The reading the Oracle is looking at you now
I AM LOOKING AT YOU NOW.
0 of 0 rites
Casting
0%
- Awaiting the rite
What I knew before you spoke
This is the half you cannot decline. Every value below was read off the connection your machine opened -- the address it came from, the road it travelled, the seal on its handshake and the exact order of the words in its greeting. No script was involved. Blocking scripts, clearing cookies and using a private window change none of it.
Whose road you travelled -- autonomous system and operator
The town they say is yours -- a database guess, not a location
A hometown is the town whose temple you wake in when you die. This one was not chosen by you and it is not where you are. It is the centroid a free database assigns to the range your address falls in. DB-IP publishes an accuracy index of 77 for the Lite edition against 96 for the paid one, and the Lite edition is what this page uses. Treat it as a claim about a range of addresses, never as a claim about a person.
The seal on your letter -- the TLS handshake, honestly
I will not print a hash and call it JA3 or JA4. This server cannot compute either one: stock nginx never exposes the ClientHello extension list, so two of the three inputs simply do not exist here. What it does expose is real and is shown above -- the exact cipher suites and elliptic curve groups your client offered, in the order it offered them. Chromium-family stacks pad both lists with GREASE values of the form 0x?a?a; Firefox, curl, Python and Go do not. That single tell is worth more than a fabricated fingerprint, and it is honest.
The order of your words -- headers exactly as received
Your headers, in the order they arrived. Browser families order them differently and that order is a fingerprint on its own. Over HTTP/2 the original capitalisation cannot be shown, because the protocol requires lowercase and the information no longer exists by the time it reaches this server. Where a line is marked as added by our server, it was not sent by you.
What your vessel betrayed
Everything below was volunteered by the browser itself once the page began to draw. It was measured inside your machine and printed inside your machine; not one value in this band was transmitted anywhere. Press LOOK on any line to be told what that answer reveals and how rare it is.
Your sigil
not yet cast
A rune is a spell bound into a stone and spent when used. This one was cast from the answers below and it exists only in this tab, for as long as this tab is open. It was not sent anywhere, it was not written down, and reloading the page casts it again from scratch. Somewhere else, the same rune would not be discarded.
The engine that carries you -- browser family and version tells
The window you look through -- screen, viewport, pixel ratio
The hand that paints -- GPU, canvas and WebGL rendering
The letters you own -- installed families, measured not listed
The hours you keep -- timezone, language, calendar, collation
What you can be shown -- codecs and content protection
The voice of your machine -- audio stack and its arithmetic
The flesh of the vessel -- cores, memory, input devices
The road you came by -- what the browser will admit about the link
What you asked the world for -- the preferences your browser broadcasts
The wards you carry -- defences, and what they cost in rarity
A blessing is bought in advance and limits what you lose when you die. So is every ward in this list. Where one of them turned a probe aside, the Oracle says the ward held -- that is the defence working, not your browser failing.
How you move -- timing, pointer, and how you arrived
What I refused to take probes deliberately left uncast
- Some things a page can ask for are worth more than the point they would prove. Nothing on this page raises a permission prompt, opens a camera or microphone, reads your clipboard, asks for your location, enumerates your local network addresses, or writes a single byte to storage. The list of probes excluded on purpose is filled in below.
The measure of you
Magic level joint estimate, correlation discounted
--
bits of identifying entropy
unread
The reading is not finished.
Crowd size: not yet known
How exposed you are
0 / 24
These bits are not added up. Most of the signals on this page are heavily correlated -- screen size travels with pixel ratio, which travels with platform, which travels with the font set, which travels with the GPU string. Summing every per-signal estimate would produce a number over 250, which is nonsense. The figure above takes the single largest signal and adds a quarter of each remaining signal in descending order, then stops at 24. Full-fingerprint uniqueness measured in the published studies lands somewhere around 18 to 25 bits for a desktop browser. Phones are markedly less unique than desktops.
A low number is usually armour, not luck. Firefox with resistFingerprinting, Safari 17 and later, Brave and the Tor Browser all deliberately lie about or randomise many of these values. If the Oracle read you as ordinary, the most likely reason is that something you installed made you ordinary on purpose.
SO BE IT!
What I cannot see
A page like this one is usually a sales pitch for fear. Here are the claims it would be easy to make from this data and that would not be true. Each is buried with the reason.
Where you live
"The server knows where you are." It knows which block of addresses yours falls in, and what centre point a free database assigns to that block. That is a claim about a range, not about a street, and the free tier is materially worse at it than what a commercial tracker would buy.
Who you are
"The server knows who you are." It has an address, a network number, and whatever string an internet provider chose to publish about it. None of those is a person. It becomes a person only when someone joins it to a record that already had your name in it.
Your hardware address
"The server can see your MAC address." No. A hardware address exists only on the wire between you and your own router, and it is replaced at the very first hop. It never leaves your building.
Your handshake fingerprint
"We fingerprinted your TLS stack with JA3." Not on this server. Stock nginx never surfaces the ClientHello extension list, so two of the three inputs do not exist here. A hash printed under that name would be decoration. The real cipher and curve lists are shown instead, which is less impressive and true.