The 2026 Encyclopedia of Browser Privacy & Web Security

Browser privacy and web security have become inseparable from everyday browsing. Every site you visit collects data through mechanisms most users never see — from canvas fingerprinting that tracks you without cookies, to password entropy calculations that determine whether your accounts survive a brute-force attack.

This encyclopedia defines the technical terms that matter in 2026. Each entry includes a precise technical definition and a plain-English explanation so you can understand what the term means and why it matters for your privacy.

Key Takeaways

• Browser fingerprinting (canvas, WebGL, AudioContext) can identify you without cookies — and most browsers still don't block it by default
• Password entropy is measured in bits; anything under 60 bits is crackable in under a minute with modern hardware
• Client-side encryption means your data is encrypted before it reaches the server — the provider literally cannot read it
• IndexedDB quotas let sites store up to 80% of your disk space, and most browsers have no hard cap
• Understanding these terms is the first step to actually protecting yourself online

---

Authentication & Password Security

Password Entropy

Technical definition: Password entropy measures the unpredictability of a password in bits, calculated as log2(R^L) where R is the size of the character pool and L is the password length. A password drawn from a pool of 94 printable ASCII characters with length 12 yields approximately 78.8 bits of entropy.

Layman's terms: Entropy is how "guessable" your password is. A password with 80 bits of entropy would take a computer roughly 10^24 guesses to crack — longer than the age of the universe at a billion guesses per second. A password with 40 bits? About 15 minutes. The higher the entropy number, the stronger your password.

Want to see how entropy plays out in practice? Our Password Generator creates random passwords and shows you the entropy in bits so you can see exactly how strong a 16-character random string really is.

Brute-Force Attack

Technical definition: A brute-force attack systematically tries every possible combination of characters until the correct password is found. The time complexity is O(R^L), where R is the character set size and L is the password length. Modern GPU clusters can test 100 billion hashes per second for MD5, or roughly 10 billion per second for bcrypt.

Layman's terms: A brute-force attack is when a computer tries every possible password — "aaa," "aab," "aac," all the way to "zzz" — until it finds the right one. It's like trying every key on a massive keyring. The longer and more complex your password, the more keys the attacker has to try.

Rainbow Table Attack

Technical definition: A rainbow table is a precomputed lookup table that maps hash values to their corresponding plaintext passwords. Rather than computing hashes in real time, an attacker looks up a stolen password hash in the table and retrieves the original password. Rainbow tables work against unsalted hashes — those generated without a random value mixed in.

Layman's terms: Instead of guessing passwords one by one, a rainbow table is like a cheat sheet that already has the answers. If a website stores passwords without "salting" them (mixing in random data), an attacker can look up the stolen hash in this cheat sheet and instantly get your password. This is why salting is essential.

You can see how different hashing algorithms compare using our Hash Generator — it produces MD5, SHA-1, SHA-256, and SHA-512 hashes from any input, so you can observe how the same password produces different outputs across algorithms.

Salt (Cryptographic)

Technical definition: A salt is a unique, randomly generated value concatenated with a password before hashing. Each user gets a separate salt, stored alongside the hash. Salts ensure that identical passwords produce different hashes, rendering rainbow tables ineffective. Modern standards recommend at least 16 bytes of cryptographically random salt.

Layman's terms: A salt is like adding a unique secret ingredient to each password before scrambling it. Even if two people use the password "password123," different salts mean their stored hashes look completely different. An attacker's cheat sheet (rainbow table) becomes useless because it would need a separate table for every possible salt.

Generating cryptographically secure random values for salts is critical — our UUID Generator produces v4 UUIDs, which are 128-bit random identifiers suitable for salts, nonces, and other security-critical random values.

Argon2

Technical definition: Argon2 is the winner of the Password Hashing Competition (2015) and the current recommended password hashing algorithm. It is memory-hard, meaning it requires significant RAM to compute, making GPU and ASIC attacks expensive. Variants include Argon2d (data-dependent memory access, better for disk encryption), Argon2i (data-independent, better for password hashing), and Argon2id (hybrid). OWASP recommends Argon2id with a minimum of 19 MiB memory, 2 iterations, and 1 parallelism.

