# bscan.info

> Free in-browser tools to inspect what websites can learn about you: public IP and geolocation, browser fingerprint (canvas, audio, WebGL, fonts), WebRTC leaks, ad-blocker detection, and more. Plus a small set of standalone privacy utilities and a blog covering tracking and security topics.

Browser tests and file utilities run in the visitor's browser unless noted. The server stores aggregate fingerprint-hash popularity counts, without IP addresses or raw browser data. IP geolocation and reputation use self-hosted databases and proxied external lookups; see the privacy statement for provider details.

## Agent access

- Request any public page with `Accept: text/markdown` for its server-rendered Markdown representation. This includes translated pages in English, Spanish, Portuguese, Chinese, Russian and German. HTML remains available with `Accept: text/html`.
- [Page catalog](https://bscan.info/api/agent/pages): Every indexable public page, with HTML and Markdown URLs. Filter with `locale=en|es|pt|zh|ru|de` and `kind=scan|blog|tools`.
- [API catalog](https://bscan.info/.well-known/api-catalog): RFC 9727 discovery of the public read-only documentation API.
- [OpenAPI description](https://bscan.info/openapi.json): Parameters and response formats for page discovery and Markdown access.
- [Agent skill index](https://bscan.info/.well-known/agent-skills/index.json): Site usage instructions with a SHA-256 integrity digest.
- [Access documentation](https://bscan.info/auth.md): Public content requires no account, key, token or payment.
- Supporting browsers expose two read-only WebMCP tools on public pages: `bscan_list_pages` and `bscan_read_page`.

Markdown does not execute browser measurements or process user files. Live measurements in an agent's browser describe that browser, not the user's separate browser. Use the HTML tools for local file processing and permission-dependent checks.

## Main pages

- [Browser scan (homepage)](https://bscan.info/): Live IP address, geolocation, and browser-fingerprint report. Plots where multiple independent geolocation services think the visitor is (they usually disagree), and detects WebRTC leaks, timezone mismatch, ad-blocker presence, incognito mode, the visitor's live Google reCAPTCHA v3 score (opt-in), plus canvas/audio/WebGL/font hashes and a combined fingerprint.
- [Blog](https://bscan.info/blog): Articles on browser fingerprinting, IP geolocation, WebRTC leaks, ad-blocker comparisons, and online privacy.
- [Privacy tools](https://bscan.info/tools): Index of standalone client-side utilities listed below.

## Blog posts

- [Can Websites See Your Computer Name? Check the Claims](https://bscan.info/blog/computer-name): Live URL-hostname and file-picker readings explain the difference between your PC name, public reverse DNS, software descriptions and selected filenames.

- [Can Websites Read Your Clipboard? Test the Two Ways](https://bscan.info/blog/can-websites-read-clipboard): A local, opt-in demo separating paste events from direct clipboard reads, browser permission differences, and the limits of clipboard history access.

