This page explains how the site works so you can judge how far to trust a result. Each tool page has a short summary of the same information; the lists below are generated from those summaries so they stay consistent.
The privacy score
The score is a heuristic of observed exposure under the conditions of one test. A higher score means less exposure was observed. It is not a probability of being tracked, not a security audit, and not a measure of anonymity.
- Full scan: five categories with fixed weights: network exposure (38), WebRTC (15), DNS (15), browser fingerprint (20) and tracking signals (12). The weights are design choices by the site author. They are not calibrated against real tracking or compromise data.
- Not tested is not clean: each check ends as tested, inconclusive, not tested or failed. A check that did not run is left out and the score is scaled to what was measured. A scan with fewer than four of five checks cannot reach the top level and is labelled a partial scan.
- Findings: each category shows its own result as "Exposure found", "Not detected" or "No verdict", with a confidence level and the basis for it, so you can see why the number is what it is.
- Quick score on the home page: uses the connection only: a visible IP, city-level location, identifiable provider and readable device details, with smaller deductions when the network looks like a VPN.
- Not measured: cookies and logins, malware, account security, and what individual sites do with your data.
VPN detection
We infer a VPN or hosted network from the name of the network that owns your address, plus (in the VPN check) time zone and WebRTC comparisons. This can be wrong in both directions: a VPN on a residential-looking address will not be detected, and a company or university network on a cloud provider may look like a VPN. Results carry a confidence level (low or medium, never high) and the basis, and signals that could not be tested say "Not tested".
What each tool tests
Privacy and leak tests
Browser Fingerprint Test
Last reviewed 2026-10-26
We test
- Standard browser properties: user agent, languages, time zone, screen, hardware, fonts, canvas and graphics rendering
- Whether your browser randomises or hides some of them
We do not test
- Real-world uniqueness: bit values are rough published estimates, not measurements of live visitors
- Cookies, logins or tracking by specific sites
What we store
- Nothing: computed on your device and never uploaded
Third parties: None. This test makes no third-party requests.
DNS Leak Test
Last reviewed 2026-10-26
We test
- Which DNS resolvers contact our test server when your browser looks up unique hostnames
- Whether those resolvers belong to your own network, a public DNS provider or somewhere else
We do not test
- Whether your DNS is encrypted in transit
- Leaks from apps that use their own DNS outside the browser
- What the resolver does with the lookups it receives
What we store
- Resolver addresses seen by our DNS server, tied to a random test code, for ten minutes, then deleted
- Your own IP address is not stored with them
Third parties: Our own DNS test server sees your resolver's address. Geolocation providers receive resolver addresses to identify their networks.
HTTP Headers Viewer
Last reviewed 2026-10-26
We test
- The request headers your browser sent to our server for this one request
We do not test
- Cookies and authorisation headers, which are hidden deliberately
- What other websites receive: that depends on the site, your settings and extensions
What we store
- Nothing is written to a log or database
Third parties: None beyond our hosting provider, which carries the request and may keep its own connection records.
Open Port Checker
Last reviewed 2026-10-26
We test
- Whether 24 common TCP ports on your own public IP accept a connection from our server
We do not test
- UDP ports or uncommon ports
- Individual devices behind your router, or addresses shared through CGNAT
- Whether a service that is open has vulnerabilities
What we store
- Nothing: the result is returned to you and not stored
- Short-lived in-memory limit counters per network (a few scans per half hour)
Third parties: None. Our server connects to your public IP and no other address.
Full Privacy Scan
Last reviewed 2026-10-26
We test
- What your connection reveals: IP, approximate location, provider and visible device details
- Whether your browser reveals an extra address through WebRTC
- Which DNS servers answer your lookups
- How identifying your browser fingerprint is (an estimate)
- Whether Global Privacy Control and Do Not Track are on
We do not test
- Malware, passwords, accounts or anything inside your device
- Cookies, logins or what individual websites do with your data
- Whether you are anonymous: a high score means little exposure was observed by these tests, nothing more
What we store
- Nothing: results are computed in your browser and are not uploaded or saved
- The DNS part keeps resolver addresses for ten minutes against a random code, not your IP
Third parties: ipify (your browser) sees your IP; geolocation providers receive it to return location data; a STUN server (Google by default) sees your address during the WebRTC part; our own DNS test server sees your resolver's address.
User Agent Checker
Last reviewed 2026-10-26
We test
- Your user agent string and what can be parsed from it
- Client Hints and other properties JavaScript can read about your browser
We do not test
- Whether your user agent is spoofed or modified by an extension
- What individual websites do with these details
What we store
- Nothing: the details are shown in your browser and not uploaded
Third parties: None. This test makes no third-party requests.
Am I Using a VPN?
