What Every Website Can Tell About Your Device Without Asking

By — SDET & creator of findWhatIsMyIP.com

Open a web page and, before you click anything or see a single Allow pop-up, it already knows a fair amount about the machine you are on: how many CPU cores you have, your screen size, your graphics chip, your language, your time zone, whether you prefer dark mode. None of that needs permission. The browser hands it over as part of normal operation so pages can adapt — and the same details are used, for better and worse, to recognise you again later.

You can see exactly what your own browser is giving away on our System Info page. This article explains what those values mean: which are trustworthy, which are only a guess, which stay private no matter what, and why the whole set together is a problem.

What a website can read reliably

These are consistent across browsers and need no permission:

  • Logical CPU cores — the number of hardware threads, via navigator.hardwareConcurrency. Useful for deciding how many background workers to spin up.
  • Screen and window size, colour depth and the device pixel ratio. This is what responsive layouts are built on. Our Screen Resolution page breaks it down further.
  • Preferences — dark or light mode, reduced motion, reduced data, increased contrast, whether the primary pointer is a mouse or a finger. These come from CSS media queries.
  • Language and time zone — your accepted languages and your IANA time zone (for example Europe/London), read straight from the browser's internationalisation settings.
  • Media codec support — whether the device can play H.264, HEVC, AV1 or VP9, so a video site can pick a format that will actually decode.
  • The user-agent string — browser, engine and rough OS. Our User Agent Decoder parses it field by field.

What is only an estimate, or browser-specific

Some values are deliberately vague, and several are only sent by Chrome and Edge:

  • Device memory is exposed by navigator.deviceMemory in Chromium browsers only, and it is rounded to a coarse bucket — 0.5, 1, 2, 4, 8 GB. A laptop with 12 GB reports 8. Firefox and Safari do not report it at all.
  • The GPU model (“Apple M2”, “GeForce RTX 3070”) comes from a WebGL debug extension. Firefox with anti-fingerprinting turned on, and Safari, hide or generalise it.
  • OS version, CPU architecture and device model come from User-Agent Client Hints, which only Chromium browsers send. On Windows the version is blunt on purpose: Windows 11 reports as major version 13 or higher.
  • Network “downlink” and round-trip time are the browser's rough guesses, not a measurement. For a real figure, use the Internet Speed Test.
  • Battery level used to be readable by any site. It was removed from Firefox and Safari after researchers showed it was being used to track people; only Chrome and Edge still expose it.

So the same page can look data-rich in Chrome and sparse in Firefox. That is not a bug — it is the two projects making different privacy choices.

What a website cannot read without asking

A lot of what people expect to be visible simply is not. The following all require either a native application or an explicit permission the page has to request — and a permission prompt you would clearly see:

  • Your exact total RAM and free disk space (only a rounded memory bucket and the storage quota for that one site are available).
  • Your CPU model and clock speed, and the OS build number.
  • Your computer name, MAC address, and the list of software installed on the machine.
  • The labels of your cameras and microphones. Before you grant camera or microphone access, a site can tell that a camera exists but not what it is — and on phones it often sees only one even when there are two.

Some identifiers are off-limits to a browser entirely, by design. A phone's IMEI, serial number, SIM or phone number, and the Android or Apple advertising ID are never exposed to a web page — not with any permission. Even native mobile apps can no longer read the IMEI on current versions of Android and iOS. If a website claims to show your IMEI, it is guessing or lying.

Why the combination matters: fingerprinting

On their own these values are harmless. Millions of people have 8 CPU cores. Millions use English and a 1920×1080 screen. The problem is the combination. Core count, memory bucket, GPU string, screen size, pixel ratio, time zone, the exact ordered list of accepted languages, installed fonts, codec support — put twenty of these together and the result is distinctive enough to pick your browser out of a very large crowd.

That is a browser fingerprint. It works without cookies, so clearing cookies or using a private window does not reset it. It is how some analytics and ad-tech systems recognise a returning visitor who has opted out of everything else. The System Info page shows you the raw ingredients; sites like coveryourtracks.eff.org and amiunique.org estimate how rare your particular combination is.

What actually reduces your fingerprint

Not much, if you tackle it value by value — and some attempts backfire. Spoofing your user agent to look like a different browser, for instance, just makes you rarer, because now your UA does not match your real rendering behaviour.

What works is using a browser that deliberately makes everyone look the same:

  • Tor Browser normalises screen size, time zone, fonts and more so that its users share one fingerprint. It is the strongest option, at a real cost in speed and convenience.
  • Firefox with privacy.resistFingerprinting enabled (or the built-in anti-fingerprinting in strict tracking protection) reports rounded window sizes, a fixed time zone, a generic user agent and a masked GPU.
  • Brave adds small random noise to canvas and audio readings so the fingerprint shifts between sessions.

A VPN changes your IP address and location, not your fingerprint. The two are separate signals: your IP says roughly where you are connecting from; your fingerprint says which browser is connecting. A site that wants to track you can use either. If your goal is to be hard to follow, you need to address both.

The takeaway

None of this is cause for alarm on its own. It is worth knowing, though, that “I cleared my cookies” is not the same as “this site can't recognise me,” and that the details a page can read are both more (fingerprintable combinations) and less (no RAM, no disk, no IMEI) than most people assume. See exactly what your browser reports on the System Info page.

Related

Awesome findWhatIsMyIP Blog