Everything below is what a website can see about your device. Anything that reads sensitive data (clipboard, persistent storage) only runs when you press the matching button — nothing fires automatically.
Generates a silent tone and hashes how your specific audio stack renders it. Runs on click since some browsers require a user gesture to start an AudioContext.
Detects fonts by comparing text measurements — no filesystem access, but can reveal software you have installed (e.g. "Calibri" → likely has MS Office).
VPNs hide your public IP but sometimes leak your real local/public IP through WebRTC's ICE candidate gathering.
Device kind and count are visible without permission. Device labels (e.g. "Logitech C920") are hidden until you grant camera/mic access.
The list of installed TTS voices differs by OS and language packs, adding entropy to a fingerprint.
This does not run automatically. Modern browsers require a real click and will show their own permission prompt — that prompt is the actual security boundary, not this page. Try copying something first, then click the button.
This is a clearly-labeled demo of one weak "supercookie" pattern: an ID stored in more than one place so clearing cookies alone doesn't remove it. Real evercookie-style trackers go much further (cache ETags, HSTS pinning, favicon caching, respawning across vectors) specifically to resist deletion — that's a tracking-evasion technique, not a privacy-education feature, so it isn't implemented here.
Current permission state only — no access is being requested.