🧭 The Browser Being Analysed
Read from this tab right now. Every figure below describes this browser on this device.
Browser Privacy & Storage Analyzer
See what this website can actually read from your browser — storage, cookies, tokens, permissions and which files came from your own cache. Everything runs locally; nothing is uploaded.
Runs entirely in this tab — no request is made to any server.
Token and secret-looking values are masked by default.
Browser security boundary: this page cannot read another website's
localStorage/sessionStorage, HttpOnly cookies, saved passwords, extension storage,
complete browsing history, or the browser's private disk HTTP cache.
None of that is a limitation of this tool — it is the same-origin policy, and it is the thing that stops any website reading your bank's session. Everything below therefore describes this origin only. To inspect a different site, use the Site Storage Inspector — a bookmarklet that runs inside that site, where its data is legitimately readable.
None of that is a limitation of this tool — it is the same-origin policy, and it is the thing that stops any website reading your bank's session. Everything below therefore describes this origin only. To inspect a different site, use the Site Storage Inspector — a bookmarklet that runs inside that site, where its data is legitimately readable.
Press Start Browser Analysis to inspect what this site can see in your browser.
—
Not analysed
Run the analysis to see an exposure reading.
Readable Cookies
visible to JavaScript only
Storage Entries
—
local + session storage
JWT-like Values
—
readable by any script here
From Browser Cache
—
files reused with no download
⚡ What Came From Cache — On This Page
Every file this page loaded, and whether your browser reused a stored copy. A resource reporting zero bytes transferred but a non-zero decoded size came from your cache without touching the network — the one browser-cache fact that is genuinely observable.
Why only this page's files? No website can list your browser's cache. The Performance API
reports the resources this document requested and nothing else — there is no API for the rest,
deliberately. If any page could enumerate your cache, it could work out every site you had visited.
Third-party files appear here (fonts, analytics) only because this page requested them.
To inspect another site, use the bookmarklet below —
it runs inside that site, where its own data is legitimately readable.
Full setup and source: Site Storage Inspector →
TypeResourceSource
TransferredDecoded
⚠️ Findings
💾 Storage Explorer
Everything this origin can read. Values that look like secrets are masked — reveal them only if you are somewhere private. For another site's storage, use the Site Storage Inspector.
🎟️ Token Inspector
JWT-shaped values found in this origin's storage — and a decoder for any token you paste in. To find tokens another site is holding, run the Site Storage Inspector there.
💽 Storage Quota
Used
—
Available
—
🌐 Browser & Device
Everything any page can read without asking you first — the raw material of fingerprinting. No single value identifies you; the combination very often does.
🔐 Privacy Signals
🧪 Browser Capabilities
Feature detection, not fingerprinting — though the combination of answers is itself identifying.
🖼️ Image Resources
Images this page loaded, with whether each came from the network or your cache.
Only this page's images — another site's can only be seen from inside it, via the Site Storage Inspector.
🔓 Optional Permission Tests
Nothing is requested automatically. Each test asks once, reports the answer, and immediately releases anything it was given.
Location
Asks for your coordinates and reports the accuracy. Nothing is stored or sent.
Not tested
Notifications
Requests permission and reports the result. No notification is ever sent.
Not tested
Camera
Opens the camera only long enough to confirm access, then stops the track immediately.
Not tested
Microphone
Confirms microphone access without recording. Any stream is stopped at once.
Not tested
Clipboard
Asks to read your clipboard. The length is reported, never the contents.
Not tested
Persistent Storage
Asks the browser to exempt this origin's storage from automatic eviction.
Not tested
Device Labels
Lists your cameras and microphones. Names appear only after media permission is granted — a live demonstration of what consent unlocks.
Not tested
🔖 Run This On Any Site
This page can only read its own origin's data — that is the same-origin policy, and it is what stops any website reading your bank's session. The supported way around it is not to break the rule but to work inside it: run the same checks on the site you want to inspect.
Drag the button below onto your bookmarks bar. Then visit any site — one you are
logged into, for instance — and click the bookmark. It runs inside that site, so it can read
that site's localStorage, sessionStorage, cookies and tokens, and shows them in a panel on the page.
Everything stays in your browser; nothing is sent anywhere, including to us.
Full walkthrough, troubleshooting and the complete source: Site Storage Inspector →
Full walkthrough, troubleshooting and the complete source: Site Storage Inspector →
🔖 Storage Inspector
Dragging is easiest. Clicking it here does nothing useful — it only works once it is a bookmark on another site.
Sixty seconds: install it once, then click it on any site.
What exactly does it run?
It reads localStorage, sessionStorage and document.cookie for
whichever site you are on, flags anything JWT-shaped or named like a secret, and renders a small overlay
with the results. It makes no network request of any kind, and it removes itself when you close the panel.
The full source is in the Copy button above if you would rather read it before trusting it — which,
for anything you are about to run on a site you are logged into, is the right instinct.
