What changed, and when
A reference tool is only worth trusting if you can see it being maintained, and see what it got wrong. Everything below shipped on the date given. Corrections are listed as corrections, not quietly folded into a release note.
Every signal now shows its detection call, its sources and a review date
All 32 signal pages gained a block naming the exact JavaScript expression a website calls to read that value, what it returns when a browser withholds it, whether it can be faked, and how much it contributes to a fingerprint estimate. Where browsers differ meaningfully, there is a per-browser table.
Every page now carries at least one primary source, usually the MDN documentation for the API or the specification itself, and the date a human last checked the facts on that page. A build-time check refuses to ship a page missing any of it.
The six category pages were rewritten from link lists into pages that explain how the signals in that category interact, each with a table of every signal in it. A new index at /signals lists all 32 in one place.
Affected: All signals indexed, Methodology.
The uniqueness estimate is now capped, and the method is published
The fingerprint test used to add up its per-signal estimates as though the signals were independent. They are not: a Retina pixel ratio, an Apple GPU string and a macOS platform token describe one device three times. Adding them produced totals above 40 bits, which is one in a trillion, and there are not a trillion browsers.
The reported total is now capped at 33 bits, roughly 8.6 billion combinations, which is already more than the number of people online. Where your reading is capped, the page shows both numbers and says why.
The full table of per-signal estimates and the reasoning behind each one is published at /methodology and at /api/entropy.json, generated from one source file so they cannot disagree.
Affected: Fingerprint test, Methodology.
The privacy policy now describes the site that exists
The policy previously described advertising partners, advertising cookies and a consent option for visitors in the EEA and UK. None of those exist on this site, and none ever have. Describing them was a template artefact, and on a site about what websites collect it was the worst possible place for one.
It now states what is actually true: no advertising, no analytics of any kind, no third-party scripts, no cookies beyond a throwaway one used by the cookie test itself, and exactly two network requests, both to this domain.
Affected: Privacy policy.
Social and canonical metadata completed on every page
Every indexable page now emits its own og:url alongside a working preview image. Several pages had been replacing the shared metadata wholesale and losing the image in the process, so links shared in chat apps rendered without one.
IP and geocoding lookups moved to first-party endpoints
The public IP readout and the consent-gated reverse geocoding previously went through third-party keyless services, which rate-limit at modest traffic and see your request. Both now go through endpoints on this domain, which log nothing and store nothing.
The geocoding relay exists for a second reason: OpenStreetMap's Nominatim service requires requests to identify themselves, and untagged browser traffic can get an entire domain blocked. The relay adds that identification and passes through only the coordinates you consented to share.
Affected: Privacy policy.
ReadMyBrowser launched
A live dashboard of what a website can detect about your browser, with an explainer page per signal, a fingerprint uniqueness test, a user agent parser and generator, an embeddable badge and a keyless JSON API.