JPKCom DB

Info Tools — Manual

Full reference: the Client Hints summary, all nine tabs from Connection to API, the plain-text endpoints and the JSON export.

Back to overview: Info Tools · Open the live tool: www.jpkc.com/tools/info/

This manual walks through Info Tools section by section: what each data point means, where it comes from (server or browser), and how to read the result. Tab and field names appear exactly as they do in the interface. Next to many field names the tool also shows the source of the value in code type, such as REMOTE_ADDR or navigator.languages.

Usage: enter nothing, just read

Info Tools requires no input. You load the page and it fills itself in. At the top sits the At a glance card with the summary; below it, a card with nine tabs: Connection, Headers, Display, Media features, Locale & time, Capabilities, Permissions & storage, Navigator and API. On narrow screens the tabs wrap onto several lines.

Some values arrive asynchronously: the hostname, the exact versions from the Client Hints, permissions, storage quota, battery and the clock offset. Until then a placeholder such as "looking up…" or "measuring…" holds their place. The load times (Page load) are only measured once the page has fully loaded.

Next to most text values sits a small copy button that puts exactly that value on the clipboard. At the very top, Copy as JSON and Export as JSON handle the entire dataset (see JSON export).

Where the data comes from

The split between server and client data is the tool's core concept:

  • Server-side (PHP) are only the values your browser sends with the request anyway: IP address, source port, HTTPS status, SERVER_PROTOCOL, X-Forwarded-For and the request headers (Headers tab). Every server you visit sees this data.
  • Client-side (JavaScript in the browser) is everything else — summary, display, media features, locale, capabilities, permissions, navigator. Your browser reads these values locally; they are not transmitted to the server. Every value goes into the page as plain text, never as HTML.

Two values need an extra request to the server, without any client data going along: the hostname (reverse DNS of your IP) is fetched via ?host, and for the clock offset the page asks ?time for the server time.

Summary: At a glance

The headline sums up browser, major version and operating system in one line, e.g. "Firefox 144 on Windows 10 or 11"; with Client Hints the exact platform version follows the operating system. Below it:

  • Browser — name and version, labeled with its source: Client Hints or User-Agent.
  • Engine — Blink, Gecko or WebKit (every iOS browser uses WebKit).
  • Operating system — operating system and version.
  • Device — device type (desktop, mobile, tablet), plus model and form factors where available.
  • Architecture — CPU architecture and bitness, if the browser reports them.
  • IP address (REMOTE_ADDR), Hostname (reverse DNS), Protocol (nextHopProtocol), Language (navigator.language) and Time zone (Intl).

User-Agent Client Hints deliver exact values in Chromium browsers: the tool calls getHighEntropyValues() for architecture, bitness, form factors, the full version list, model, platform version and WoW64. When picking the brand, the more specific name wins (Edge, Opera, Vivaldi, Brave, Yandex Browser or Samsung Internet over Chrome and Chromium); placeholder entries such as "Not.A/Brand" are ignored. Windows is identified by its platform version: from 13 upward the tool reports Windows 11, from 1 upward Windows 10, below that Windows 7/8/8.1.

Without Client Hints (Firefox, Safari) the tool parses the User-Agent string and says so. There, Windows 10 can't be told apart from 11 ("10 or 11"), macOS is frozen at 10.15.7 in the User-Agent ("10.15.7 or later"), and an iPad in desktop mode poses as a Mac — the tool spots it by more than one touch point and shows iPadOS. Such limitations appear as notes beneath the summary, as do the cases where the browser withholds the exact values or reports no OS version on Linux.

The hostname shows up after a short delay. Without a PTR record it reads "no PTR record". Lookups are limited: at most 20 requests per minute per IP and at most three concurrent lookups on the server. Once a limit is hit, the tool shows "rate limited — try again later" or "lookup busy — try again later".

The tabs

Connection

The tab has three sections.

