No signup · no clicks · already running
This is your digital reflection — what every site you visit learns in the first second. The scan ran the moment you arrived. Nothing was stored.
Exposure score
Scanning your connection…
Every point maps to a named finding — nothing is a black box.
Your IP is read from this request and sent straight back to you — never stored or logged. Everything else is computed inside your browser.
01 · Scan
The mirror: here's your reflection.
Read in your browser, in a second.
02 · Threat
What that reflection enables.
What each finding exposes — in your context.
03 · Proof
Who ignored theirs.
Real case files. One mistake each.
04 · Fix
Synthesis: resize it, free first.
Free steps first. Tools only if you want more.
05 · Return
Re-scan. Watch it shrink.
A clean re-test flips a finding green.
Synthesis — awareness is the upgrade
You can't leave the mirror. You can decide how much of you it shows — free steps first, always.
Your reflection, resized · example
Before
7.4After
2.1Illustration — your own before/after appears once you fix something and re-test.
It happened
Hector Monsegur, "Sabu" of LulzSec, was reported to have been identified after logging into IRC once without Tor — his home IP did the rest. The attacker only needs the one time.
What the other side enables
Without a VPN, your home city and ISP are one lookup away from anyone you interact with — a forum admin, a game lobby, a marketplace seller. A WebRTC leak can undo a VPN you do have.
Firefox: about:config → media.peerconnection.enabled → false. Brave: Settings → Privacy and security → WebRTC IP handling → "Disable non-proxied UDP". Test it →
Quad9 or Mullvad DNS over HTTPS in your browser settings — your ISP stops seeing every site you look up.
Providers worth a look: Mullvad and Proton VPN. Connect, then re-run the scan above — a VPN only counts if the test says so.
Any partner link on this site will be marked and will never come before a free fix. How we make money →
Caught — two identities, one person
Everyone in these files held both halves at once: the persona they curated, and the trail they left. Every file will end with a check you can run on yourself.
Who he thought he was
"Dread Pirate Roberts"
Untouchable admin of an encrypted marketplace. Offshore, anonymous, three steps ahead.
Who the FBI found
Ross Ulbricht · 2013
An early Silk Road promotion posted under the handle "altoid" — a handle tied, years earlier, to his personal Gmail. Arrested in a San Francisco public library.
Who he thought he was
"Sabu", ghost of LulzSec
Hundreds of careful sessions behind Tor. Untraceable by habit.
Who the FBI found
Hector Monsegur · 2011
One IRC login without the mask. Home IP → ISP records → a knock on the door in New York.
Who they thought they were
Tens of thousands of "untouchable" customers
EncroChat: encrypted phones, remote wipe, total trust. OPSEC as a subscription.
What Europol found
Messages read live · 2020
European police read along for months. Outsourced OPSEC is someone else's mirror — you never see what it shows.
Tools
Two-second tests with a plain verdict. Your last result stays on this device — this grid is your personal checklist.
You think: the VPN covers everything.
The mirror: WebRTC can hand out your real IP anyway.
You think: lookups are nobody's business.
The mirror: your ISP answers — and logs — every one.
You think: my inbox is mine.
The mirror: the average address sits in several public dumps.
You think: paid for it, protected by it.
The mirror: pass or fail, per leak vector.
What we see when you scan
Almost nothing.
One request echoes your own IP and location back to you; it is not stored or logged by us. Every other check runs in your browser. No third-party trackers, no accounts, no cookies, no fonts from anyone else's server — open DevTools and count. The full list →
What you see
Everything.
Every parameter, explained in plain language, with the free fix beside it. Revenue: clearly marked partner links, always after the free steps.