Layman's terms: Argon2 is the strongest available way to scramble a password for storage. Unlike older methods that a fast computer can brute-force, Argon2 deliberately eats up memory and processing time so that even a powerful attacker is slowed to a crawl. It's the gold standard for password storage in 2026.

bcrypt

Technical definition: bcrypt is a password hashing function based on the Blowfish cipher. It incorporates a work factor (cost parameter) that determines how many iterations of the underlying hash are performed. The default cost factor of 10 yields roughly 100 milliseconds per hash on consumer hardware. Each increase in cost factor doubles the computation time.

Layman's terms: bcrypt scrambles passwords using a method that gets deliberately slower as you increase a setting called the "cost factor." This means you can make it progressively harder for attackers to guess passwords, even as computers get faster. It's been the go-to password storage method for years, though Argon2 is now preferred for new systems.

To see how different hash algorithms transform the same input, try our Hash Generator — it computes MD5, SHA-1, SHA-256, and SHA-512 instantly, letting you compare how each algorithm produces a completely different output from identical input.

Pepper (Cryptographic)

Technical definition: A pepper is a secret value applied to passwords before hashing, stored separately from the database (e.g., in an environment variable or hardware security module). Unlike a salt, the pepper is the same for all users and is never stored alongside the hash. If the database is stolen but the pepper is not, the hashes remain unintelligible.

Layman's terms: A pepper is like a master password that's applied to everyone's password before it gets scrambled. It's kept in a completely different location from the database. So even if a thief steals the entire password database, they still can't crack any passwords because they don't have the pepper.

zxcvbn

Technical definition: zxcvbn is a password strength estimator developed by Dropbox. Rather than checking against arbitrary rules, it uses pattern matching against dictionaries, common names, keyboard patterns, and known breach databases to estimate the number of guesses required to crack a password. It returns an entropy estimate and a crack-time display.

Layman's terms: zxcvbn is a smart password checker that doesn't just count uppercase letters and numbers. It actually checks your password against lists of common passwords, keyboard patterns like "qwerty," and names. It then tells you how long it would take to crack — giving you a realistic security score instead of a meaningless "weak/medium/strong" label.

This is why our Password Generator creates truly random passwords — it bypasses dictionary patterns entirely, producing strings that zxcvbn and real-world attackers both struggle with.

---

Tracking & Fingerprinting

Canvas Fingerprinting

Technical definition: Canvas fingerprinting exploits differences in how browsers, GPUs, and font renderers draw 2D graphics. A site instructs the browser to render text (often with emoji and specific fonts) and geometric shapes onto an HTML5 <canvas> element, then calls canvas.toDataURL() to extract a pixel-level hash. Subtle rendering differences across hardware and software configurations produce a unique fingerprint for each user. The technique works even in private browsing mode.

Layman's terms: A website asks your browser to draw a hidden picture — text, shapes, colors — and then reads back the exact pixels. Because every computer renders images slightly differently (different graphics cards, fonts, anti-aliasing), the resulting picture acts like a fingerprint. It can identify you across websites even if you delete all your cookies.

This is separate from image metadata — if you're concerned about photos leaking EXIF data (GPS coordinates, camera model, timestamps), use our Metadata Stripper to strip that information before sharing images online.

WebGL Fingerprinting

Technical definition: WebGL fingerprinting collects information about the user's graphics hardware and driver through the WebGL API. Sites query WEBGL_debug_renderer_info for the vendor and renderer strings, enumerate supported extensions, test rendering precision, and measure performance benchmarks. The combination of GPU model, driver version, and extension support creates a highly identifying fingerprint.

Layman's terms: Similar to canvas fingerprinting, but instead of drawing 2D pictures, this technique queries your graphics card directly. It learns what GPU you have, what drivers you're running, and what features your hardware supports. This combination is surprisingly unique — most people share their fingerprint with fewer than 1% of other users.

AudioContext Fingerprinting

Technical definition: AudioContext fingerprinting exploits variations in audio processing pipelines across devices. A site generates an audio signal, processes it through an OscillatorNode and AnalyserNode, and hashes the resulting floating-point samples. Differences in audio hardware, drivers, and OS-level processing produce a device-specific output. This method works in all major browsers and is resistant to private browsing and cookie deletion.

Layman's terms: Your browser processes a sound file in a slightly unique way because of your audio hardware and software. A website can play this hidden sound, analyze the result, and use the tiny differences as a fingerprint. Even though you never hear the sound, it identifies you as surely as a canvas drawing would.

