Cookies and sessions
JavaScript-readable cookies, server-visible cookie metadata, tokens and session-like identifiers.
SEE WHAT YOUR BROWSER REMEMBERS ABOUT YOU
Browser Memory / Mémoire du navigateur
See what a website can learn from your browser
AIExperimental AI project by GuruLabs
This scanner analyzes real data available to this origin: cookies, Web Storage, IndexedDB, Cache Storage, origin-private files, URL state, server-visible IP/request data, and browser/device fingerprinting signals. JWT, JSON and Base64 values are decoded locally.
What “exposed” means here
A finding means the value or signal is accessible to scripts running on this website/origin, or is visible to the web server during a normal request. It does not mean the data is public on the Internet. Browsers normally prevent this site from reading Facebook, Google, banking, or other unrelated sites’ private storage.
GURULABS × AI
A GuruLabs AI project about practical web privacy
Browser Memory / Mémoire du navigateur is a free lab built by GuruLabs with AI assistance to make browser storage, tracking and fingerprinting risks easier to understand. It is educational and does not replace a professional security assessment.
Sensitive storage values are analyzed in your browser. Google Analytics loads only after consent and never receives the raw contents found by the scanner.
BROWSER PRIVACY / CONFIDENTIALITÉ
What the browser privacy scanner checks
The audit combines same-origin storage surfaces, information visible to the web server, and browser signals that are normally exposed without requesting a sensitive permission.
Local and offline storage
localStorage, sessionStorage, IndexedDB, Cache Storage, OPFS, service workers and URL state.
Network and IP address
Network address seen by PHP, HTTP headers, language, Client Hints and other information from a normal web request.
Browser fingerprint surface
Screen, device, GPU/WebGL, canvas, audio, timezone, capabilities, network and other signals that can be combined.
Structured stored data
Local decoding of JWT, JSON, Base64 and nested fields so technical values become understandable to the user.
Security boundaries
The report also explains what a website cannot directly read: unrelated-origin storage, saved passwords and arbitrary local files.
—/100
Run the scan to calculate a risk score.
Exposed & sensitive data
Real values discovered in browser-readable storage. Open any finding to see the complete value, decoded information, potential impact, and safer design guidance.
No scan yet.
Storage inventory & scan coverage
Cookies, localStorage, sessionStorage, IndexedDB, Cache Storage, OPFS, service workers, push subscriptions and storage limits for this origin.
No scan yet.
Network, browser & fingerprinting exposure
Public/network address visible to PHP, request headers, browser/device signals, GPU/canvas/audio fingerprint surfaces, performance metadata and third-party requests.
No scan yet.
Permission states
Checks status only. The scanner does not ask for camera, microphone, precise location, clipboard or notification permission.
No scan yet.
What this website cannot directly read
Browser security boundaries around other sites’ cookies/storage, password managers, payment vaults, arbitrary files and permission-gated APIs.
No scan yet.
SECURITY / SÉCURITÉ
Why stored browser data can become dangerous
Browser storage is useful, but JavaScript-readable data shares the security boundary of the page. If the origin runs malicious code—through XSS, a compromised third-party script, or another supply-chain failure—readable data may become available to that code. Long-lived storage can also remain on shared or stolen devices.
Session and account takeover
A reusable access token or session credential may let an attacker act as the signed-in user until it expires or is revoked. Authentication secrets deserve the strongest protection.
Identity and privacy exposure
Names, email addresses, phone numbers, addresses, health information or government identifiers can support phishing, impersonation, profiling or identity fraud when exposed.
Long-lived tracking
Persistent identifiers, IP addresses, device characteristics and fingerprinting signals can be combined to correlate visits or recognize a browser over time.
Cached/offline data survives
IndexedDB, Cache Storage, localStorage and OPFS can outlive a session. Sensitive API responses or profile data may remain after logout unless the application explicitly clears or expires them.
URLs spread further
Secrets placed in query strings or fragments can be copied, screenshotted, stored in history, logged by servers/analytics, or exposed through referrer behavior depending on policy.
Third-party scripts share page access
A script legitimately loaded into a page normally executes with that page’s JavaScript privileges. Keeping sensitive data out of JavaScript-readable storage reduces the impact of a compromised dependency.
Examples: data type → realistic impact → safer practice
| Data / signal | What could happen if exposed | Safer practice |
|---|---|---|
| Access/session token | Session replay or account actions as the user, depending on token scope and validity. | Prefer short-lived, revocable sessions; when appropriate use Secure + HttpOnly + SameSite cookies and strong XSS defenses. |
| Password / private secret | Credential theft, account compromise, API abuse or downstream compromise. | Do not persist passwords/private secrets in browser-readable storage. Keep server secrets server-side. |
| Personal / health / government data | Phishing, profiling, embarrassment, discrimination risk, impersonation or identity fraud. | Minimize collection, avoid unnecessary persistence, encrypt server-side where appropriate, and expire/clear client copies. |
| Cached API/profile response | Data may remain after the user leaves or logs out and can be read by later same-origin scripts. | Avoid caching sensitive responses unnecessarily; clear offline stores on logout and apply suitable cache controls. |
| IP + fingerprint signals | Correlation and probabilistic recognition across sessions when combined with other signals. | Collect only what is needed, reduce third-party scripts, respect privacy signals, and avoid unnecessary fingerprinting. |
FAQ
Browser Memory privacy scanner FAQ
Can this website read my Facebook or banking cookies?
No. The browser same-origin policy normally prevents one website from reading another domain’s private cookies and browser storage.
Why can localStorage be risky?
localStorage is readable by JavaScript running on the same origin. A successful XSS injection or compromised third-party script can therefore sometimes access values persisted there.
Is my IP address visible to a website?
Yes. A web request must reach a server or reverse proxy, which sees a source network address. The report separates server-visible request information from browser-stored information.
Does the scanner send my cookies or tokens to GuruLabs?
No. Browser-storage value analysis happens locally. The PHP endpoints return normal request information and cookie metadata, not raw HttpOnly cookie values.
Severity guide
Critical
Authentication tokens, passwords, secrets, payment-like data or high-impact identifiers readable by page scripts.
High
Direct personal data, account identifiers, sensitive profile information or security-relevant state.
Medium
Tracking IDs, IP/fingerprint signals, persistent state, URL leakage or other privacy-enhancing data points.
Info
Decoded metadata and browser protections that explain the exposure boundary.