Connection describes the connection itself:

  • IP address (REMOTE_ADDR) and Hostname (reverse DNS), as in the summary.
  • Protocol (browser) (nextHopProtocol) — the protocol your browser actually spoke: HTTP/3 (QUIC), HTTP/2 or HTTP/1.1.
  • HTTPS — badge "secure (HTTPS)" or "not secure (HTTP)".
  • Remote port (REMOTE_PORT) — the source port as the web server sees it.
  • Server-side protocol (SERVER_PROTOCOL) — the protocol between the front-end server and PHP. It can differ from what your browser used (e.g. HTTP/1.1 instead of HTTP/2).
  • X-Forwarded-For — the proxy chain, if a proxy or CDN set the header; otherwise "not set (direct connection)".
  • Online (navigator.onLine) — "online" or "offline", updated automatically when it changes.

Network Information API (navigator.connection, Chromium only) shows Effective type (e.g. 4G), Downlink (estimate) in Mbit/s, Round-trip time (estimate) in ms, Data saver (on/off) and, if present, Connection type. Chromium rounds these estimates on purpose (privacy) — they are not measurements. When the connection changes, the section updates. If the API is missing, a note says so.

Page load (Navigation Timing) breaks the load of this page into phases: Protocol, DNS lookup, TCP connect, TLS handshake, Time to first byte (responseStart − requestStart), Download, DOM interactive, DOMContentLoaded, Load event and Transferred (HTML) (transferSize). The values come from the navigation timing entry (performance.getEntriesByType('navigation')) and are relative to the start of the navigation. If a connection was reused or the DNS answer cached, you'll usually see 0 ms. The tool shows a dash only when the browser reports no timestamp for a phase: "— (cached or reused)" for DNS lookup, "— (connection reused)" for TCP connect and TLS handshake. For TLS handshake that dash also appears when the page was loaded without HTTPS — then there simply was no TLS handshake.

Headers

A table of every request header your browser sent for this page — in the order the server received them. Besides User-Agent, Accept, Accept-Language and Accept-Encoding, you'll also see headers such as Sec-Fetch-*, Sec-CH-UA-*, Sec-GPC or Upgrade-Insecure-Requests.

Two headers are deliberately never shown in clear text: for Cookie only the number and names of the cookies appear ("… (values hidden)"), for Authorization and Proxy-Authorization only the scheme ("Basic … (hidden)"). That applies equally to the page, the export and the ?headers and ?json endpoints.

Display

Screen and window geometry:

  • Screen (screen.width × height) in CSS pixels and Screen in device pixels (× devicePixelRatio).
  • Available area (screen.availWidth × availHeight) — excluding taskbars and the like.
  • Viewport (innerWidth × innerHeight) and Layout width (without scrollbar) (documentElement.clientWidth).
  • Window (outerWidth × outerHeight).
  • Device pixel ratio — ratio of physical to CSS pixels, e.g. 2x on Retina displays.
  • Colors (screen.colorDepth) — color depth in bits, plus the number of colors computed from it.
  • Orientation (screen.orientation) — type and angle, e.g. landscape-primary (0°).
  • Touch (maxTouchPoints) — "yes (n points)" or "no".
  • Zoom-aware root font size — the computed font size of the <html> element, which reveals a changed default font size in the browser.

The values update live when you resize the window or rotate the device — no reload needed.

Media features

How your browser currently evaluates 18 CSS media features: prefers-color-scheme, prefers-reduced-motion, prefers-contrast, prefers-reduced-transparency, prefers-reduced-data, forced-colors, inverted-colors, color-gamut, dynamic-range, video-dynamic-range, pointer, any-pointer, hover, any-hover, display-mode, orientation, scripting and update.

Each shows the first matching value (for color-gamut the widest: rec2020 before p3 before srgb). If the browser doesn't know a feature at all, a "not supported" badge appears; if it knows the feature but none of the tested values matches, it reads "none of the known values". This tab updates live too — when you switch your system to dark mode, for instance.