Font Enumeration

Technical definition: Font enumeration identifies which typefaces are installed on a user's system. The classic technique measures the rendered width of text in various fonts using a probe element; fonts that exist on the system produce different widths than the fallback. Modern approaches use document.fonts.check() or measure text metrics against known baselines. The set of installed fonts varies significantly across users, making it a strong fingerprinting signal.

Layman's terms: Your computer has a specific set of fonts installed, and a website can figure out which ones they are just by measuring how text looks on screen. The combination of fonts on your machine is like a signature — most people have a different mix, so a website can tell you apart from other visitors.

Audio Fingerprint

Technical definition: An audio fingerprint is a compact identifier derived from the audio processing chain of a device. It captures how the browser's Web Audio API converts mathematical operations into audible signals, affected by the operating system's audio stack, hardware DAC, and driver-level processing. Two identical browsers on different hardware produce different audio fingerprints.

Layman's terms: When your browser processes sound, it does so through layers of hardware and software that are unique to your device. A website can extract this unique "audio signature" and use it to identify your specific device, even across different browsers or after clearing cookies.

###ClientRects Fingerprinting

Technical definition: ClientRects fingerprinting collects the bounding rectangles returned by Element.getBoundingClientRect() and Element.getClientRects() for specific DOM elements. These measurements include sub-pixel precision and are affected by operating system DPI scaling, browser window size, font rendering, and zoom level. The combination produces a fingerprint that is persistent across sessions.

Layman's terms: A website measures exactly where and how large elements appear on your screen, down to tiny fractions of a pixel. These measurements vary because of your screen resolution, zoom level, and operating system settings, creating yet another way to identify your device.

Harris Corner Detection Fingerprinting

Technical definition: This technique uses the Harris corner detection algorithm (typically via a canvas) to identify feature points in rendered content. The algorithm detects corners and edges in the rendered pixels, and the distribution of these points varies by GPU, driver, and anti-aliasing settings. The result is a stable fingerprint resistant to common perturbations.

Layman's terms: A website renders a complex image and then uses a math algorithm to find "corner" points in the picture. The exact locations of these points depend on your graphics hardware, giving websites another way to track you that's hard to fake or block.

Font Fingerprint Resistance

Technical definition: Font fingerprint resistance refers to browser-level mitigations that limit or randomize the information available about installed fonts. Firefox's privacy.resistFingerprinting flag limits the fonts exposed to web content, returning a standardized set instead of the full system font list. Chrome's "Font Access" API provides opt-in access with user consent.

Layman's terms: Some browsers let you hide the list of fonts installed on your computer from websites. Firefox has a setting called "resist fingerprinting" that shows websites a fake, standardized font list instead of your real one. This makes it harder for sites to identify you based on your fonts.

---

Browser Storage & Data

IndexedDB

Technical definition: IndexedDB is a low-level browser API for storing structured data client-side. It supports large volumes of data (limited only by disk space, with browsers typically allowing up to 80% of available space), indexed queries, transactions, and versioned schemas. Unlike cookies or localStorage, IndexedDB can store structured data, binary data (ArrayBuffer/Blob), and supports advanced querying via indexes.

Layman's terms: IndexedDB is like a mini database built into your browser. Websites can use it to store lots of data on your computer — far more than cookies or localStorage. A shopping site might use it to save your cart, but trackers can also abuse it to store identifying information that survives cookie deletion.

IndexedDB Quota

Technical definition: IndexedDB quotas define how much storage space a website can use. In Chromium-based browsers, the default persistent quota is approximately 80% of available disk space for origins that the user has granted persistent storage to. Temporary storage is typically capped at a smaller threshold (around 10% of total disk, up to 2 GB). Firefox uses a similar model with a "prompt" threshold above which users are asked for permission.

Layman's terms: Websites can store a surprising amount of data on your computer through IndexedDB. Some browsers let sites use up to 80% of your hard drive. That's enough for trackers to store massive amounts of data about your browsing habits, even across private browsing sessions.

localStorage

Technical definition: localStorage is a synchronous key-value storage API limited to 5–10 MB per origin. Data persists across sessions and is accessible to all scripts running on the same origin. Unlike cookies, localStorage data is not automatically sent with HTTP requests. It is vulnerable to XSS attacks since any script on the page can read it.

