Timezone and locale fingerprinting
Your browser carries a regional accent.
A website can read your timezone, language order, calendar, numbering system, hour cycle, and formatting rules without asking permission. When those values disagree with a VPN exit or IP region, the contradiction becomes a signal inside alarger browser profile.
- Permission
- None
- Primary APIs
- Intl · Date · Navigator
- Can narrow region
- Yes
- Precise location
- No
Live regional inspector
See what your browser makes visible.
This demonstration reads the actual regional surface exposed to page JavaScript. It does not request geolocation, look up your IP, transmit the values, or store the result. Choose a hypothetical VPN exit to see how an observer could compare the two contexts.
- IANA timezone
- Waiting to inspect
- Current offset
- —
- Primary locale
- —
- Language order
- —
- Calendar
- —
- Numbering
- —
- Hour cycle
- —
- Date sample
- —
- Number sample
- —
- Currency sample
- —
The page will compare the selected region with the timezone your browser reports.
The comparison is educational and remains local. Real services may infer network region from an IP address and combine it with many more signals.
Anatomy of a regional profile
Timezone and locale describe different parts of the story.
Timezone describes how the clock relates to UTC. Locale describes language and formatting preferences. They often correlate with geography, but neither is a GPS coordinate.
America/DenverTimezone
An IANA zone can describe a region and its daylight-saving rules, not merely one current UTC offset.
UTC−06:00Offset
The current difference from UTC changes seasonally in many zones and is shared by many places.
en-US · es · enLanguage order
Navigator exposes an ordered preference list; requests often carry a related Accept-Language header.
9/20/26 · 2:42 PMFormatting
Date order, separators, month names, and 12- or 24-hour time reveal locale conventions.
gregory · latn · h12Intl defaults
Calendar, numbering system, and hour cycle add structured detail to the regional profile.
The same instant, several outputs
Formatting behavior turns preferences into observable text.
A script does not have to trust one locale string. It can ask the browser to format dates, times, numbers, currencies, lists, and names, then compare the output with the claimed locale.
1,234.561,234.561.234,561,234.56The mismatch is a signal
A VPN can hide the route while the browser keeps its home context.
A routed VPN changes the public IP and apparent network region. It does not automatically change the operating system’s timezone or the browser’s language preferences. The pair can narrow a likely real region, reveal a retained home configuration, or simply show that the profile is inconsistent.
en-US · h12 · gregoryIP region: NetherlandsNL networkDenver timezonedistinctive combination: Dutch exit + Mountain Time browser
The mismatch can expose a probable origin region or prior device configuration behind a VPN. It does not prove where a person is physically located, why the mismatch exists, or whether the user is acting maliciously. Travel, remote desktops, corporate systems, and deliberate privacy protections can produce the same pattern.
A zone is more than an offset
Daylight-saving rules make the identifier richer.
Many places share the same UTC offset today. An IANA timezone also carries a rule set: when clocks change, whether they change at all, and what the offset will be on another date. A collector can format winter and summer dates to distinguish zones that currently look alike.
January · UTC−07July · UTC−06changesJanuary · UTC−07July · UTC−07fixedJanuary · UTC±00July · UTC±00fixedConsistency is the classifier
Ordinary values become stronger when they validate each other.
A timezone is shared by millions of people. So is a language. Fingerprinting systems gain confidence by comparing the relationships between them and the rest of the request.
profile assessmentmostly stable browser context · changed network context
What actually changes the signal?
Changing the network does not rewrite the browser’s regional settings.
The values are reconstructed from browser and operating-system preferences.
Private mode isolates storage but normally inherits the same regional configuration.
That disagreement is often more informative than either signal alone.
The IP region moves while the device may retain its home timezone and language order.
Timezone, preferred languages, calendar, numbering, and hour cycle may inherit different defaults.
Shared timezone and locale answers can place many users in the same regional profile.
Meaningful defenses
A coherent shared profile is safer than random regional noise.
Changing only one value can create an unusual contradiction. Strong anti-fingerprinting designs coordinate timezone, locale, language headers, and formatting behavior so many users return the same internally consistent answers.
Standardize
Shared timezone and locale defaults reduce the number of distinct regional profiles.
Keep layers aligned
Navigator languages, Intl output, Accept-Language, and network claims should not contradict one another accidentally.
Avoid one-off spoofing
A rare or inconsistent combination may be easier to recognize than the real values it replaced.