I’m the author, so treat this as self-promotion. It’s free, MIT-licensed, and AI helped me write a lot of the code.
What it is: Who Are You runs the checks any ordinary website can run without a permission prompt and then writes out, in plain sentences, who the site would think you are: rough location from the exit IP, time zone and languages, OS and screen, fonts, canvas/WebGL/audio fingerprint, WebRTC, client hints, DNT/GPC.
Why I built it: most fingerprint test pages give you a uniqueness score. What I kept wanting to know was what contradicts what. The page flags the mismatches that usually give a VPN or proxy away:
- system time zone or browser language doesn’t match the exit IP country
- WebRTC shows a different IP than the one the site sees
- a split-tunnel setup where some requests leave through a different exit
- the TCP/TLS fingerprint belongs to a different OS than the user agent claims (a user-agent switcher can’t fix that one)
Each finding has a short “how to fix / or leave it if you’re not trying to look local” note.
Data, since this is c/privacy: the checks run in your browser. To say how many visitors share a value, the site keeps anonymous per-value counts, with no IP, no full fingerprint and no record of single visits. “Don’t count me” or a GPC signal turns the counting off. If that’s still too much, the source is here and you can host it yourself: https://github.com/yt1988/who-are-you
I’d especially like to hear from Tor Browser, Mullvad Browser and LibreWolf users: what does it get wrong about you, and which check is missing?
Super cool project! I notice it can tell if Firefox’s resist fingerprinting is on. Given that most people have this off does this imply it actually makes you more identifiable? Ie I’m probably the only Linux user on my network with it on
Love the summary format. Definitely a lot more accurate of a fingerprint using Chromium, many stats with Librewolf are jumbled up as expected. In fact, all is well in Chromium. I guess all but one of my machines are entry-level, ran the test on my second-most recent device (2019 ThinkPad) and it’s still characterized as “entry-level”.
It commented on Firefox RFP reporting UTC regardless of local time zone and I thought it was funny that I do in fact have my devices set to UTC even though I don’t live in Iceland. To be clear, not a bug, just my personal choice.
Does contradicting the VPN specifically make me significantly more identifiable? I don’t care if they know I’m using a VPN. I care if they can recognize me.
Not much on its own. A timezone or language that doesn’t match the exit IP mostly tells a site you’re on a VPN, which you’re fine with. It only starts to narrow you down when the combination is rare, for example an uncommon language plus a timezone few people on that exit server use, or when WebRTC leaks your real IP.
What actually lets a site recognize you again is the stuff that stays the same when your IP changes: cookies and logins first, then canvas, WebGL, fonts, screen size and similar. So if you only care about recognition, that part of the report matters more than the VPN mismatch part.