Layman's terms: localStorage is a small storage box that websites can use to save data on your computer. It holds about 5-10 MB per website and remembers data even after you close your browser. It's simpler than IndexedDB but limited in size and easier for attackers to steal if a website has a security flaw.

Service Worker Caching

Technical definition: A service worker is a script that runs in the background, separate from the web page, intercepting network requests and caching responses. It enables offline functionality, push notifications, and background sync. Service workers persist until explicitly unregistered and can store cached responses in the Cache API, which has no fixed quota — browsers manage it as part of overall storage pressure.

Layman's terms: A service worker is like a bodyguard for your browser tab. It sits between the website and the internet, caching files so the site works offline. It can remember what a website looked like and serve it from memory, even without an internet connection. This is great for usability but also means cached data persists longer than you might expect.

Cache API

Technical definition: The Cache API provides a programmatic interface for storing and retrieving network responses (request/response pairs) in the browser. It is primarily designed for use with service workers and enables offline-first web applications. Cache storage is origin-isolated and can grow until the browser's overall storage pressure triggers eviction.

Layman's terms: The Cache API is a storage system that lets websites save copies of files (images, scripts, stylesheets) on your computer. A website can store hundreds of megabytes of data this way, and it sticks around until your browser decides to clean up space. Most users have no visibility into what's cached.

Cache Poisoning

Technical definition: Cache poisoning is an attack where an adversary injects malicious content into a web cache (CDN, browser, or proxy) so that subsequent requests serve the poisoned response. Variants include HTTP header injection, URL normalization exploits, and Vary header misconfigurations. The attacker typically needs to find a request that is cached but whose response includes attacker-controlled input.

Layman's terms: Cache poisoning is like contaminating a water supply, but for website data. An attacker tricks a caching system (like a CDN or your browser) into storing a harmful version of a webpage. When other users request that page, they get the poisoned version instead of the real one.

Attackers often exploit URL normalization quirks to pull this off — properly encoding URLs with our URL Encoder can help developers understand how special characters in paths and parameters are interpreted differently by various systems.

---

Encryption & Transport Security

Client-Side Encryption

Technical definition: Client-side encryption (CSE) encrypts data in the browser before it is transmitted to the server. The encryption keys are derived from user input (password, passphrase) and never leave the client. The server stores only ciphertext and cannot decrypt it without the user's key. Implementations use the Web Crypto API (SubtleCrypto) with algorithms like AES-GCM (256-bit) and PBKDF2 for key derivation.

Layman's terms: With client-side encryption, your data is scrambled on your computer before it ever reaches the website's server. The website literally cannot read your data because it never has the decryption key. It's like putting your letter in a locked box — the mail carrier can deliver it but can't open it. Tools like password managers and encrypted backup services use this approach.

Encrypted data often needs to be encoded for safe transport — our Base64 Encoder converts binary ciphertext into text-safe strings, and our URL Encoder handles special characters when encrypted payloads travel in query strings.

End-to-End Encryption (E2EE)

Technical definition: End-to-end encryption ensures that data is encrypted on the sender's device and decrypted only on the recipient's device. No intermediate server, relay, or service provider can access the plaintext. Implementations use protocols like Signal Protocol (Double Ratchet + X3DH), MLS, or custom constructions built on AES-GCM and Curve25519. E2EE is distinct from transport encryption (TLS), which protects data in transit but not at rest on the server.

Layman's terms: End-to-end encryption means only you and the person you're talking to can read the message. Not even the company running the messaging app can read it. This is different from HTTPS, which protects your data while it travels across the internet but doesn't prevent the server from reading it once it arrives.

Perfect Forward Secrecy (PFS)

Technical definition: Perfect forward secrecy ensures that the compromise of a long-term key does not compromise past session keys. In TLS, PFS is achieved through ephemeral key exchange (ECDHE), where each session generates unique temporary keys. Even if an attacker records all encrypted traffic and later steals the server's private key, they cannot decrypt the recorded sessions.

Layman's terms: PFS is like using a new, disposable lock for every conversation. Even if someone steals your master key later, they can't go back and unlock old conversations — each one had its own unique lock that was thrown away after use.

