A Client-Side Privacy Audit: What Your Browser Leaks and How to Clean It Before Sharing

By 2026, third-party cookie blocking is the default in Safari and Firefox, while Chrome’s phaseout remains staggered across releases and regions.¹²³ Instead of collapsing, the tracking industry shifted toward browser fingerprinting, a technique that does not require local storage.⁴ Since your browser exposes dozens of distinct hardware and software signals every time a page loads, trackers can stitch them together into a persistent profile that survives private windows, meaning you cannot simply clear a fingerprint like cookies; you must actively change the conditions producing it.

That audit breaks down into three categories you should check before sharing anything online: device identity signals your browser broadcasts, credentials hidden in URLs you copy-paste, and metadata embedded in photos you upload. Given that CapyToolkit offers a suite of browser-based tools that run entirely client-side, you can detect every single one of these leaks without ever transmitting a byte of data, and here is exactly how to stop them.

What 30+ Browser Signals Reveal About You Without Your Permission

Every website you visit can query your browser’s screen dimensions, GPU model, CPU core count, timezone, and installed fonts through standard APIs designed for legitimate uses. Opting out requires browser-level mitigations rather than a single toggle. The browser fingerprint is not a file a tracker writes to your disk; it is a profile assembled from properties the browser reports by design to every page that asks.

While each signal is individually weak (knowing your screen resolution alone tells a tracker almost nothing since millions share a 1920x1080 display), the specific intersection of dozens of signals narrows the global population dramatically. CapyToolkit’s Browser Fingerprint Inspector that scans 30+ hardware and software signals to report your entropy score without any data transmission runs all of these probes locally and marks each signal as trackable or non-trackable. At 20 bits of Shannon entropy, a perfectly uniform distribution would mean roughly one in a million browsers share your configuration, though real-world signal correlation means the actual uniqueness is lower than the raw bit count suggests.⁵

Canvas and WebGL: The High-Weight Signals

Canvas fingerprinting distinguishes your machine by rendering a hidden offscreen image and hashing the pixel output produced by your GPU driver and font renderer.⁶ The resulting hex hash is typically consistent across page loads on the same machine but can shift after driver updates, font changes, or browser version upgrades. Identical hashes across unrelated systems are uncommon but can occur, especially when anti-fingerprinting defences normalise the output.

WebGL fingerprinting can be even more specific when the WEBGL_debug_renderer_info extension that exposes GPU model and driver strings to page scripts is available. Where exposed, it reports the GPU model and driver string, for example “ANGLE (NVIDIA GeForce RTX 4070 Direct3D11 vs_5_0 ps_5_0).” Many modern browsers restrict this extension, especially in hardened configurations. Its identifying power comes primarily from combining with other signals, since common hardware like Intel integrated graphics can appear across millions of machines with identical strings.

Audio Fingerprinting and Font Probing

The AudioContext API exposes subtle hardware differences in how your system processes audio signals.⁷ The operating system’s audio pipeline, sound card driver, and sample rate produce measurable variations, though these are semi-stable at best and can vary with CPU load, power state, or browser changes.

Font probing checks whether specific fonts are available on your system by rendering short strings offscreen and measuring dimensions.⁸ The inspector tests a set of 30 fonts, which is a limited probe compared to the hundreds that dedicated fingerprinting scripts can enumerate. Even this limited subset perfectly demonstrates the underlying principle: while common fonts like Arial contribute almost nothing to your fingerprint, obscure design typefaces act as high-entropy signals that dramatically increase your overall uniqueness.

Reading Your Entropy Score

The entropy score summarises everything in a single number. Below 9 bits means your browser looks like a large crowd. Above 20 bits, marked as VERY HIGH, indicates a configuration distinctive enough that a tracker with access to a matching dataset could reidentify your browser.

First, run the inspector in a normal window and note your baseline score; next, test it in a private window, and finally, compare those results against a hardened browser like Brave with shields up or Firefox with privacy.resistFingerprinting enabled. This comparison tells you exactly which privacy settings are actually working. For a deeper walkthrough of interpreting score changes across browser configurations, see the guide on auditing browser fingerprints and privacy leaks without transmitting data.