Locale & time

Language and time settings:

  • Languages (navigator.languages) and Accept-Language (the HTTP header).
  • Formatting locale, Time zone, Calendar and Numbering system (all from Intl).
  • UTC offset now and Local time.
  • Hour cycle — h23/h24 (24-hour) or h11/h12 (12-hour).
  • Number format — the number 1234567.891 formatted your way.
  • Clock offset vs. server — how far your device's clock is off from the server time.

The clock offset is measured with a single NTP-style request: the tool notes the local time before and after the request and compares their midpoint with the server time. The uncertainty is half the round trip. If the offset is within 500 ms (or within the uncertainty, whichever is larger), it reads "in sync (± n ms)"; otherwise something like "2.3 s behind (± 40 ms)" — "behind" means your clock is slow, "ahead" that it's fast.

Capabilities

Three sections about what your browser can do.

User-Agent Client Hints lists the raw values: Brands, Full versions, Platform, Platform version, Mobile, Model, Architecture, Form factors and WoW64. If the browser doesn't release the exact (high-entropy) values, a note says so; without Client Hints (Firefox, Safari) the User-Agent string is all there is.

WebGL / GPU creates an invisible canvas (WebGL 2, falling back to WebGL 1) and reads GPU renderer, GPU vendor, Version, GLSL, Max texture size, Max viewport and the number of Extensions. Renderer and vendor name the actual chip via WEBGL_debug_renderer_info where the browser allows it; otherwise you get the generic values. If WebGL is disabled or blocked, a note appears.

HTML5 & CSS feature detection uses a custom build of Modernizr 3.13.1 that only checks features of the current web platform: removed or never-shipped features (AppCache, Flash, WebSQL, CSS Regions and others) and probes that would need eval or new Function are not included. Results are grouped — CSS, Images, Audio & Video, Canvas & WebGL, SVG & MathML, Forms & Input, Storage & Files, Network, Workers, DOM & Events, Elements, JavaScript and Other — each with a green (supported) or red badge and a "supported / total" counter per group. At the top right the section shows the totals ("N supported", "N not").

Results with sub-values are broken down: for audio and video the codecs with the browser's answer ("probably", "maybe" or "no"), for inputtypes the individual input types, for webp the variants. Some tests run asynchronously, so the section renders twice — immediately and again once those tests have finished (after 4 seconds at the latest). A negative result for blobworkers is re-checked before the second render with a more generous 3-second timeout, because Modernizr's own test wrongly reports "no" on busy devices — in that case the second render comes up to 3 seconds later.

Permissions & storage

Permissions (this site) queries the state of 14 permissions through the Permissions API: Geolocation, Notifications, Push, Camera, Microphone, Clipboard read, Clipboard write, Persistent storage, MIDI, Screen wake lock, Storage access, Local fonts, Window management and Idle detection. Each appears in one of four states: granted (green), asks first (yellow — the normal case: the site has to ask before using it), denied (red) or not supported (gray). Querying alone triggers no permission prompt.

Storage shows whether Cookies are enabled and whether localStorage and sessionStorage are usable (the tool writes and removes a test entry to find out). From navigator.storage come Used by this site, Quota for this site (a browser estimate) and Persistent — whether this site's storage is protected from automatic eviction.

Browser settings:

  • Built-in PDF viewer (navigator.pdfViewerEnabled) — "no (PDFs are downloaded)" if the browser doesn't display PDFs itself.
  • Global Privacy Control — from the Sec-GPC header or navigator.globalPrivacyControl; "on — sites must not sell/share your data" or "off".
  • Do Not Track — the deprecated DNT header, "on" or "off".
  • Automation (navigator.webdriver) — "controlled by automation" if an automation framework is driving the browser, otherwise "not automated".

