparency, contrast preference, forced colors
- Network: connection type, effective type, downlink speed, round-trip time, data saver flag
- Privacy flags: Do Not Track, Global Privacy Control, cookie availability, document referrer
- Exposed permission states for APIs including geolocation, camera, microphone, clipboard, and sensors
- Canvas rendering: two live test patterns rendered directly in the page (text across font stacks, and geometric shapes), each hashed to produce a fingerprint value
- WebGL: GPU vendor and renderer, GL and GLSL versions, max texture size, max viewport dimensions, shader precision formats, and the full list of supported extensions
- Audio context: sample rate, channel count, and an oscillator/compressor fingerprint value
- Font width probes across a fixed candidate list, plus a hash of matching candidates; these are signals, not an installed-font inventory
- Layout and rendering: DOMRect measurements at fractional font sizes, fractional layout coordinates, and observed performance.now() timing deltas
- Execution context flags: isSecureContext and crossOriginIsolated
- WebRTC candidate gathering, including requests to Google's public STUN servers; no peer connection is established with another visitor
- Battery status (where available): level, charging state, time to full or empty
- Media-device entries exposed to this page, with hashed device IDs and group IDs; permissions and browser policy can hide devices or labels
- User-Agent Client Hints (Chromium-based browsers): architecture, bitness, full version list, platform version, model
- Browser storage: localStorage and sessionStorage keys, per-type quota breakdown, window.name value, opener status
- JS heap memory usage (Chrome only), navigation type, page visibility state
- Legacy plugin and MIME-type entries, which modern browsers may standardize around PDF-viewer compatibility
- Browser capability checks including WebAssembly, Service Workers, WebXR, and File System Access
- Sensor and device API availability: Bluetooth, USB, HID, Serial, NFC, Vibration, Accelerometer, Gyroscope, Magnetometer, Gamepad, and others
How it works
The page requests /cdn-cgi/trace on this origin for connection details, then repeats that request while live timing is active. The WebRTC probe also contacts Google's public STUN servers. Those services receive connection information and may keep logs. Trace values describe the browser-to-Cloudflare request, not every connection your device makes.
The fingerprint summary is saved in this origin's localStorage to compare later scans. Other storage observations describe this origin's browser storage, not your disk or other sites. Fingerprint inputs and the rendered report are not uploaded by this page's code. The audit does not request new camera, microphone, location, or sensor access; it reads exposed capabilities and existing permission states.
The request-related panel shows values read from browser APIs. It does not reconstruct the actual navigation request: header values can vary by browser, request, policy, and intermediary.
Canvas fingerprinting draws two deterministic test patterns. Different operating systems use different font renderers, GPU rasterizers, and anti-aliasing approaches, so the same drawing commands produce different pixel output on different systems. The hash captures that difference.
Font probing compares text width against fallback families. A difference suggests a matching or aliased font was used. Equal widths, browser restrictions, and font substitution can obscure the result; these probes do not prove installation or enumerate every font.
Why it exists
Most people know websites can see their IP and browser. Few know the full picture. Audit makes that concrete with no abstraction and no paraphrasing.