🚫 What This Page Cannot See
Deliberately withheld from every website. If a page claims otherwise, it is guessing.
Other websites' data
The same-origin policy means this page cannot read another site's localStorage, sessionStorage, IndexedDB, Cache Storage or ordinary cookies. Each origin is sealed off from every other.
Passwords, autofill and full browsing history
Saved passwords, payment details and your complete history live in the browser's own storage, which page JavaScript has no access to. A page can read history.length for this tab, and nothing more.
HttpOnly cookies
An HttpOnly cookie is hidden from document.cookie on purpose — it is the main defence that stops a cross-site scripting bug from stealing a session. If your session cookie does not appear in the Cookies tab above, that is good news.
The browser's own HTTP cache, in full
No page can enumerate the disk cache. The cache table above is inferred per-resource from timing data for this page only, plus anything a service worker explicitly put in Cache Storage.
HOW IT WORKS
The Only Honest Way to See a Browser Cache
Our CDN Cache Checker runs from a server, which means it can tell you whether a CDN edge answered a request — but it can never tell you whether your browser would have skipped the network entirely, because it has no browser cache to consult. This page is the other half of that question. Running here, in your tab, it can read the Performance API and see that a resource reported zero bytes transferred with a non-zero decoded size, which happens only when the browser served it from its own cache. That single measurement is the one piece of genuine browser-cache evidence available to any web page. Everything else on this page follows the same rule: it reports what the browser actually exposes to this origin, and states plainly what it is not allowed to know.
What else can you check?
These tools all work on the same connection and address data — pick whichever question you actually have.
Want to see the full path to a site?
DNS, redirects, every hop, the CDN, TLS and the origin server.
Want to know your public IP?
See your IPv4 and IPv6 addresses, location, ISP and ASN.
Want to check your tower & route?
Live ping, speed, DNS, traceroute and a map of nearby points.
Want to ping from around the world?
Real latency from real probes across 12 countries, live on a map.
Want to locate any IP address?
City, region, country and coordinates for any public IP.
Want to know if an IP is risky?
Proxy, VPN, Tor, hosting and abuse-report indicators.
Want to know if you're blacklisted?
Check an address against major spam and abuse DNSBLs.
Want to know who owns an IP?
Network owner, ASN, CIDR range and abuse contact.
Want to explore an AS number?
Announced prefixes, BGP neighbours and registry details.
Want to test your connection speed?
Measure real download, upload, ping and jitter.
Want to see what changed?
Word-level diff between two blocks of text or code.
Want to know if a DNS change is live yet?
Compare answers from five independent public resolvers.
Want to verify a domain's nameservers?
Direct authoritative checks, glue records and SOA serials.
Want to check a domain's DNSSEC setup?
DNSKEY, DS records, signature expiry and real validation.
Want to see the hop-by-hop path to a server?
A real traceroute from a genuine probe anywhere in the world.
Want to know if a server port is open?
A real TCP connection attempt - open, closed or filtered.
Want to measure latency to a server?
Real connect timing - min/avg/max, jitter and connection loss.
Want a clean URL slug from a title?
Real transliteration, stop words and batch mode.
Want to find and replace across a document?
Regex, capture groups and a live preview before you commit.
Want to find the invisible character?
Code points, escapes, bytes and hidden-character detection.
Want to escape text for HTML?
Minimal, named or numeric entities, attribute-safe.
Want to strip emoji cleanly?
Whole clusters - no half-flags or stray modifiers left.
Want to spot repeated words?
Frequency, density and accidental doubles like "the the".
Want to know if a URL is cached?
Two requests prove whether your CDN is really caching it.
Want to run that check on any site?
One-click bookmarklet reads storage and tokens where they live.
Want to know who your site talks to?
Renders the page and names every outside company it contacts.
Browser Privacy Analyzer FAQ
Does any of this leave my browser?
No. There is no network request in the analysis at all — you can confirm it by opening your browser's network tab and pressing the button. The Export button builds the JSON file locally too.
Why can it see some cookies but not my login cookie?
Because a well-built login cookie is marked HttpOnly, which hides it from JavaScript entirely. Its absence here is a sign the site is doing the right thing.
Why does it flag JWTs in localStorage?
Anything in localStorage is readable by every script on the page, including any third-party script and anything injected through an XSS bug. A token there can be stolen silently; the same token in an HttpOnly cookie cannot.
How does it know something came from cache?
The Performance API reports zero bytes transferred alongside a real decoded size, which can only happen when the browser reused a stored copy. Cross-origin resources without a Timing-Allow-Origin header hide their sizes, so those are reported as unknown rather than guessed at.
What does the score actually measure?
Exposure of this page's own origin — secure context, tokens reachable by script, secret-looking keys in storage. It is a prompt to look at specific findings, not a grade to chase.
Is the permission section safe to use?
Yes. Nothing is requested until you press a button, camera and microphone streams are stopped in the same function that opens them, and no location, audio or video is stored or transmitted.