Your data in this workspace.

The generator, “Read my browser”, compatibility lookup, pasted-response inspector and script builder process their inputs in your browser. The application does not upload those inputs, target URLs or pasted headers to a testing service. “Read my browser” and “Read this browser’s high-entropy values” use your browser’s JavaScript API only when you select them, and the results stay in the page. The compatibility snapshot is a local site file; looking up a header does not contact MDN.

Browser negotiation experiments

When you run the negotiation lab, your browser navigates to /api/optin on this site, which responds with an Accept-CH header and returns you to the lab. The reloaded page then sends one request to /api/echo. Depending on browser support, earlier opt-in state and the fields you select, these requests can include browser and platform details, architecture, bitness, device model or full browser versions. The return address contains the names of the hint headers that request 1 carried, not their values. The echo endpoint returns allowlisted UA-CH headers with a timestamp, a random request identifier and the requested hint names. The endpoints do not reflect cookies, authorization credentials or IP address headers, their code does not store or log requests, and their responses are marked Cache-Control: no-store.

Generated commands

This website does not execute the generated cURL or A/B commands for you. If you run them, your computer contacts the target you chose and sends the configured headers, and the A/B script saves responses in a temporary directory on your device. The target’s privacy practices and the files on your device are outside this site’s control.

This website has no user accounts, no registration, no contact form, no newsletter and no comments; its terms of use apply to all visitors. Its own code does not collect names, email addresses, payment details or the contents of what you type into the tools, and does not keep personal data on a server.

This site’s own code sets no cookies and does not use localStorage. The negotiation lab uses sessionStorage in your tab to keep a pending experiment and up to 20 completed reports, so that they survive the lab’s own page reload. They are removed when you select “Clear results” or close the tab, and are never sent to a server. The browser’s origin opt-in for Client Hints remains until another navigation response changes it; the lab’s “Clear origin opt-in” button sends an empty Accept-CH header for that purpose. Cookies and similar storage used for advertising are described in sections 6 and 10.

This website does not include an analytics tracker. The hosting provider may show the operator aggregated traffic statistics (for example request counts by country) derived from its own operational data, as described in section 7.

We update this page when the site’s data handling changes. The date at the top identifies this version.

The workspace page uses Google AdSense, an advertising service provided by Google, to display ads. This privacy notice, the 404 page and the API endpoints do not load advertising code.

• Third-party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this website or other websites.
• Google’s use of advertising cookies enables it and its partners to serve ads to users based on their visits to this site and/or other sites on the Internet.
• When ads are served, Google and its partners may read and set cookies in your browser, and may use web beacons, IP addresses, device and browser information (which can include User-Agent Client Hints) and similar identifiers to deliver, personalise, measure and limit the frequency of ads and to detect fraud and abuse.
• Ads can be personalised or non-personalised. Non-personalised ads do not use your past behaviour for targeting but can still use cookies or identifiers for frequency capping, aggregated reporting and fraud prevention where permitted.

Learn more in How Google uses information from sites or apps that use its services (opens in a new tab), How Google uses cookies in advertising (opens in a new tab) and How Google uses cookies (opens in a new tab). You can manage personalised advertising from Google in My Ad Center (opens in a new tab), and visitors in the United States can opt out of some vendors’ personalised advertising at aboutads.info (opens in a new tab).

This site also publishes an ads.txt file and a Google site-verification meta tag. Neither of them loads code, sets cookies or sends data from your browser. You can delete or block cookies in your browser settings; blocking all cookies can affect how ads and the consent tool work.

The site is hosted on Cloudflare Pages, with Pages Functions for the two lab endpoints. Serving a page, a file or an endpoint response necessarily makes connection information available to the hosting infrastructure, such as IP address, request time, URL and browser information. Cloudflare processes that information to deliver the service, keep it reliable and protect it from abuse, under its applicable terms and the site’s settings. See Cloudflare’s privacy policy (opens in a new tab).