Battery uses the Battery Status API: Level in percent, Charging and, depending on state, Time to full or Time remaining. The values update when they change. Desktops without a battery report 100 % and "charging"; Firefox and Safari don't expose the API at all, for privacy reasons.

An alphabetical table of every navigator property with a simple value — text, number, boolean or list, e.g. hardwareConcurrency, deviceMemory, languages, platform or userAgent. Functions and nested objects are skipped.

Below it are Plugins and MIME types, each with a count. Current browsers report a fixed list here (the built-in PDF viewer) instead of real plugins, or nothing at all — both protect against fingerprinting. MIME types appear as badges; hover for the description and file extension.

API

This tab lists the plain-text endpoints as ready-made curl commands, each with a copy button. Details in the next section.

Single-value endpoints

For scripts and the command line there are lean endpoints that return one value as plain text (text/plain), terminated by a line break:

  • ?ip — your IP address (REMOTE_ADDR)
  • ?ua (alias ?agent) — the user agent
  • ?accept — the Accept header
  • ?enc — Accept-Encoding
  • ?lang — Accept-Language
  • ?gpc — Sec-GPC (Global Privacy Control)
  • ?dnt — the DNT header (deprecated)
  • ?port — your source port as the web server sees it
  • ?protocol — the protocol between front end and PHP (SERVER_PROTOCOL), not necessarily what your browser used

If a header is missing from the request, the endpoint answers not set. Two endpoints return more than one value:

  • ?headers — every request header, one per line (cookie and authorization values hidden)
  • ?json — all server-side values together as JSON (IP, port, HTTPS, protocol, X-Forwarded-For, the individual headers and the full header list)

Every endpoint works as a query parameter or as a path: https://www.jpkc.com/tools/info/?ip and https://www.jpkc.com/tools/info/ip return the same thing. A parameter with a value (?ip=1), on the other hand, shows the normal page. Responses are never cached (Cache-Control: no-store).

The page itself additionally uses ?host (reverse DNS of your own IP, limited to 20 requests per minute) and ?time (server time in milliseconds as JSON); these two aren't listed in the API tab.

JSON export

At the top of the page, two buttons bundle the entire dataset:

  • Copy as JSON — puts all values on the clipboard as formatted JSON.
  • Export as JSON — downloads the same data as a file named browser-info-<date>.json.

Before exporting, the tool waits until every asynchronous value (Client Hints, hostname, Modernizr tests, permissions, storage, battery, clock offset) has arrived. If you click right after the page loads, that can take a few seconds — mainly because of the Modernizr tests and a slow reverse DNS lookup for the hostname. The tool only collects the Modernizr results and load times once the page has fully loaded; if you export before that, both are missing from the dataset. The dataset covers the server-side values including the header list and everything the browser contributed: summary, Client Hints, hostname, connection, network information, load times, display, media features, locale including clock offset, WebGL, the Modernizr results (with sub-values), permissions, storage, browser settings, battery, navigator properties, plugins and MIME types. The file is generated locally in the browser. The note at the top of the page reminds you that the export contains your IP address and hostname; cookie and authorization values are never included.

Operating limits and privacy

  • Values aren't stored: the page and every endpoint send Cache-Control: no-store, private; nothing the tool displays is kept. Every visit reads fresh. To enforce the hostname lookup limit, the server merely keeps a short-lived counter per IP.
  • The server sees only the usual: the server gets your IP and request headers with every request anyway — Info Tools just reflects them back, minus cookie and authorization values.
  • Client data stays local: browser-side values leave your browser only when you take them out via Copy or Export.
  • Hostname lookups are limited: 20 requests per minute per IP, at most three lookups at a time.
  • API dependency: many sections depend on optional browser APIs (Client Hints, Network Information, Battery, WebGL). If one is missing or blocked for privacy, the section shows a factual note instead of an error.

For the intro and target audiences, see the overview page. Concrete walkthroughs are in the examples, strategy and pitfalls in the tips & tricks. You can try it all directly in the tool.