Test persistent tracking in your browser
With your consent, this page stores one test ID in cookies, storage and cache. Clear them to see which places still hold it and whether a copy can put it back into other places.
Start the test
Nothing is stored in this browser until you tick the first box and press start. Then the page writes one random test ID, which says nothing about you, into each place in the table so you can delete them and see which come back.
The erase button deletes the test ID from every place at once. The site keeps nothing except the fingerprint hash and test ID for 24 hours when you tick the second box.
Your test
Try the test
- Tick the first box, the second as well if you want, and start the test.
- Clear this site's cookies in the browser settings, or close the tab and open the page in a new one.
- Come back to this page and press check to see which places kept the test ID and which got it back.
- Try clearing more, such as all site data or the cache, or use a private window, then check again. Erase the test ID when you are done.
Places and results
| Place | What it holds |
|---|
Browser storage facts
| Storage allowance | – |
|---|---|
| Keeps data when space runs short | – |
| Cookies | – |
| Fingerprint hash | – |
A much smaller storage allowance than usual is one way fraud checks guess that a private window is in use. The fingerprint hash is what the second box lets the site keep.
How each place keeps an ID
| Place | How it keeps the ID | How fraud checks read it |
|---|---|---|
| Cookie | The cookie is sent with every request to this site and lasts a year. Clearing cookies for this site deletes it. | A cookie seen on many accounts or applications can point to one device behind them. A returning customer's cookie can let a login go ahead with fewer steps. |
| Local storage | Local storage has no end date and is read only by this site's script. Clearing site data deletes it, and clearing cookies alone often does not. | Checks read it like a cookie, and it often lasts longer. A device can still appear known after its cookies were cleared. |
| Session storage | Session storage lasts while the tab is open and links pages seen in that tab. Closing the tab clears it. | It links pages in one tab, such as an application form restarted with different details. |
| IndexedDB | IndexedDB keeps data until site data is cleared. It can hold far more than a cookie. | It is another copy of a device ID. Clearing only cookies leaves this copy behind. |
| Cache | This site's script writes the test ID to cache storage. It stays until site data or the cache is cleared. | It is another copy of a device ID. If every copy disappears at once, that can prompt a closer look. |
| Window name | The window name stays with the tab as it moves from page to page, even to another site. Clearing cookies or storage does not touch it, and closing the tab ends it. | It links pages and sites seen in one tab. Fraud checks rarely rely on it alone. |
| ETag | The server gives a response a tag that is the test ID. The browser caches it and sends it back when it asks again, so the ID survives clearing cookies and storage. Clearing the cache deletes it. | A device ID in the HTTP cache can show a device returning after cookies were cleared. Some privacy tools limit this. |
| Last-modified date | The test ID is written as the response's last-modified date, which the browser sends back unchanged. Clearing the cache deletes it. | Checks read it like an ETag, as another copy in the HTTP cache. |
| Fingerprint | Nothing is stored in the browser. The site keeps the fingerprint hash with the test ID, and the same browser gives the same hash, so the ID is found again after everything in the browser is deleted. The site deletes it after 24 hours or when you erase it. | A fingerprint can link accounts, applications and payments from one device after stored IDs are deleted. A fingerprint with no stored ID beside it can prompt a closer look. |
What persistent tracking shows
Putting an ID back into places it was deleted from, using copies that remained, is how persistent trackers work. Fraud checks use the same places to recognise a returning device, and a device that clears every place at once or keeps changing them can prompt a closer look.
A stored ID points to a browser on a device, not a person. Browsers may limit some of these places or keep them apart per site, and a returning or missing ID alone says nothing about fraud. It is read alongside the email address, the IP address and the rest of the application.
A returning device ID can be read by your rules in a sign-up, application or payment decision, alongside the email address and the IP address. Start free
What persistent tracking means
Persistent tracking checks whether a site can recognise a browser after cookies are cleared. This test stores one random test ID in several places in the browser and shows which places still hold it.
A returning device can matter when reviewing a sign-up, application or payment. Read the result alongside the email address, the IP address and the rest of the application.
Common questions
What is persistent tracking?
Persistent tracking is a way for a site to recognise a returning browser through data kept in more than one place. This test shows which places still hold its test ID after cookies are cleared.
What is an evercookie or supercookie?
Evercookie and supercookie are names for persistent tracking that can use several places to keep or find an ID. This test shows which places in your browser still hold its test ID.
How does ETag tracking work?
The server gives a response a tag that contains the test ID, and the browser sends the tag back when it asks again. The ID can remain in the cache after cookies and storage are cleared.
Can a website track me after I clear cookies?
A test ID may remain in places such as local storage or the cache after cookies are cleared. This page checks which places still hold its ID.
Does private browsing stop persistent tracking?
This test does not claim that a private window hides a device. It shows which places are available and whether they hold the test ID.