TLS 1.3

Technical definition: TLS 1.3 (RFC 8446, published 2018) is the latest version of the Transport Layer Security protocol. It removes insecure cipher suites (RC4, 3DES, CBC mode), mandates forward secrecy for all key exchanges, reduces the handshake to one round trip (0-RTT for resumption), and encrypts more of the handshake metadata. It is the baseline for all secure web communication in 2026.

Layman's terms: TLS 1.3 is the security standard that makes the padlock icon in your browser work. It's the fastest and most secure version yet — it removes old, broken encryption methods, makes every connection forward-secret by default, and connects you to websites faster than previous versions.

Certificate Transparency (CT)

Technical definition: Certificate Transparency is a system of publicly auditable logs that record every TLS certificate issued by a Certificate Authority. Browsers require CT compliance for new certificates. The system enables detection of misissued or malicious certificates by allowing domain owners and monitoring services to watch the logs for unauthorized certificates.

Layman's terms: Certificate Transparency is like a public ledger for website security certificates. Every certificate a company issues is recorded in a public log that anyone can check. If a certificate authority issues a fake certificate for google.com, it shows up in the log and can be caught. This makes it much harder for attackers to impersonate websites.

HSTS (HTTP Strict Transport Security)

Technical definition: HSTS is a response header (Strict-Transport-Security) that instructs browsers to only access a domain over HTTPS for a specified duration (max-age). The includeSubdomains directive extends this to all subdomains, and preload allows the domain to be hardcoded in browsers as HTTPS-only. HSTS prevents protocol downgrade attacks and cookie hijacking over HTTP.

Layman's terms: HSTS is a instruction from a website to your browser that says "never connect to me over regular HTTP — always use the secure HTTPS version." Once your browser receives this instruction, it won't let any link or redirect take you to the insecure version, even if someone tries to trick you.

Content Security Policy (CSP)

Technical definition: Content Security Policy is an HTTP response header that restricts which resources a page can load. A CSP defines allowed sources for scripts, styles, images, fonts, frames, and connections. It mitigates XSS by preventing inline script execution, restricting script sources, and blocking unauthorized data exfiltration. Key directives include default-src, script-src, style-src, and connect-src.

Layman's terms: CSP is like a bouncer for your webpage — it decides what's allowed in and what gets blocked. A website can tell your browser to only load scripts from its own server, block all inline JavaScript, and prevent connections to unknown domains. This stops many types of attacks, even if an attacker manages to inject malicious code into a page.

Subresource Integrity (SRI)

Technical definition: Subresource Integrity is a security feature that allows browsers to verify that fetched resources (scripts, stylesheets) haven't been tampered with. The integrity attribute on <script> or <link> tags contains a cryptographic hash of the expected file. If the fetched resource doesn't match the hash, the browser refuses to execute or apply it.

Layman's terms: SRI is like a tamper-evident seal on a package. When your browser downloads a script from a CDN, it checks a digital fingerprint embedded in the HTML. If even one character in the script has been changed — by a hacker or a CDN compromise — the browser rejects it.

OCSP Stapling

Technical definition: Online Certificate Status Protocol (OCSP) stapling allows a web server to periodically query the Certificate Authority for the current revocation status of its certificate and "staple" the response to the TLS handshake. This eliminates the need for the client to contact the CA directly, reducing latency and preventing OCSP response interception.

Layman's terms: Normally, your browser has to ask a certificate authority "is this website's certificate still valid?" every time you visit. OCSP stapling lets the website include the answer directly in the connection, so your browser doesn't have to make a separate trip. It's faster and more private.

---

Browser Security Mechanisms

Same-Origin Policy (SOP)

Technical definition: The Same-Origin Policy is a fundamental browser security mechanism that restricts how a document or script loaded from one origin can interact with resources from another origin. An origin is defined by the combination of protocol, hostname, and port. SOP prevents a script on evil.com from reading data from bank.com, accessing its DOM, or making authenticated requests to it.

Layman's terms: The Same-Origin Policy is a rule that says a website can only access its own data. Without it, any website you visit could read your email from Gmail, steal data from your bank, or access any other site you're logged into. It's one of the most important security features in every browser.

CORS (Cross-Origin Resource Sharing)

Technical definition: CORS is a mechanism that allows servers to declare which origins are permitted to access their resources. The server responds with Access-Control-Allow-Origin headers specifying allowed origins. For non-simple requests, the browser sends a preflight OPTIONS request to check permissions before sending the actual request. CORS relaxes the Same-Origin Policy in a controlled, server-decided manner.

