Can Websites See Your Computer Name? Check the Claims

You renamed your laptop to something personal. Then an IP checker showed a field called “hostname,” or a login alert named your computer, and you wondered whether every website gets that name when you open a tab.

An ordinary public website does not get your Windows device name or Mac computer name through a standard browser API. But several things on a privacy checker are called a name, and they refer to different machines. Mixing them up makes a fairly boring network lookup look like someone reached into your settings.

The hostname in JavaScript belongs to the website

Open the console on this page and evaluate location.hostname. On the public site it returns bscan.info. On a local preview it may return localhost. Neither result is the name of the computer reading the page. It is the host part of the page’s URL, as the Location API documentation specifies.

The word “host” in an HTTP request causes the same confusion. Host: bscan.info tells the server which website you requested. HTTP/2 and HTTP/3 can carry that information in :authority. These identify the destination, not your laptop. That is the meaning defined in HTTP’s Host and authority fields.

Try the demo below. Its first two values are actual browser readings. The computer-name row states what standard browser APIs expose. It cannot rule out information you share through other routes.

The User-Agent is a browser-supplied description of your software. It can name an operating-system family and a browser version. It has no standard field for the device name you chose in Settings. An extension or a custom browser could put extra text in it, so read the actual string rather than assuming it is empty of personal details. We cover the reliability of those software claims in why the User-Agent and the engine can disagree.

A public IP hostname is another name again

A server can take the source IP of your connection and attempt a reverse-DNS lookup. The result might look like customer-203-0-113-8.isp.example, a hosting-provider name, or nothing at all. That is an invented example of a DNS record.

Reverse DNS asks whoever controls the address’s reverse-DNS records what name they published for it. It does not ask Windows or macOS what you named the machine. On a home network using IPv4 NAT, several devices may share the public address. A public hostname therefore cannot be treated as the name of whichever laptop opened the page.

Do not turn that into “a hostname can never identify a machine.” An organization may deliberately publish a meaningful name for a publicly addressed computer. The record could even match its local name. The point is where the result came from: published DNS data, not a standard webpage API that reads your settings. A VPN can change which connection address a site sees; it does not establish what other information the site already knows.

Can an upload reveal your Windows username?

A path such as C:\Users\Alice\Documents\invoice.pdf contains a username. A normal single-file HTML picker does not hand that full path to the page. The input’s value uses a privacy-preserving string such as C:\fakepath\invoice.pdf, and File.name contains the filename without its path. MDN documents the fake path; it is not a folder you need to delete or a Windows error.

Use the demo’s harmless sample, then choose it in the picker. Compare input.value with File.name. Seeing a Windows-shaped fake path on a Mac does not mean the page detected Windows. The string is there to hide the real directory structure.

The filename itself is visible. If you choose Alice-Payroll-October.pdf, the page gets that name. Choosing a file also gives the page access to that file’s contents; it does not have to wait for you to press a separate Upload button. This demo displays only the name and the input value. It never reads the contents or sends the file anywhere.

That distinction matters when evaluating other sites. A local preview may read a file without uploading it. A different page can transmit it as soon as selection completes. Folder pickers are a separate feature and can expose relative paths inside a chosen folder. A fake path is protection for your full local path, not a promise that your selected files contain no personal information.

Who can actually learn your computer name?

Your local network is a different observer from a random public website. Device names can appear in network protocols and service discovery. RFC 8117 describes the privacy problem, including names exposed through DHCP and multicast DNS. A router’s device list can therefore know something a normal public webpage does not. Opening that router’s administration page does not give every other website the router’s knowledge.

On a corporate intranet, Windows Authentication lets configured web applications authenticate users with their Windows accounts. Microsoft’s Windows Authentication guide describes its use on corporate intranets. An authenticated account name arriving through that arrangement is different from an arbitrary script reading your OS username. A company portal can also show device details from its own inventory. Ask which integration supplied the label before concluding the browser exposed it.

You can also send the name yourself. A screenshot of Settings can show the device name. A diagnostic log can contain a hostname or a home-directory path. A document can contain an author name. Those are reasons to inspect what you share, even though the page has no general-purpose “read computer name” function.

Renaming your PC does not reset a browser identity

If an account is recognized after you rename the computer, that is unsurprising. A site can recognize a session from its cookies or your login. It can also combine browser characteristics into a fingerprint. None of that requires the name printed in your device settings. The same distinction explains why a website’s device recognition does not require your MAC address.

Changing Alice-Laptop to Desktop is sensible if you dislike broadcasting a personal label on local networks. It does not clear cookies, change a login or replace the rendering characteristics used in canvas fingerprinting. A checker can recognize your browser without finding your computer name.

For client-account work, separate browser profiles are more relevant than a new PC name. Incogniton is one tool for managing those profiles. Treat that as a workflow choice, not a guarantee that an uploaded document or an authenticated company portal cannot identify you.

Start with the claim you actually saw. If the value is the current site’s domain, it came from the URL. If it resembles your provider, check whether it is reverse DNS. If it contains your personal name, inspect the filename, account or diagnostic data you supplied. Then run the browser scan to examine the signals a webpage can read without knowing your PC’s nickname.