The method is part of the result.

Every tool separates data collection from interpretation. Results describe a specific observation at a specific time. The workbench does not claim to replace penetration testing, a malware scanner, a certificate revocation service or a legal compliance review.

Browser observations

Fingerprint, canvas, WebGL, offline audio and permission checks use web APIs available to the current page. They can be affected by browser settings, extensions, hardware acceleration, secure-context requirements and deliberate anti-fingerprinting behaviour. Blocked or unavailable fields are reported as such.

The fingerprint digest is SHA-256 over a JSON snapshot of measured signals. It is not a uniqueness measurement. No reference population is collected. Comparing two exported reports is a comparison of those observations, with no statistical inference about the rest of the web.

Network observations

The public IP tool contacts api.ipify.org from your browser. WebRTC uses Google’s public STUN endpoint to gather ICE candidates. DNS checks use Google Public DNS’s JSON endpoint through this server. An AD flag is a resolver’s authentication assertion, not an independent DNSSEC validation performed by this page.

TLS and header checks originate from the site server. Outbound connections are restricted to validated public IPv4 destinations and default web ports. Destinations are resolved and pinned per connection; redirects are rechecked. A TLS check records one negotiated handshake. It does not enumerate all protocol support or run an independent revocation query.

Local data analysis

CSP and cookie tools analyse pasted configuration. JWT verification supports HS256 and RS256 with a key supplied by the user. The supplied key is not automatically trusted. URL checks inspect syntax without visiting destinations or querying a reputation service. HAR checks detect named patterns, not every possible secret.

The file vault uses AES-256-GCM with a fresh 16-byte salt and 12-byte IV, plus PBKDF2-SHA-256 at 600,000 iterations. Its header is authenticated and original filename metadata is encrypted. It is a documented tool-specific format, not an independently certified or externally audited cryptographic product. Keep backups and verify a round trip before relying on a saved file.

Unavailable results stay unavailable

Timeouts, unsupported APIs and rate limits are shown as errors or missing observations. They are never converted into a reassuring result. Findings labelled “review” identify something to investigate; “present” or “matching” describes a measured property, not the safety of the entire system.

Reproducing a result

Record the tool, input type, browser version, date and expected behaviour. Export the report where appropriate, then repeat the same test while changing one setting at a time. Remove secrets before sharing reports. Relevant standards and primary documentation are linked beneath each guide.