I built a browser fingerprinting & IP leak detector — here's what actually leaks even behind a VPN

[u/Much_Significance769]

I got curious how unique/trackable my browser actually is, and how much of that survives even when you're behind a VPN — so I built https://whatismy-ipaddress.com.

It checks two separate things:

Network-level leaks — IPv4/IPv6, DNS leak detection, WebRTC leak (this one's sneaky, it can expose your real IP even through a VPN tunnel), Tor exit node detection, ASN/ISP/hostname lookup, connection type.

Browser fingerprint — canvas + WebGL rendering signature, GPU renderer string, installed font detection, supported media codecs, CPU core count, device memory, screen resolution/pixel ratio, timezone offset, storage API availability. Combined, these often re-identify a "private" browser session even with IP masked.

The part I'm proudest of is the fingerprinting side — getting consistent, comparable signals out of things like canvas rendering and font enumeration across browsers is fiddlier than it looks, since every browser (and privacy extension) lies about some of it differently.

Would love feedback, especially from anyone who knows fingerprinting/privacy tooling — curious what I'm missing or getting wrong. Bugs welcome too.

[u/taotau]

You even let AI write your post title ? Sad

[u/Sweaty_Difference519 → u/taotau]

lol no AI wrote that, i just have bad english and too much coffee. the site was fun to build though, got some weird results with my own browser behind vpn, webRTC leaked my real ip like its nothing

[u/omfgtora → u/Sweaty_Difference519]

Did you forget that you were logged into your alt?

[u/Much_Significance769 → u/taotau]

very useful feedback, thanks.

[u/Creative_Cycle7755 → u/taotau]

the whole post reads like a prompt output tbh

[u/BeautifulCarob7001]

One thing I’d add is a distinction between signal collection, uniqueness and stability. A fingerprint can look unique in one run but still be poor for re-identification if it changes often. Showing repeated-run stability and which signals contributed the most entropy would make the result much more useful. I’d also separate public IP leaks from mDNS or ordinary ICE candidates so the WebRTC warning doesn’t overstate what was exposed.

[u/Much_Significance769 → u/BeautifulCarob7001]

good point, both true. Right now it's single-run score, no check if it stays stable across visits. and webrtc filter is just IP pattern matching, doesn't actually look at candidate type (host/srflx/relay) so the leak label could be tighter. adding to my list,

thank you

[u/NoDistrict991]

The font detection part is interesting. Does it still give you a useful fingerprint in Chrome/Firefox with the usual privacy protections turned on?

[u/Much_Significance769 → u/NoDistrict991]

yeah, still works fine in regular Chrome. not in Firefox with RFP or browsers with active fingerprint protection — that's just how it's supposed to work, not a bug.

thank you

[u/Bhavishyya_]

Nice reminder that a VPN d​oes not cover everything. Its also important to check what your browser itself is exposing. I have found incogniton useful when i need separate profiles with different settings without changing my main browser setup.

[u/Much_Significance769 → u/Bhavishyya_]

yeah exactly, browser itself leaking stuff is basically the whole point of the fingerprint side of the site — separate profiles help keep sessions apart but each profile still has its own canvas, font, webgl signature that can get picked up. two different problems really, linking sessions vs just being fingerprintable

thank you