- [Canvas Fingerprinting: What Your Canvas Hash Gives Away](https://bscan.info/blog/canvasHash): What canvas hashes are, how they're used to fingerprint browsers, and how to defend against canvas-based tracking.
- [Audio Fingerprinting: The Sound of Tracking](https://bscan.info/blog/audioFingerprinting): How the AudioContext API is abused for tracking and what mitigations exist.
- [Camera Fingerprinting: Exposed by Your Webcam](https://bscan.info/blog/cameraFingerprinting): How cameras can be fingerprinted by their unique sensor characteristics, even without recording.
- [WebRTC IP Leak: What It Is and How to Protect Yourself](https://bscan.info/blog/webRTC): How WebRTC can reveal a real IP address even behind a VPN, and how to prevent it.
- [Understanding IP Address Geolocation Inaccuracy](https://bscan.info/blog/ip-geolocation-accuracy): Why IP-based geolocation is often wrong and how lookup services like ipinfo.io and iphub.info work.
- [Comparing 5 Popular Adblockers](https://bscan.info/blog/adblockComparison): Side-by-side comparison of uBlock Origin, Adblock Plus, Ghostery, and others.
- [Comparing a Normal and a Secure Browser](https://bscan.info/blog/browserCompare): Privacy and fingerprinting differences between a hardened browser (Incogniton) and stock Chrome.
- [Your User-Agent Lies. Your Chromium Version Doesn't.](https://bscan.info/blog/chromium-version): How JavaScript feature detection reveals the real Chromium version regardless of what the User-Agent claims.
- [Zen Browser and Widevine: Why Netflix Won't Play](https://bscan.info/blog/widevine-drm): Why Zen Browser (and other Firefox forks) report Widevine DRM as supported yet fail to play Netflix (Verified Media Path), how DRM support works as a fingerprinting signal, and what to do about it.
- [One Browser, Five OS Claims: Why Platform Spoofs Get Caught](https://bscan.info/blog/platform-spoofing): The five places a browser names an operating system and why inconsistent platform spoofs are detectable.
- [Are You Detectable as a Bot? Test Your Browser for Automation Leaks](https://bscan.info/blog/bot-detection): A live test for the automation signals anti-bot systems check, and why stealth plugins can make a bot easier to catch.
- [Timezone Leak: Your VPN Moves Your IP, Not Your Clock](https://bscan.info/blog/timezone-leak): How the OS timezone read by JavaScript contradicts a VPN exit IP, why half-spoofing it is worse, and a live mismatch test.
- [Font Fingerprinting: Your Installed Fonts Give You Away](https://bscan.info/blog/font-fingerprinting): How websites measure installed fonts with a width trick, what the list reveals about OS and software, and a live font fingerprint test.
- [Language Leak: Your VPN Doesn't Change Your Browser Language](https://bscan.info/blog/language-leak): How the Accept-Language header and navigator.languages contradict a VPN exit IP, why half-spoofing them is worse, and a live language-vs-IP test.
- [How Websites Detect Your Ad Blocker (and When They're Wrong)](https://bscan.info/blog/adblock-detection): How anti-adblock scripts use bait elements and decoy ad requests, why they misfire on DNS filtering and privacy browsers, and a live six-check test.
- [Why You Keep Getting CAPTCHAs (and How to Make Them Stop)](https://bscan.info/blog/captcha-everywhere): Why risk engines keep challenging some visitors — IP reputation, cookie history, tampered browser APIs, behavior — with a live trigger check and fixes per cause.
- [reCAPTCHA Score Too Low? What It Means and How to Fix It](https://bscan.info/blog/recaptcha-score): What the reCAPTCHA v3 score is (0.0–1.0, four levels on free keys), where the 0.5 cutoff comes from, the documented reasons scores drop (IP traffic, automation, tampered environments), and a live check of the visitor's own score with Google's reason codes.
- [How Websites Detect Your VPN (and How to Test Yours)](https://bscan.info/blog/vpn-detection): How sites spot VPNs from the IP's owner (ASN), reputation lists, a time zone or language that still says home, WebRTC, TCP and DNS tells, why obfuscated servers don't help against websites, and a live VPN detection test.
- [Battery Fingerprinting: Your Charge Level Is a Tracker](https://bscan.info/blog/battery-fingerprinting): How the Battery Status API re-links you across sites with a near-unique charge reading, the capacity-recovery-from-precision trick, and why Firefox removed it and Safari never shipped it.
- [Can Websites See Your MAC Address? What They Use Instead](https://bscan.info/blog/mac-address): Why no website can read a MAC address (it is rewritten at every router and browsers have no API for it), why old Java/ActiveX-era answers say otherwise, whether a VPN hides it, and what "device bans" actually pin to — with a live test of what a page can see.
- [WebGL Fingerprinting: What Your GPU Tells Every Website](https://bscan.info/blog/webgl-fingerprinting): What the unmasked WebGL renderer string and render hash reveal (GPU model, device ID, graphics API and therefore OS), why "WebGL fingerprinting is present" is normal, how checkers decide "WebGL renderer info is spoofed" (API/OS mismatch, vendor mismatch, patched getParameter, per-read noise), common false alarms, and a live WebGL spoof test.
- [Can Websites See You Switch Tabs, Copy or Screenshot?](https://bscan.info/blog/can-websites-see-tab-switching): What a web page is told about your actions (visibilitychange and blur for tab and window switches, copy/cut/paste and selection events, beforeprint, the PrintScreen key quirk, cursor leaving the window, its own other tabs via BroadcastChannel) versus what no event reports (OS screenshots, screen recordings, other sites' tabs, which app you switched to), why exam software and phone apps can see more, and a live widget that logs your own actions.
- [Our Commitment to Your Privacy](https://bscan.info/blog/privacy): How bscan.info handles (and doesn't store) data while demonstrating tracking techniques.

## Tools

- [2FA Code Generator](https://bscan.info/tools/2fa-generator): Time-based one-time password (TOTP) generator with secure encrypted sharing and QR-code scanning. Runs offline.
- [Password Strength Checker](https://bscan.info/tools/password-checker): Entropy calculation, crack-time estimates, and pattern detection. Nothing leaves the browser.
- [Image Metadata Stripper](https://bscan.info/tools/metadata-stripper): Removes EXIF data, GPS coordinates, and camera info from photos before sharing. Files never leave the device.
- [Unicode Escape Converter](https://bscan.info/tools/unicode-converter): Bidirectional conversion between native text and Java-style `\uXXXX` escape sequences.
- [Array Converter](https://bscan.info/tools/array-converter): Converts a list of values into formatted arrays for JavaScript, Python, PHP, Perl, and CSV.
- [PDF Metadata Remover](https://bscan.info/tools/pdf-metadata-remover): Shows the hidden metadata in PDF files (author, title, dates, producer, XMP) and rewrites the document without it. Files never leave the device.
- [Video Metadata Remover](https://bscan.info/tools/video-metadata-remover): Lists the hidden metadata in MP4, MOV, M4V, 3GP, WebM and MKV videos (GPS location, device make/model, dates, software, XMP/C2PA packets, GoPro/DJI/Sony telemetry tracks) and overwrites it in place with zero-filled padding. No re-encoding, no upload; files never leave the device.
- [Webcam & Mic Test](https://bscan.info/tools/webcam-mic-test): Live camera preview with resolution and measured frame rate, microphone level meter and waveform, and local record & playback. Streams never leave the device.
- [Invisible Character Detector](https://bscan.info/tools/invisible-character-detector): Reveals zero-width spaces, hidden Unicode, bidirectional controls, tag characters (with decoded smuggled ASCII payloads) and stray variation selectors in pasted text, and removes them without breaking emoji sequences. Optional normalization of AI-style punctuation (curly quotes, long dashes, ellipses). Runs client-side; text never leaves the browser.
- [Bluetooth Signal Tester](https://bscan.info/tools/bluetooth-tester): Scans and connects to nearby Bluetooth Low Energy (BLE) devices via Web Bluetooth, inspects GATT services/characteristics, reads battery and device info, and monitors RSSI signal strength. Runs client-side; needs Chrome/Edge/Opera.

## Technical demos

- [DBSC Demo — Device Bound Session Credentials](https://bscan.info/DBSC): Interactive demo of Chrome's experimental Device Bound Session Credentials (DBSC) API — hardware-backed session binding via TPM / Secure Enclave so a stolen session cookie is useless on another machine. Exercises the full registration → refresh flow against live SvelteKit endpoints.