Free exposure check
What the internet already knows about you
This page reads your browser the way a tracking script would — canvas and audio fingerprints, fonts, graphics card, screen and time zone — and shows you every value it finds. The check runs on your device. Nothing is sent, and nothing is stored.
Runs locally — nothing sent, nothing stored
Ready when you are
The check takes a couple of seconds and reads your browser locally. It starts only when you press the button: this page does not fingerprint you in order to explain fingerprinting.
Signals found
Your report appears here, with each value and what it tells a site about you.
About your IP address
Your public IP address and an approximate location travel with every request you make, including the one that loaded this page. JavaScript cannot read them, so we do not show them and we do not need them. If you want to know what your connection exposes, look at it from a network you do not control.
Fingerprints survive cleaning
Clearing cookies does not change your canvas or audio fingerprint. That is the whole point of them: they let a site recognise you again after you deleted everything.
Blocking is not the same as hiding
Blocking the canvas makes you rarer, not invisible. Very few browsers block it, so a blocked canvas becomes a signal of its own.
A score is a comparison
This number compares your browser to an ordinary unprotected one. It does not measure your risk of being attacked, and no score makes you anonymous.
Tools
Check whether a password has been leaked
Password breach check
Enter a password to see whether it appears in known data breaches. It is hashed in this browser first, and only the first five characters of the hash are sent — which is why the lookup can never reveal which password you typed.
Your password never leaves this browser. It is hashed locally with SHA-1, and only the first five characters of that hash are sent.The lookup uses the Have I Been Pwned range API, which answers with every hash suffix matching those five characters. We never see your password, and the service cannot tell which of the returned hashes is yours.
Tools
Questions people ask about this check
What runs, what leaves your browser, and what the score really means.
Does this check send anything to BaitScan?
No. The report is assembled in your browser and never transmitted, and there is no endpoint on this site that would accept it. You can confirm that in your browser's network tab.
Why do I get a different score in another browser?
Because browsers differ in what they give away. A hardened browser deliberately returns random or empty values for canvas, audio and GPU, and the score is built to reward exactly that.
Can I be tracked without cookies?
Yes, and this report shows how. A canvas or audio fingerprint computed once can be stored server-side under any identifier a site invents, which is why deleting cookies is not enough on its own.
Is it safe to check my password here?
Your password is hashed inside this page before anything leaves it, and only five characters of the hash go out. That split is what makes the lookup impossible to reverse into a specific password.
Does a good score make me anonymous?
No. It means the values normally used to tell you apart were harder to read. Your IP address, your provider and your logins still identify you to the sites you actually sign in to.
Got something suspicious to check?
This tool looks at your browser. The other tools look at the message, link, email address, phone number or QR code you received.