ClientHintsGenerator.com is run by GASO Studio, an independent project of a private individual based in Italy (Abruzzo region), who is the data controller for this website. The postal address is Via San Filipo, snc, 64032, ATRI (TE), Italy, and privacy requests can be sent to privacy@clienthintsgenerator.com. This email address is only for privacy and data protection matters, including questions about this notice; it is not a user support channel. The controller’s full identity is provided on request to people exercising their data protection rights and to supervisory authorities.

Depending on the law that applies to you, you may have rights to access, correct, delete, restrict or object to processing, to data portability, and to withdraw consent at any time (section 10). To exercise them, write to the privacy address given in section 8. We aim to reply within one month, as required by the GDPR. We may ask for proportionate information to verify a request; do not send identity documents unless we ask for them. Emails sent to the privacy address are kept only as long as needed to handle the request and any follow-up.

For data processed by Google for advertising, you can also use Google’s own tools, such as My Ad Center (opens in a new tab) and Google’s data and privacy settings (opens in a new tab). Retention of hosting records and advertising data is set by Cloudflare and Google under their policies and account settings; consent choices are stored by the consent tool in your browser for the period it states.

For visitors in the European Economic Area, the United Kingdom and Switzerland, ads are served with a consent management platform certified by Google and integrated with the IAB Transparency and Consent Framework (TCF), which Google requires for personalised ads in these regions. On your first visit, the consent message lets you accept, reject or manage purposes and vendors before advertising cookies are used where consent is required. Rejecting is as easy as accepting. You can change or withdraw your choice at any time from the privacy settings option of the consent message, when it is available; withdrawing does not affect processing carried out before.

This applies the EU General Data Protection Regulation (GDPR) and ePrivacy rules (in Italy, Article 122 of the Italian Privacy Code), the UK GDPR and the Privacy and Electronic Communications Regulations (PECR), and the Swiss Federal Act on Data Protection (FADP). If you do not consent, Google may show non-personalised or limited ads as described in its documentation. Using the tools on this site never depends on accepting advertising cookies.

• Providing the tools and lab endpoints, and keeping the site secure and reliable: legitimate interests in operating a working and secure service (Article 6(1)(f) GDPR / UK GDPR).
• Advertising cookies and personalised ads: your consent where required by law (Article 6(1)(a) GDPR / UK GDPR, with the ePrivacy rules and PECR), collected by the consent tool in section 10.
• Non-personalised ads, fraud prevention and ad measurement that do not require consent in your region: legitimate interests in funding the free tools through advertising, within the limits set by the consent tool and the law.

Google and Cloudflare can process data outside your country, including in the United States. They describe the safeguards they rely on, such as adequacy decisions (for example the EU–US Data Privacy Framework and its UK and Swiss extensions) or standard contractual clauses, in their own privacy information, for example Google’s data transfer frameworks (opens in a new tab). This notice does not claim that all processing takes place in the European Union.

You have the right to lodge a complaint with a data protection authority, in particular where you live or work or where an alleged infringement took place:

• Italy: Garante per la protezione dei dati personali (opens in a new tab)
• Other EEA countries: your national supervisory authority (opens in a new tab)
• United Kingdom: Information Commissioner’s Office (ICO) (opens in a new tab)
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC) (opens in a new tab)

This website is available worldwide. Visitors from other countries have the rights given by their local law and can use the privacy address given in section 8.

• United States: residents of states with consumer privacy laws (for example California, Colorado, Connecticut, Virginia and others) may have rights to know, access, correct and delete personal information and to opt out of targeted advertising and of the “sale” or “sharing” of personal information. Where offered, the consent tool on the workspace page provides this opt-out (“US state regulations” message); you can also use My Ad Center (opens in a new tab) and aboutads.info (opens in a new tab).
• Canada: you have rights under federal and provincial privacy laws, such as PIPEDA and Quebec’s privacy law, and can complain to the Office of the Privacy Commissioner of Canada (opens in a new tab) or your provincial authority.
• Brazil: you have rights under the LGPD and can complain to the Autoridade Nacional de Proteção de Dados (ANPD) (opens in a new tab).
• Other countries: contact the data protection authority where you live.

This website is not directed at children under 16 and does not knowingly collect their personal information.