A new browser fingerprinting tool called Glassbox has been released, designed to show users how easily their browser and device can be uniquely identified online. Developed by security engineer David Dale, Glassbox operates entirely within the user's browser, without transmitting any data to external servers, while simulating various tracking and anti-fraud scripts commonly found on websites.
Glassbox provides detailed raw data about a browser's characteristics, along with an "identifiability" score. This score is an estimate, calculated by summing published per-signal entropy, accounting for browser masks, and capped at approximately 33 bits, which is theoretically sufficient to distinguish one person globally. Dale noted that because the tool runs locally, this score is an estimate rather than a measurement against a live population, unlike other tools such as AmIUnique or the EFF's Cover Your Tracks, which provide real population numbers.
The inspiration for Glassbox came when Dale learned about silent sawtooth waves used by fingerprinting code on Alibaba's AliExpress site to identify browsers through audio analysis. Instead of forking existing open-source tools, Dale decided to build his own, incorporating this technique and others. He stated that AI tools like Claude Code assisted him in refining the concept and making it accessible.
Glassbox probes over 30 different browser data points, including canvas, WebGL, font libraries, WebAssembly (WASM) features, API matrices, and cross-site login states. Initial testing with the tool showed varying identifiability estimates: a daily-use Chrome browser scored 99 percent, while Tor Browser with an active circuit scored 56 percent. Firefox also demonstrated a lower identifiability rating of 89 percent. These estimates suggest that a Chrome session could be unique among 1 in 7.6 billion browsers, while Firefox users might share a fingerprint with 1 in 681 million, and Tor users with 1 in 408 thousand.
Dale emphasized that the most effective strategy for online anonymity is to use a browser that places a user within a large, identical crowd. He cautioned that heavily customized or "hardened" browser setups can paradoxically make a user more identifiable due to their uniqueness. Beyond browser choice, Dale recommends using a VPN or Tor and addressing WebRTC leaks, which can expose a user's true IP address even when using some VPNs, as WebRTC is often enabled by default. Glassbox includes a section with suggestions for improving online anonymity.