Last reviewed 2026-10-26
We test
- Whether the network name matches VPN, proxy or hosting patterns
- Whether the network number is on a short list of hosting and VPN networks
- Whether your browser time zone matches your IP location
- Whether WebRTC reveals a different public IP
We do not test
- A VPN on a residential-looking address, which this cannot detect
- Whether your VPN leaks DNS or WebRTC (use those tests)
- Anything with certainty: companies, universities and some ISPs can look like VPNs
What we store
- Nothing is written to a log or database
- Short-lived in-memory request counters per network to block abuse
Third parties: Geolocation providers receive your IP to return network data; a STUN server (Google by default) sees your address during the WebRTC part.
WebRTC Leak Test
Last reviewed 2026-10-26
We test
- The addresses your browser reveals through WebRTC
- Whether any public address differs from the one websites see for your connection
We do not test
- Other kinds of leak: this tests WebRTC only
- Leaks from apps outside the browser
What we store
- Nothing: the comparison happens in your browser
Third parties: A STUN server (Google's by default) is contacted by your browser and sees the address your browser connects from. ipify and our own server provide the address websites see.
Online safety assistant
Browser Security Guide
Last reviewed 2026-10-29
We test
- Nothing: this is an instruction guide, not a scanner. It does not read your browser settings
We do not test
- Your actual settings: it cannot see which options you have switched on
- Menu names in every browser version: browsers rename items, so each step also gives an address-bar shortcut where one exists
- Malware already on your device
What we store
- Nothing: your browser choice is read from your own browser to pre-select a tab and is never sent to us
Third parties: None. This page makes no third-party requests.
Mobile App Safety Check
Last reviewed 2026-10-29
We test
- Whether each permission you tick is normal for the kind of app you chose, using a built-in table of typical needs
- Extra risk when an app was installed outside the official store or came from a message
We do not test
- The app itself: we cannot scan, download or inspect an app, so this cannot detect malware
- Permissions you do not tell us about: it only reviews what you tick
- Whether the publisher is honest: check the developer name and reviews in the official store
What we store
- Nothing: your choices are analysed in your browser and never sent to us
Third parties: None. This tool makes no network request with your choices.
Scam and Phishing Message Checker
Last reviewed 2026-10-29
We test
- Common scam patterns in the text you paste: urgency, threats, impersonation of banks, couriers and authorities, requests for one-time codes, passwords or payment, gift-card and crypto demands, remote-access requests, prizes and easy-money bait
- Any links in the message, using the same checks as the suspicious link checker
- The things you noticed that text cannot show, such as an unexpected sender
We do not test
- Who really sent the message: we cannot see headers, numbers or addresses
- Attachments, images or voice notes
- Whether a message is genuine: a message with no signs found can still be a scam, and a real one can trip a rule
What we store
- Nothing: the message and your ticks are analysed in your browser and never sent to us
Third parties: None. This tool makes no network request with your message.
Personal Security Checkup
Last reviewed 2026-10-29
We test
- Your own answers about passwords, two-step verification, updates, device locks, backups, app sources, browser habits, scams and networks, turned into a prioritised list of actions
We do not test
- Your real accounts or devices: we cannot see them, so the plan is only as accurate as your answers
- Whether you have already been compromised
- A security rating: the count of habits in place is not a score
What we store
- Nothing: your answers are processed in your browser and never sent to us or saved
Third parties: None. This tool makes no network request with your answers.
Suspicious Link Checker
Last reviewed 2026-10-29
We test
- Visible warning signs in the text of the address: look-alike or mistyped brand names, misleading subdomains, a hidden destination after an @ sign, raw IP addresses, mixed alphabets, link shorteners, risky file downloads and redirect parameters
- How you reached the link and what you are about to do, because the same link is riskier when it arrived in a message and asks you to sign in
We do not test
- Whether the page is actually malicious: we do not open the link or check blocklists
- Whether a clean-looking address is safe: a clean result is not a safety guarantee
- The content of the page, the sender or the message around the link
What we store
- Nothing: the link and your answers are analysed in your browser and never sent to us
Third parties: None. This tool makes no network request with your link.
Website Safety Checker
Last reviewed 2026-10-28
We test
- Whether the site uses HTTPS and whether its certificate is trusted and how long it has left
- Whether plain HTTP redirects to HTTPS and where redirects lead
- Security headers: HSTS, Content-Security-Policy, nosniff, clickjacking protection, referrer policy
- Domain age from the public registry record
We do not test
- Malware or phishing blocklists: a clean result is not a safety guarantee
- The content of the pages or whether the business is honest
- Anything on private or internal addresses, which are refused
What we store
- The address you enter is used for the check and not written to a log or database
- Short-lived in-memory request counters per network to block abuse
Third parties: The site you enter is contacted from our server, so it sees our server's address, not yours. Domain age comes from the public RDAP registry; names are resolved by public DNS resolvers.
IP and network lookups
DNS Lookup
Last reviewed 2026-10-28
We test
- The A, AAAA, MX, NS, TXT, CNAME and related records public resolvers return for a domain
We do not test
- Records only visible inside a private network
- Whether the domain or the services behind it are trustworthy
What we store
- Nothing you type is written to a log or database
- Short-lived in-memory request counters per network to block abuse
Third parties: Public DNS resolvers (1.1.1.1, 8.8.8.8) receive the domain you type and see our server, not you.
