scan.now
Premium Scan a site

Hardware details exposed to scripts

Scripts on any page can read your CPU core count, approximate memory, screen geometry, touch capability and in some browsers battery and network state, all of which feed a fingerprint.

Do this: Nothing to fix; privacy browsers report generic values instead. CPU count, memory and GPU model combine into a stable identifier that survives clearing cookies.
PassHardware details are masked or standardised.
InfoScripts can read detailed hardware values from your browser.

The fix, in one snippet

Example to adapt What any page can read 
navigator.hardwareConcurrency   // 8
navigator.deviceMemory          // 8
screen.width + 'x' + screen.height

Illustrative values. Change the paths, hostnames and options to match your own site before using it.

The sections below explain what is tested, why it matters and the alternatives.

What we test

In JavaScript the scan reads navigator.hardwareConcurrency, navigator.deviceMemory (Chromium only, rounded to a power of two and capped at 8), screen.width, screen.height, availWidth, availHeight, colorDepth, devicePixelRatio, navigator.maxTouchPoints, navigator.getBattery() (Chromium; Firefox removed it in version 52 and Safari never shipped it), navigator.connection (Chromium) and the storage quota from navigator.storage.estimate(), which hints at disk size. We report which values are exposed and how common the combination is in our sample. This is informational: none of these is a bug, and every browser exposes some of them.

Why it matters

Each value carries little information alone but changes rarely, so together they anchor a fingerprint over months. The Battery Status API was shown by Olejnik and colleagues in 2015 to allow short-term tracking through the charge level, which is why Mozilla and WebKit removed it. The same values are used by malware to detect analysis sandboxes (two cores and 2 GB of memory look like a virtual machine) and by fraud systems to score sessions. A 16-core CPU, 8 GB reported memory and a 3440 by 1440 screen is a small group of people.

How to fix it

Firefox: privacy.resistFingerprinting reports a fixed core count, spoofs screen values and letterboxes the window to standard sizes; Tor Browser does the same by default. Brave: farbles hardwareConcurrency and deviceMemory per site. Chrome, Edge and Safari: no setting alters these values; a content blocker that stops known fingerprinting scripts is the available defence. Keeping the browser window at a common size rather than full screen on an unusual display helps a little. See fingerprint uniqueness for the combined result, and browser fingerprinting explained and what private browsing does not hide for context.

Where this fits

Hardware details exposed to scripts is check 14 of 16 that the browser security & privacy check runs under browser privacy and policy enforcement, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.

Fix this one first

Above it in the same category sits Do Not Track signal (info), where your browser is not sending the DNT: 1 header. An attacker who has that does not need this, so it is the better use of the same hour.

What fixing this still leaves open

Hardware details exposed to scripts closes one route in. Immediately below it: JavaScript disabled, where javaScript is off in your browser, so the client-side parts of this scan could not run; User-Agent Client Hints exposure, where your browser answers high-entropy Client Hints requests, revealing its exact version, platform version, device model and CPU architecture to any site that asks.

Prompt for an AI Hand this check to an assistant Sign in to copy it
The first few lines 
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.

Finding: Hardware details exposed to scripts (info severity)
Scanner check id: hardware-exposure
19 more lines, including the evidence and the exact fix

The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.

Sign in with Google

Signing in is free and takes one click. We store your email address and nothing else.

References

  1. MDN: Navigator.hardwareConcurrency
  2. MDN: Navigator.deviceMemory
  3. W3C: Battery Status API (privacy considerations)
  4. Olejnik et al., The leaking battery (2015)

Related guides

7 min read · Updated Sep 02, 2026 Browser Fingerprinting Explained: How Sites Identify You Without Cookies

Browser fingerprinting combines dozens of small facts about your browser and device into an identifier that survives cookie deletion and...

Read the guide 7 min read · Updated Sep 15, 2026 What Private Browsing Does and Does Not Hide

Incognito and private windows delete local history, but they do not hide you from websites, your network or your fingerprint. This guide...

Read the guide