Layman's terms: CORS is like a guest list for a website's data. The website decides which other websites are allowed to access its information. When a website from a different domain asks for data, your browser checks the "guest list" (the CORS headers) before allowing the request. Without CORS, the Same-Origin Policy would block everything.

SameSite Cookies

Technical definition: SameSite is a cookie attribute that controls when cookies are sent with cross-site requests. SameSite=Strict sends cookies only for same-site requests. SameSite=Lax (the default in modern browsers) sends cookies for top-level navigations but not for cross-site subrequests. SameSite=None sends cookies with all requests but requires the Secure flag. This attribute is the primary defense against CSRF attacks.

Layman's terms: SameSite cookies control when your browser sends cookies (login tokens) to different websites. By default, your bank's cookies won't be sent when a link on another website tries to access your bank. This stops a common attack where a malicious site tries to perform actions on your behalf using your stored login.

Cross-Site Request Forgery (CSRF)

Technical definition: CSRF is an attack that tricks a user's browser into making unintended requests to a site where the user is authenticated. The attacker embeds a hidden form or image tag that triggers a request (e.g., transferring money) using the user's existing session cookie. Defenses include SameSite cookies, anti-CSRF tokens, and checking the Origin or Referer headers.

Layman's terms: CSRF is when an attacker tricks your browser into performing an action on a website where you're logged in — like changing your password or making a purchase — without you knowing. They do this by embedding a hidden request on a page you visit. SameSite cookies and CSRF tokens are the main defenses.

Cross-Site Scripting (XSS)

Technical definition: XSS is a vulnerability where an attacker injects malicious JavaScript into a web page viewed by other users. Types include stored XSS (persistent in the database), reflected XSS (injected via URL parameters), and DOM-based XSS (manipulating client-side JavaScript). XSS allows attackers to steal session cookies, redirect users, deface websites, or perform actions as the victim. Defenses include input sanitization, output encoding, CSP, and Trusted Types.

Layman's terms: XSS is when an attacker sneaks malicious code into a website that other people visit. The code runs in their browsers as if the website itself served it, letting the attacker steal logins, redirect users, or spy on their activity. It's like someone slipping a hidden note into a letter that the postman delivers to someone else.

Developers defending against XSS often use regex patterns to validate and sanitize input. Our Regex Tester lets you test and debug these patterns with live highlighting — essential for building robust input validation that blocks malicious payloads without breaking legitimate user input.

Trusted Types

Technical definition: Trusted Types is a browser security mechanism (part of the W3C specification) that prevents DOM XSS by requiring that dangerous sink inputs (e.g., innerHTML, eval, document.write) receive only trusted policy-created values rather than raw strings. When enabled, scripts that try to assign a string to innerHTML are blocked unless the string was processed through a defined Trusted Type policy.

Layman's terms: Trusted Types is like a security checkpoint for code that could be dangerous. Instead of letting any string get inserted directly into the page (which could contain hidden attacks), your browser requires that the code be processed through a safety filter first. It's a powerful defense against XSS attacks.

SPECTRE (Security Exploit)

Technical definition: SPECTRE (Speculative Execution) is a class of hardware vulnerabilities that allow attackers to read sensitive data from memory through CPU speculative execution. Variant 1 (Bounds Check Bypass) and Variant 2 (Branch Target Injection) are the most relevant to browsers. Mitigations include site isolation (each site in a separate process), reduced timer precision, and compiler-level retpolines.

Layman's terms: SPECTRE is a hardware flaw in virtually all modern processors. It lets an attacker read data they shouldn't have access to by exploiting how CPUs try to be fast. Browsers have added defenses like running each website in its own isolated compartment, but it remains one of the most serious hardware-level threats.

Site Isolation

Technical definition: Site isolation is a browser security architecture that runs each site in a separate operating system process. In Chrome, this was fully enabled in 2018 to mitigate SPECTRE attacks. It prevents one site from reading another site's data through side-channel attacks, at the cost of increased memory usage. Each origin gets its own process with its own address space.

Layman's terms: Site isolation puts each website in its own sandbox. Even if one website tries to spy on another through a hardware flaw like SPECTRE, it can't — they're in completely separate containers. The trade-off is that your browser uses more memory, but the security benefit is significant.