URL Inspection Catches Credential Leaks You Would Otherwise Miss

Copying and pasting URLs is one of the most common actions developers take every day. You paste a URL into a bug report, a support ticket, or a forum post, thinking you are sharing a harmless link. But many URLs contain embedded credentials that are invisible at a glance.

OAuth redirect URLs, SSO callback URLs, and password reset links routinely carry tokens, session identifiers, and API keys in their query strings or hash fragments. The OAuth implicit grant flow, which delivers access tokens in URL fragments that JavaScript on the page can read, does so by design, yet most users copy the full URL into support tickets or chat windows without checking what follows the hash.⁹¹⁰

Common Credential Leaks You Never Notice

Building on that risk, here are the specific patterns most likely to trip you up:

1. OAuth implicit grant redirects carrying an access token in the URL fragment (#access_token=...). The browser does not send fragments in HTTP requests, but JavaScript on the page can still read location.hash and transmit the token to analytics or third-party scripts.¹¹
2. SAML response payloads encoded in query parameters (?SAMLResponse=...). These base64-encoded XML blobs often contain signed assertions; proper implementations include expiry and replay protection, but exposure in a URL still leaks metadata about your identity provider and session structure.¹²
3. Password reset URLs with single-use tokens. If you paste the full reset URL into a support ticket, anyone with access to that ticket can reset the password.
4. API error pages exposing internal route parameters, database IDs, or stack traces in the URL. These appear harmless at first glance but reveal infrastructure details.

The URL Parser that decomposes any URL into its individual components shows query parameters and fragment values in separate sections with clear labels. Because the tool runs entirely on your browser’s built-in URL constructor with absolutely zero network requests, you can safely paste any link, inspect every parameter, and confirm you are not sharing hidden credentials before you hit send.

Query Parameter Inspection for Tracking

Beyond credentials, URLs carry tracking parameters like ?utm_source, ?ref, ?fbclid, and ?gclid appended by social platforms and ad servers to attribute traffic. Sharing a URL with these parameters intact tells the recipient’s analytics provider exactly which campaign and referral path led to that link.

The URL Parser includes a known-parameter tooltip feature. Click the circle-icon next to any parameter name, and the tool explains what it does and which service added it. Stripping tracking parameters before sharing reduces the data footprint you leave behind every time someone clicks a link you sent them.

Hidden GPS Coordinates and Device Data Travel Inside Every Photo

Every photo you take with a modern smartphone carries hidden EXIF metadata. This data stays embedded in the file unless something actively strips it, meaning it can reach recipients who receive the raw file through direct transfers, email, or services that do not process metadata server-side.

GPS metadata hidden in shared photos can reveal visited places, timestamps, travel routes, and sensitive-location exposure.¹³ A photo taken in front of your house reveals your home address. A photo at your desk reveals your workplace. Some services strip metadata on upload, but this is not guaranteed for every sharing path or direct file transfer.

What EXIF Data Travels with Your Photos

EXIF, the standard that defines how cameras embed GPS coordinates, device identity, and timestamps inside image files, stores data inside the image file.¹⁴ The fields most relevant to privacy include GPS coordinates (accuracy varies from a few metres to tens of metres depending on the device and conditions), your device make and model, precise timestamps down to the second, and camera settings like aperture, shutter speed, and ISO.

GPS coordinates alone can reveal your home address from a single photo taken at your front door. Device model strings link an anonymous image to your hardware identity. Timestamps expose your timezone and daily schedule. Together, these fields form a complete picture of where you were, what device you used, and when you were there.

Batch Scrubbing Before Social Sharing

The EXIF Scrubber that removes GPS coordinates and device metadata from photos before you share them handles each format according to its own container structure: EXIF segments are stripped from JPEG files, ancillary chunks (such as tEXt or zTXt) are removed from PNG files, and sub-chunks are handled inside the WebP RIFF container.¹⁵ By avoiding decoding and re-encoding of the actual image pixels, the scrubber perfectly preserves your original visual quality.

