“The ‘identifiability’ number is an honest model, not a measurement,” Glassbox developer David Dale said, summarizing a tool he built to show how trackers can single out a browser and device from the crowd.
How Glassbox runs: a local mirror of live fingerprinting
Glassbox is a browser-based utility that runs entirely in a user’s browser and — apart from pinging a public geolocation API — does not ship identifying details to the web, according to its developer. It behaves like the anti-fraud scripts, trackers and other fingerprinting code users encounter online, but presents raw, unfiltered probe data that a curious user can inspect. Rather than submitting results for comparison against a live population, Glassbox estimates how identifiable a browser is by summing published per-signal entropy, discounting masks, and capping the result at roughly 33 bits — the level the developer says is needed to single out one person on Earth.
What Glassbox probes: audio, canvas, WebGL, fonts and more
Dale designed Glassbox to exercise around 30 different probes for unique browser data. The tool inspects canvas and WebGL rendering, font libraries, WebAssembly features, API matrices and cross-site login states, among others. It specifically factors in a technique discovered on Alibaba’s AliExpress site: inaudible “silent sawtooth” audio waves used by fingerprinting code that can help identify a browser. Glassbox’s output therefore mirrors a wide set of techniques that modern trackers use to assemble a fingerprint.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildMeasured estimates from real testing: Chrome, Firefox, Tor
In independent testing described in the source piece, Glassbox’s identifiability estimates varied widely across browsers. A Chrome session used daily for work produced an identifiability estimate near 99 percent and was judged unique to roughly 1 in 7.6 billion browsers; the writer noted that their ISP’s IPv6 allocation made the IP address even more identifying. Firefox produced an estimated identifiability of 89 percent, characterizing that setup as sharing a fingerprint with about 1 in 681 million Firefox users. Tor with an active circuit came in far lower: an estimated 56 percent identifiability, or 1 in 408,000 Tor users. Safari and Edge in the same testing were labeled “effectively unique.”
Advice baked into the tool: blend in, patch WebRTC leaks, consider VPN or Tor
Dale emphasizes that the single highest-impact move is to use a browser that places you in a large, identical crowd. Counterintuitively, he warned, a heavily customized or “hardened” setup often increases identifiability because few other browsers look like it. Glassbox includes a page of anonymization suggestions and the developer recommends a VPN or Tor, plus a fix for the long-running WebRTC leak that can reveal a browser’s real network address even when a VPN is active. Those steps — choice of browser, network-layer tools and closing WebRTC leaks — are presented as practical mitigations against the probing techniques Glassbox demonstrates.
What this means for technologists, end users, and policymakers
- Technologists and security teams: Glassbox gives a local testbed for the specific signals to watch — canvas, WebGL, font stacks, WASM features, API fingerprints, cross-site login states and even the audio sawtooth technique exposed on AliExpress — and a model for evaluating how masks and obfuscations affect per-signal entropy.
- End users and the general public: The tool’s takeaway is concrete: choosing a mainstream browser configuration and closing known leaks (WebRTC) can reduce how uniquely you’re identified; Glassbox’s guidance lists steps users can try locally without sharing data externally.
- Policymakers and privacy regulators: Glassbox highlights the diversity of fingerprinting methods — including inaudible audio probes — that may merit attention when regulators evaluate transparency or restrictions around automated user identification.
Glassbox is not positioned as a population-measuring service. Dale acknowledged the limitation repeatedly: because it runs without a server-side population to compare against, its identifiability figure is an estimate rather than a true rarity measurement. Still, by running the same probes a tracker would use and exposing the raw signals, the tool offers a practical window into how easily modern browsers can be singled out — and it underscores a blunt lesson for anyone who values anonymity online: blending in often beats standing out.
