Info Tools — Tips & Tricks

Back to overview: Info Tools · Open the live tool: www.jpkc.com/tools/info/

Info Tools is quick to read — but placing the values correctly takes some know-how. This page collects what matters in practice. The meaning of the individual tabs and fields is in the manual.

Always ask first: server or client?

The tool's most important reading rule: where does the value come from?

The IP address, the port, X-Forwarded-For and everything in the Headers tab are server-side. They are exactly what every web server receives from you. If you want to know "what do websites see about me without asking?", look here.
Everything else is client-side and does not leave your browser — unless you export it yourself. These values show what your device could reveal if a site actively reads them with JavaScript.

Internalize that split and you'll read the page correctly: your GPU or battery level aren't "out on the net" as long as nobody queries them — your IP, by contrast, travels with every request. Client Hints are a gray area: a Chromium browser can send part of them as Sec-CH-UA-* headers — whether yours does shows up in the Headers tab. The exact values such as platform version or device model, however, the tool fetches with a JavaScript call (getHighEntropyValues()), and the browser is free to refuse.

Client Hints beat the User-Agent string

The User-Agent string is frozen and simplified: Windows 11 identifies itself as "Windows NT 10.0", macOS stays stuck at 10.15.7, and an iPad in desktop mode poses as a Mac. The Browser field in At a glance tells you whether the tool built its summary from the Client Hints or from the User-Agent. If it says "User-Agent" (typical for Firefox and Safari), answers like "10 or 11" or "10.15.7 or later" aren't the tool being vague — that's all the browser gives away. For the exact version, open the page once in a Chromium browser on the same device.

Protocol: browser or server?

Info Tools shows two protocol values that often differ. Protocol (browser) comes from the Navigation Timing API and is what your browser actually spoke — HTTP/2 or HTTP/3 (QUIC). Server-side protocol (SERVER_PROTOCOL) is the protocol between the front-end server and PHP and frequently reads HTTP/1.1, even though your connection has long been using HTTP/2. For the question "does my browser speak HTTP/3?", only the first value counts. The same goes for the ?protocol endpoint: it returns the server value.

Empty plugin and MIME lists are a good sign

Don't be surprised if Plugins and MIME types in the Navigator tab show nothing or only the built-in PDF viewer. Modern browsers no longer reveal these lists for privacy reasons, or report a fixed default list, because they used to be a strong fingerprinting trait. So it doesn't mean something is broken — it's a sign that your browser already protects you here.

Assess your own fingerprint realistically

The Navigator, Capabilities (GPU), Display, Media features and Locale & time tabs together form a fingerprinting profile. Rules of thumb:

Unusual values make you more distinguishable. An exotic screen resolution, a rare GPU model, an unusual language setting or a rare time zone lift you out of the crowd.
GPU obfuscation is good. If GPU renderer shows a generic name instead of your specific chip, your browser is already anonymizing.
More standard = less conspicuous. Whoever swims in the pool of default configurations is harder to track than someone with many individual settings.

A concrete walkthrough is in the examples.

Global Privacy Control instead of Do Not Track

Under Browser settings in the Permissions & storage tab you'll find two privacy signals. The tool explicitly flags Do Not Track as deprecated, and it is non-binding — servers may ignore it, and many do. Global Privacy Control (the Sec-GPC header or navigator.globalPrivacyControl) is the newer signal; when it's active, the tool shows "on — sites must not sell/share your data". Both are requests, not technical barriers: real protection comes from browser settings, extensions and avoiding conspicuous traits. From a script you can check the signals with ?gpc and ?dnt.

X-Forwarded-For reveals your proxy path

If X-Forwarded-For in the Connection tab shows anything other than "not set (direct connection)", a proxy or CDN set this header on the way to the server. It may contain your original IP — useful for debugging, but also a hint that a supposedly anonymous connection is forwarding the real address. Check this if you're relying on anonymity.

Hostname "no PTR record" is normal

The tool determines the hostname via reverse DNS of your IP, and only after the page has loaded. Not every IP address has a PTR record — without one it reads "no PTR record", and that's not the tool failing. Lookups are capped at 20 requests per minute; reload the page many times in quick succession and you'll see "rate limited — try again later". Wait a moment and it works again.

Load times come last — and only cover this page

The Page load section in the Connection tab measures only after the page has fully loaded and therefore appears with a short delay. The values refer to this specific load of Info Tools. So the tool isn't meant for analyzing the performance of someone else's site — it shows how the info page itself loaded over your connection. If TCP connect or TLS handshake shows 0 ms or a dash ("— (connection reused)"), your browser usually kept using an existing connection — there was simply nothing to measure for that phase. For TLS handshake, the dash can also mean that no HTTPS was involved at all.

The clock offset is a single measurement

Clock offset vs. server in the Locale & time tab is based on one request. The figure in brackets is the uncertainty — on a slow connection it can run to several hundred milliseconds. That's why the tool reports offsets under half a second as "in sync". Only when it shows seconds or minutes is it worth looking at your system's time synchronization.

Querying permissions triggers no prompt

The Permissions section only reads the current state (granted / asks first / denied / not supported) — it requests no permission. You can inspect it safely without your browser asking for camera or location access. "Asks first" is the normal case and merely means: on real access, the browser would ask.

Exported JSON files contain sensitive values

Export as JSON is comprehensive — it bundles your IP, the reverse-DNS hostname, every request header and detailed device traits too. Cookie and authorization values are left out, but your cookie names are in there. Treat the file accordingly: don't paste it unchecked into public tickets or forums. If you pass it on, consider which fields to strip first — or encrypt the file. The Cryptor (AES-256) is made exactly for that.

Nothing is stored — capture snapshots yourself

Info Tools deliberately keeps none of the displayed values and reads fresh on every visit. If you want to capture a state (e.g. to compare before and after changing a browser setting), save it in time with Copy as JSON or Export as JSON — otherwise the previous findings are gone after a reload. Display and media features do update live, but none of that is kept without an export either.

Combining with other JPKCom tools

IP Tools — when you want to keep working with the IP from the Connection tab, such as its subnet or its other notations.
DNS, SSL, Redirect & URL — to match the reverse-DNS hostname against a domain's DNS records.
Cryptor (AES-256) — to store a JSON export with your IP and device traits encrypted before handing it on.

The full reference is in the manual, concrete walkthroughs in the examples. You can try it all in the tool.