Drop images onto the drop zone, review the metadata table, check the fields to remove, and click Scrub and Download. The original file on your disk is never modified. The tool supports batch processing, so you can drop multiple images and scrub them all in one pass rather than processing each file individually. For a focused walkthrough on stripping GPS coordinates and device data from photos before upload, see the privacy-focused image metadata removal guide.

Running the Full Client-Side Privacy Audit

As this entire workflow relies exclusively on browser-based tools from CapyToolkit, where all privacy audit tools run entirely on your device without uploads or accounts where every operation runs locally, you never need to install software, create an account, or worry about your data leaving your machine. The complete audit takes under five minutes.

Step 1: Fingerprint Scan

When you open the Browser Fingerprint Inspector, the scan runs automatically, revealing your entropy score alongside a categorized list of 30-plus signals, clearly marking which ones are trackable, within seconds. Copy the canvas hash, WebGL renderer string, and audio fingerprint values before making any changes. These serve as your baseline for comparison after you harden your browser.

Step 2: URL Inspection

Open the URL Parser and paste any URLs you have recently copied that contain OAuth callbacks, SSO redirects, or API endpoint URLs. Pay special attention to the Query Parameters and Hash sections. If you see values like access_token, id_token, SAMLResponse, or code in the parameter list, those URLs contain credentials that should never be shared raw. Clean the URL by removing those parameters before pasting it into a support ticket or forum post.

Step 3: EXIF Scrub

Open the EXIF Scrubber and drop the images you plan to share. Review the metadata table carefully. If you see GPS coordinates, device model strings, or precise timestamps, check the boxes for those fields and click Scrub and Download. The cleaned file is ready to share immediately.

Hardening Your Browser Based on Audit Results

Once you know what your browser is leaking, you can take targeted action. The goal is not to eliminate every signal, since many of them are required for normal browsing. The goal is to produce a fingerprint that blends into a larger crowd.

Firefox is the most configurable option for fingerprinting resistance. Set privacy.resistFingerprinting to true in about:config. This setting rounds screen resolution, masks the timezone to UTC, reports a generic user agent, and returns spoofed or standardised values for several high-entropy APIs including canvas and audio.

Brave with shields enabled adds noise to canvas and audio APIs so the fingerprint output differs across both browsing sessions and distinct website domains (eTLD+1), making stable cross-site identification harder.¹⁶

Tor Browser is the gold standard. It normalises fingerprint signals so Tor Browser users produce highly uniform fingerprints.¹⁷ Canvas, WebGL, fonts, screen size, and timezone are set to consistent values per session. Minor differences can still occur from window sizing before letterboxing or platform-level quirks, but the uniformity is strong enough that isolating a single user by fingerprint alone becomes extremely difficult. For a complete breakdown of every reduction technique across Firefox, Brave, and Tor, see the guide on reducing your browser fingerprint.

Beyond software mitigations, utilizing standard hardware helps significantly. A 1920x1080 resolution monitor and a common CPU core count like 4 or 8 reduce the contribution of those signals to your overall fingerprint. Specialised hardware, high-DPI displays, and unusual CPU configurations all increase entropy simply by being uncommon.

Combining fingerprint hardening with URL hygiene and EXIF scrubbing creates a complete privacy posture. No single change makes you invisible, but the combination dramatically reduces the data surface available to trackers and attackers.

Audit Cadence: How Often to Run This Workflow

Privacy is not a one-time configuration. It degrades over time as browsers update, install new fonts, and accumulate configuration drift. Here is a practical cadence:

1. You should run the full fingerprint scan after any browser update or OS upgrade. New browser versions can introduce or remove APIs that change your entropy profile. An update that adds support for WebGPU, for example, may create new fingerprinting surface depending on how the browser exposes it.¹⁸
2. Running the URL inspection pass before sharing screenshots, photos, or URLs on social media, in forums, or in support tickets helps make this a reflex rather than a deliberate decision. Five seconds of inspection prevents most accidental credential exposure.
3. You should use the EXIF scrubber on any image you plan to upload, regardless of platform. Do not rely on social media platforms to strip metadata for you, because their behaviour changes without notice and varies by region.
4. Consider running a full quarterly audit if you handle sensitive data professionally or work remotely. By covering all three tools in sequence, you actively verify that your hardened browser configuration remains fully effective over time.

