404 Audit · Attribution risk assessment
Your browser is identifying your organization.
Find out which browser and device signals remain recognizable when your team changes networks, opens a private window, or switches its working environment.
404 scopes the testing, collects hundreds of available browser signals, and compares the resulting fingerprints across agreed environments. Review which tools affect exposure and what your existing privacy controls actually change. Read the audit methodology and collection limits.
Compare what changed with what stayed stable.
Explore the problem
A changed IP is only part of the picture.
Compare a baseline with two common privacy changes. The audit asks which signals actually change in your environment—and which remain repeatable.
| Signal | Baseline | Selected session | Observation |
|---|---|---|---|
| Network exit | Exit A | Exit A | Reference |
| Browsing context | Regular window | Regular window | Reference |
| Browser properties | Profile A | Profile A | Reference |
| Canvas output | Render A | Render A | Reference |
| WebGL traits | Renderer A | Renderer A | Reference |
How to read it
Start with a reference session.
The baseline records the environment your later runs will be compared against.
| Signal | Baseline | Selected session | Observation |
|---|---|---|---|
| Network exit | Exit A | Exit A | Unchanged |
| Browsing context | Regular window | Private window | Changed |
| Browser properties | Profile A | Profile A | Repeated |
| Canvas output | Render A | Render A | Repeated |
| WebGL traits | Renderer A | Renderer A | Repeated |
How to read it
A new window can retain familiar signals.
Private browsing changes the storage context. Some browser properties and rendering outputs may remain repeatable.
| Signal | Baseline | Selected session | Observation |
|---|---|---|---|
| Network exit | Exit A | Exit B | Changed |
| Browsing context | Regular window | Private window | Changed |
| Browser properties | Profile A | Profile A | Repeated |
| Canvas output | Render A | Render A | Repeated |
| WebGL traits | Renderer A | Renderer A | Repeated |
How to read it
The route changes. Other evidence can persist.
A VPN can replace the visible IP without changing the device’s rendering behavior. We measure the actual differences in your agreed runs.
What we measure
Separate observations. One risk assessment.
We compare signals across layers and sessions rather than treating a single fingerprint hash as a verdict.
What the server sees
HTTP headers, Client Hints, and request metadata. We check whether the browser’s claims agree with the environment it presents.
What a page can read
Browser properties, language, timezone, screen, and storage capabilities. We compare the identity exposed in each test session.
What the device produces
Canvas, WebGL, and audio outputs. Repeated rendering traits can provide evidence of a recognizable environment.
What keeps coming back
Stable signals, changed signals, and inconsistencies across the agreed runs. Multiple observations support the risk assessment.
The engagement
From your working environment to an action plan.
We define meaningful comparisons before collecting evidence. Depending on scope, runs may include private browsing, VPN changes, alternate networks, different browsers, or 404-enabled sessions.
- 01
Scope
Agree on the workflows, participants, browsers, devices, and privacy controls to compare.
A defined test plan
- 02
Capture
Your team follows structured instructions and audit links for baseline and changed sessions.
Comparable observations
- 03
Analyze
404 reviews repeated signals, mismatches, and patterns across the tested environments.
Evidence of exposure
- 04
Act
Review the findings and prioritize browser, network, and workflow changes for your team.
Practical next steps
What you receive
Evidence you can use.
Changes you can prioritize.
A report that connects observed exposure to the decisions your team needs to make.
- Executive summary
- The main findings, their significance, and the decisions they support.
- Technical findings
- Compared sessions, repeated signals, inconsistencies, and the limits of the evidence.
- Prioritized recommendations
- Browser, network, and workflow changes matched to the tested environment.
- Optional workshops & training
- Staff briefings and practical guidance can be scoped alongside the assessment. Explore privacy workshops.
404 Audit
Attribution risk
assessment
Illustrative report structure
Example finding · Rendering stability
A changed route. A repeated output.
- Observation
- A rendering output repeats across baseline and changed-network runs.
- Interpretation
- A possible link between sessions; corroborate with independent signals.
- Next action
- Review browser and workflow controls against the tested exposure.
- Limit
- A matching output does not prove identity or population uniqueness.
Who it is for
When repeat recognition carries consequences.
Newsrooms & investigators
Repeated research can reveal an investigation’s direction.
Explore the use caseLegal & civil liberties teams
Research activity can expose a sensitive matter or relationship.
Explore the use caseResearch & OSINT teams
Recurring environments can connect otherwise separate sessions.
Explore the use caseHuman rights organizations
Staff visibility can carry consequences for the people they support.
Explore the use caseBefore you request
A scoped assessment of your exposure.
Results describe the tested sessions and collection conditions. The report distinguishes observed signals from broader attribution claims.
Is this an instant browser test?
No. This is a service engagement: an agreed test plan, structured comparisons, human analysis, and recommendations for your organization.
Do we need to use 404 Desktop?
No. The assessment can compare your existing setup and privacy controls. A 404-enabled run can be included where relevant to the agreed scope.
Will this tell us who is tracking us?
The audit evaluates exposure and potential linkability in the tested environment. It does not reveal every observer, prove that a particular party tracked you, or guarantee anonymity.
What should we include in the request?
Your organization, environment, primary concern, and preferred timing. Keep confidential client information, credentials, source material, and regulated data out of the public form.
Start with your environment
Know what remains recognizable.
Tell us what your team needs to protect. We’ll define the scope and quote before testing begins.
Tell us about your team and the environment you want to assess.