Evercookie Tracking Demo

The traditional method - small text files stored by the browser. Easy to clear via browser settings.

document.cookie = "tracking_id=abc123; expires=Fri, 31 Dec 9999 23:59:59 GMT";

Stores up to 5-10MB per domain. Persists until explicitly cleared. Often overlooked when clearing "cookies".

localStorage.setItem('tracking_id', 'abc123');
// Survives browser restart, never expires

Similar to localStorage but cleared when the tab closes. Can be used to pass data to respawn other cookies during a session.

sessionStorage.setItem('tracking_id', 'abc123');

A full NoSQL database in the browser. Can store large amounts of structured data. Rarely cleared by users.

const request = indexedDB.open('evercookie_db', 1);
request.onsuccess = (e) => {
  const db = e.target.result;
  // Store tracking ID in database
};

Encodes the cookie value as RGB pixel colors in a PNG image, then force-caches it. The cookie is read back by drawing the cached image to a canvas and reading pixel values.

// Encode "abc" as RGB: R=97, G=98, B=99
ctx.fillStyle = 'rgb(97, 98, 99)';
ctx.fillRect(0, 0, 1, 1);
// Later, read it back from cached image

ETags are meant for cache validation but can store tracking IDs. The server sends a unique ETag, and the browser sends it back on subsequent requests.

// Server response:
HTTP/1.1 200 OK
ETag: "tracking_id_abc123"

// Browser's next request:
If-None-Match: "tracking_id_abc123"

Exploits HSTS (HTTP Strict Transport Security) by encoding bits in subdomain HSTS policies. Each bit is a subdomain that either has HSTS set or not.

// Encoding "5" (binary: 101) across subdomains:
// bit0.tracker.com → HSTS ON  (1)
// bit1.tracker.com → HSTS OFF (0)
// bit2.tracker.com → HSTS ON  (1)
// Reading: check if browser upgrades each subdomain to HTTPS

Stores the tracking ID inside a cached JavaScript or HTML file. When the browser loads the cached version, it contains the ID.

// Server sends with far-future cache headers:
Cache-Control: max-age=31536000
// File contents:
var cached_tracking_id = "abc123";

The window.name property persists across page navigations within the same tab, even to different domains. It can store up to 2MB.

window.name = "tracking_id=abc123";
// Survives navigation to other sites in same tab!

Flash Local Shared Objects stored data outside the browser's control. Required visiting Adobe's website to clear. Flash is now dead, but was very effective.

// ActionScript:
var so:SharedObject = SharedObject.getLocal("evercookie");
so.data.tracking_id = "abc123";
so.flush();

Microsoft's Silverlight plugin had its own storage mechanism, separate from browser storage. Silverlight is now discontinued.

Encoded data in browser history by visiting URLs with the ID in them. Could read back by checking link :visited styles. Browsers have patched this.

// Create history entries:
location = "http://tracker.com/id/a";
location = "http://tracker.com/id/b";
// Read via CSS :visited (now blocked)