Bookmark the three tools for quick access: the Browser Fingerprint Inspector, the URL Parser, and the EXIF Scrubber at CapyToolkit. Every audit runs entirely in your browser with zero uploads, which means you can run it as often as you want without worrying about anyone logging your results.

By taking just five minutes today to open the fingerprint inspector, parse a suspect URL, and scrub a recent photo, you will almost certainly discover sensitive data leaking that you never expected to see.

Sources

1. 1.

   WebKit, “Tracking Prevention in WebKit,” webkit.org, accessed June 2026. https://webkit.org/tracking-prevention/

2. 2.

   Mozilla Developer Network, “Storage access policy: Block cookies from trackers,” developer.mozilla.org, accessed June 2026. https://developer.mozilla.org/en-US/docs/Web/Privacy/Guides/Storage_Access_Policy

3. 3.

   Google, “Third-party cookie restrictions,” developers.google.com, accessed June 2026. https://developers.google.com/privacy-sandbox/3pcd/prepare/prepare-for-phaseout

4. 4.

   W3C, “Mitigating Browser Fingerprinting in Web Specifications,” w3.org, September 2025. https://www.w3.org/TR/fingerprinting-guidance/

5. 5.

   Peter Eckersley, “How Unique Is Your Web Browser?,” Proceedings of the 10th International Conference on Privacy Enhancing Technologies, 2010, pp. 1–18.

6. 6.

   Keaton Mowery and Hovav Shacham, “Pixel Perfect: Fingerprinting Canvas in HTML5,” Proceedings of the Sixth Web 2.0 Security and Privacy Workshop, 2012.

7. 7.

   Shekhar Chalise, Hoang Dai Nguyen, and Phani Vadrevu, “Your Speaker or My Snooper?: Measuring the Effectiveness of Web Audio Browser Fingerprints,” Proceedings of the 22nd ACM Internet Measurement Conference, 2022, pp. 349–357.

8. 8.

   W3C, “Fonts, Privacy, and Not Breaking the Web,” w3.org, September 2024. https://www.w3.org/2024/09/font-i18n-privacy.html

9. 9.

   D. Hardt, Ed., “The OAuth 2.0 Authorization Framework,” RFC 6749, IETF, October 2012. https://www.rfc-editor.org/rfc/rfc6749

10. 10.

    T. Lodderstedt et al., “Best Current Practice for OAuth 2.0 Security,” RFC 9700, IETF, January 2025. https://www.ietf.org/rfc/rfc9700.html

11. 11.

    WHATWG, “URL Standard,” url.spec.whatwg.org, June 2026. https://url.spec.whatwg.org/#url-fragment-string

12. 12.

    Gareth Heyes, “SAML Roulette: The Hacker Always Wins,” portswigger.net, March 2025. https://portswigger.net/research/saml-roulette-the-hacker-always-wins

13. 13.

    Joshua Morris, Sara Newman, Kannappan Palaniappan, Jianping Fan, and Dan Lin, “Do You Know You Are Tracked by Photos That You Didn’t Take: Location-Aware Multi-Party Image Privacy Protection,” arxiv.org, March 2021. https://arxiv.org/abs/2103.10851

14. 14.

    Wikipedia, “Exif,” Wikipedia, accessed June 2026. https://en.wikipedia.org/wiki/Exif

15. 15.

    J. Zern, P. Massimino, and J. Alakuijala, “WebP Image Format,” RFC 9649, IETF, November 2024. https://www.rfc-editor.org/rfc/rfc9649

16. 16.

    Brendan Eich, “Fingerprinting Protections,” github.com, accessed June 2026. https://github.com/brave/brave-browser/wiki/Fingerprinting-Protections

17. 17.

    Wikipedia, “Tor (network),” Wikipedia, accessed June 2026. https://en.wikipedia.org/wiki/Tor_Browser

18. 18.

    GPU for the Web Working Group, “Fingerprinting Surface,” github.com, accessed June 2026. https://github.com/gpuweb/gpuweb/issues/3101