IP Lookup
Last reviewed 2026-10-28
We test
- Approximate location and network owner for the IP address or domain you enter, taken from third-party geolocation databases
- The registry (RDAP) record for the address
- The reverse DNS name, if one is published
We do not test
- Who is actually using the address: it identifies a network, not a person
- Street-level location: results are usually accurate to a city or region at best
- Whether the address is malicious or safe
What we store
- Nothing you type is written to a log or database
- Results are cached in server memory for about an hour to limit third-party calls
- Short-lived in-memory request counters per network (minutes to hours) to block abuse
Third parties: Geolocation providers (ipwho.is, ipapi.co) receive the IP being looked up. Registries and public DNS resolvers (1.1.1.1, 8.8.8.8) receive the address or domain you type and see our server, not you.
My IP Location
Last reviewed 2026-10-28
We test
- The public IP address your connection uses
- The city, region and country that geolocation databases associate with it
- The network provider listed for it
We do not test
- Your real street address: IP location is an estimate of where your provider routes traffic
- Whether a VPN, proxy or shared address is involved (see the VPN check for that)
What we store
- Nothing is written to a log or database
- Geolocation results are cached in server memory for about an hour
- Short-lived in-memory request counters per network to block abuse
Third parties: ipify (api4.ipify.org and api6.ipify.org) is called by your browser to find your IPv4 and IPv6 address, so it sees your IP. Geolocation providers (ipwho.is, ipapi.co) receive your IP to return location data.
Reverse DNS Lookup
Last reviewed 2026-10-28
We test
- The PTR (reverse DNS) record published for the IP address you enter
We do not test
- Whether the hostname is accurate: whoever controls the address block sets it
- Anything about private or reserved addresses, which have no public record
What we store
- Nothing you type is written to a log or database
- Short-lived in-memory request counters per network to block abuse
Third parties: Public DNS resolvers (1.1.1.1, 8.8.8.8) receive the address you type and see our server, not you.
What Is My IPv6 Address?
Last reviewed 2026-10-28
We test
- Whether your connection has a public IPv6 address and what it is
- The network that address belongs to
We do not test
- Whether your VPN covers IPv6 (use the DNS and WebRTC tests, and the IPv6 leak guide)
- Whether IPv6 is enabled on every device in your home
What we store
- Nothing is written to a log or database
- Short-lived in-memory request counters per network to block abuse
Third parties: ipify (api6.ipify.org) is called by your browser and sees your IPv6 address, if you have one. Registries receive the address for the registry lookup and see our server.
What Is My Public IP?
Last reviewed 2026-10-28
We test
- The public IP address websites see when you connect
- Whether your connection also has an IPv6 address
- The reverse DNS name and network owner of your address
We do not test
- Your private address inside your home network: browsers do not reveal it to this page
- Whether your address is shared with other customers (CGNAT) with certainty
What we store
- Nothing is written to a log or database
- Short-lived in-memory request counters per network to block abuse
Third parties: ipify (api4.ipify.org and api6.ipify.org) is called by your browser and sees your IP. Public DNS resolvers receive the address for the reverse lookup and see our server, not you.
Third parties
IP geolocation and network ownership come from third-party databases and are approximate. The DNS test uses our own DNS server; the WebRTC test contacts a public STUN server. Where a tool uses a third party it says so in its summary above. Affiliate links (for example VPN recommendations) are labelled as sponsored and do not change test results. We do not show sponsored recommendations on scam, phishing, account or app safety pages.
Recommendations and affiliate links
Recommendations follow a result, not a payout. Free and built-in options are always listed first, a list never contains only affiliate items, and an affiliate item is labelled in the page. Scam, phishing, safe-browsing and mobile-safety pages show no affiliate links. Full rules and the current list are on the recommended tools page. Affiliate clicks are counted by tool name only, with no IP address or other identifier.
What we store
We do not log visitor IP addresses. The privacy policy lists exactly what is and is not kept. To understand which tools people finish and which fixes they follow, we count a few anonymous events (a tool completed, a result category, a next-step click). They contain no IP address, no user agent, no referrer, no address, message or answer you typed, and are not sent at all if your browser sends Global Privacy Control or Do Not Track.
Guides and review
Guides are written by the ScanMyPrivacy team and show an updated date. A named reviewer is shown only where a qualified person has actually reviewed a guide. Browser menu steps change between versions, so each guide shows the date it was last checked.
Corrections
If a result or guide is wrong, email contact@scanmyprivacy.com with the page and what you saw. We check each report, fix confirmed errors and update the page's date. Wrong IP locations usually come from the geolocation database; the guide on wrong IP locations explains how to request a fix.
Published statistics
Aggregate totals of test outcomes, such as the share of completed WebRTC tests that found a leak, are published on the statistics page with their method and limits. They describe tests on this site, not all internet users.