Glassbox tool exposes how 'sneaky' browser fingerprinting tracks users

Security engineer David Dale has released Glassbox, a locally running utility designed to expose the methods tech companies use to fingerprint browsers and track users. The tool provides a transparent look at how easily a device can be singled out from a global population.

Glassbox analyzes more than 30 different probes to estimate a user's "identifiability." These probes include canvas and WebGL rendering, font libraries, WASM features, API matrices, cross-site login states, and silent audio waves. To ensure user privacy, the utility runs entirely within the browser and does not ship data to an external server, with the sole exception of a call to a public geolocation API. Dale noted that he utilized AI tools, specifically Claude Code, to help build and polish the utility's implementation.

The mechanics of tracking

Browser fingerprinting allows trackers and anti-fraud scripts to identify unique devices without relying on traditional cookies. The industry has moved toward increasingly sophisticated methods; for example, recent discoveries revealed that Alibaba's AliExpress used silent sawtooth audio waves to identify browsers.

Glassbox calculates an identifiability score based on published per-signal entropy. This score is capped at approximately 33 bits, which is the theoretical amount of information required to single out one specific person on Earth. It is important to note that this score is an estimate based on known entropy rather than a real-time measurement against a live population of users.

The paradox of browser hardening

According to testing conducted with the tool, users of Chrome, Edge, and Safari are rendered "effectively unique." While Firefox and Tor provided better anonymity, they did not offer absolute invisibility.

Dale warns that attempting to "harden" a browser through heavy customization can ironically make a user easier to track. By changing settings to increase privacy, a user may create a configuration so rare that it becomes a unique identifier in itself. "The single highest-impact move is to use a browser that puts you in a large, identical crowd," Dale said. "Counterintuitively, a heavily customized ‘hardened’ setup often makes you more identifiable, because almost nobody else looks exactly like it. Blending in beats standing out."

Future implications

As tracking techniques evolve to bypass standard privacy settings, the tool emphasizes that the most effective defense is uniformity. Users are encouraged to prioritize browsers that standardize their appearance across a wide user base rather than seeking niche configurations. For developers and security researchers, Glassbox serves as a benchmark for understanding which browser signals currently provide the highest entropy for trackers.