Nullecho collects nothing about you — no telemetry, no account, no analytics. Which means we genuinely cannot tell you whether it's working. So instead, it measures itself on your machine, where we can't see the result.
No cookies needed. No login. This survives incognito and clearing your history.
| What they read | What your browser told them |
|---|
The naive fix is to randomize everything. That's worse than nothing — randomize each value independently and you produce a machine that doesn't exist (a Windows browser with an Apple GPU and 3 CPU cores). That isn't anonymous, it's flagged as evasive, which is a smaller and more suspicious crowd than just being yourself.
Each site sees a different — but internally coherent — real-world configuration that millions of people actually run.
Nothing flickers between page loads, so nothing breaks and you don't stand out.
Site A and Site B see different machines, so a tracker that hashes the signals we cover can't connect one visit to the other — verified against FingerprintJS and ClientJS. A tracker that detects spoofed values, discards them and keys on what's left still can; CreepJS does exactly that.
A privacy tool that oversells is worse than none — you make real decisions based on what it implies.
It's open source, and the docs include our own threat model, the limitations above, and the decisions we got wrong and corrected.
github.com/ZJHeepfixer/nullecho — try to break it. If you find a fingerprinting method we miss or a way to detect us we haven't documented, that's a security bug and we want the issue.