About tattletab
tattletab gives developers an exact report of a user's browser: which web platform features it supports and how it is set up, from screen and fonts to graphics hardware and language. Send your users the link; they send back a report you can debug with. It also shows anyone what their browser gives away to websites.
How it works
Modern browsers run the full checks. Older browsers, down to Internet Explorer 6, run a small basic script with fewer checks. Without JavaScript nothing can be checked, so the page only says so.
All checks run in your browser. The page also asks the server once what it sees of your connection
(IP address, request headers, TLS version), so you can see that part as well. Three more checks reach beyond
the page: it opens a WebSocket to our server, loads a tiny test page from tattletab.jsfi.workers.dev
(our second address) to see whether third-party cookies work, and asks Cloudflare's public STUN server
(stun.cloudflare.com) for your public address, as video calls do, to check WebRTC.
Some checks try things out instead of only looking: they write a test entry to IndexedDB, the Cache API and the origin private file system and delete it straight away, start small workers, and play a tenth of a second of silence to see whether autoplay is allowed. Nothing is kept.
Three checks only run when you click them: video DRM, because some browsers show a notice; third-party services, which contacts CDNs, Google, Stripe, PayPal and others, so those companies see your IP address; and connection speed, which transfers up to about 7 MB to and from our server.
Three tests also need your permission, which the browser asks for: camera and microphone (whether they start and with which settings; the streams stop at once and nothing is recorded), location (whether it works and how accurate it is; your coordinates are never put in the report) and a keyboard and pointer test (the keys you press in the test field and how a line you draw is reported). Their results stay on the page like everything else.
While the checks run, the page notes elements and attributes that extensions add to it, so that extensions we don't know by name show up too. The fingerprint ID is a hash of your values, computed in your browser; it isn't stored or sent anywhere.
For developers
Request links with QR codes, the snippet for your own site, required features, an issue template, comparing reports and the JSON API are on the developer page.
What happens to your data
Your report stays in your browser unless you upload it. Before uploading you can edit the report and remove anything you don't want to share.
An uploaded report is stored for 90 days and then deleted automatically. Anyone who has its link
can read it. Links are made of three words and the date, for example
acorn-chef-dune-2026-11-09. To make guessing links impractical, each connection can look up
at most 60 reports per minute.
The site runs on Cloudflare, which processes your IP address to deliver the pages.
Credits
- The words in share links are based on the EFF Short Wordlist by the Electronic Frontier Foundation, licensed under CC BY 3.0 US.
- The feature checks are generated from MDN browser-compat-data 8.1.8, released under CC0 by MDN and its contributors.
- Baseline status and feature names come from web-features 3.45.0 by the W3C WebDX Community Group, licensed under Apache 2.0.