When working with memory addresses, hex dumps, or binary representations during security analysis, our Base Converter translates between binary, octal, decimal, and hexadecimal — useful when inspecting low-level data that security researchers and exploit developers work with daily.

Incognito Mode / Private Browsing

Technical definition: Private browsing modes (Chrome's Incognito, Firefox's Private Browsing, Safari's Private Browsing) create temporary browser sessions that don't save browsing history, cookies, form data, or localStorage to disk. However, private browsing does NOT prevent fingerprinting, does NOT hide activity from your ISP or employer, and does NOT prevent JavaScript from tracking you during the session. Extensions are typically disabled.

Layman's terms: Private browsing is more limited than most people think. It only prevents your browser from remembering what you did — no history, no cookies saved. But your ISP, employer, and the websites you visit can still see everything. And fingerprinting techniques can still track you. It's like wearing a disguise — it hides your identity from other shoppers, not from the store's security cameras.

---

Privacy Technologies

Do Not Track (DNT)

Technical definition: Do Not Track was a browser setting that sent a signal (DNT: 1) to websites requesting they not track the user. It was entirely voluntary — websites could ignore it with no consequence. The header was deprecated by all major browsers between 2019 and 2024 due to lack of adoption and enforcement. It has been replaced by more robust mechanisms like Global Privacy Control.

Layman's terms: DNT was a polite request your browser could send to websites saying "please don't track me." The problem? Websites were free to completely ignore it. It was like putting a "no soliciting" sign on your door — some respected it, most didn't. It's been replaced by stronger privacy tools.

Global Privacy Control (GPC)

Technical definition: GPC is a technical specification that communicates a user's legal right to opt out of the sale or sharing of their personal data under CCPA, GDPR, and similar regulations. Unlike DNT, GPC carries legal weight in jurisdictions with privacy laws. Browsers like Firefox, Brave, and DuckDuckGo send the Sec-GPC: 1 header by default. Websites in California and the EU are legally required to honor it.

Layman's terms: GPC is like DNT's younger, legally empowered sibling. When your browser sends a GPC signal, websites in California and Europe are legally required to stop selling or sharing your data. It's not just a polite request anymore — it has actual legal backing.

Privacy Sandbox

Technical definition: The Privacy Sandbox is Google's initiative to replace third-party cookies with privacy-preserving alternatives for web advertising. Key APIs include the Topics API (interest-based advertising without tracking), Protected Audiences (retargeting without cross-site tracking), Attribution Reporting (conversion measurement without individual-level tracking), and Fenced Frames (isolated ad frames). Rolled out in Chrome starting 2024, with third-party cookie deprecation proceeding through 2026.

Layman's terms: The Privacy Sandbox is Google's attempt to let advertisers show you relevant ads without tracking everything you do online. Instead of following you across the web with cookies, your browser categorizes your interests locally and shares only broad categories with advertisers. Whether this actually preserves privacy depends heavily on implementation.

Topics API

Technical definition: The Topics API is a Privacy Sandbox mechanism that allows browsers to infer coarse user interests (topics) from browsing history without exposing individual site visits. The browser observes URLs visited, maps them to a taxonomy of ~470 topics, computes the top 5 topics for each week, and makes them available to third-party code with user-agent enforcement of call limits. Users can view and delete their topics.

Layman's terms: Instead of advertisers tracking every site you visit, your browser itself figures out your interests (like "sports" or "cooking") and shares only those broad categories. Advertisers see "this person likes sports" rather than "this person visited espn.com at 3:42 PM on Tuesday." It's a middle ground between targeting and tracking.

FLoC (Federated Learning of Cohorts)

Technical definition: FLoC was a proposed Privacy Sandbox API that grouped users into cohorts of thousands based on browsing history using on-device machine learning. It was heavily criticized by privacy researchers for enabling fingerprinting of cohorts and was abandoned by Google in 2022 in favor of the Topics API. Chrome removed FLoC support in late 2022.

Layman's terms: FLoC was an earlier attempt at privacy-preserving ad targeting that grouped you with thousands of similar users. The idea was that advertisers would target "sports fans" (a group) rather than you individually. But researchers found ways to still identify individuals within groups, so it was scrapped in favor of the Topics API.

Oblivious DNS over HTTPS (ODoH)

Technical definition: ODoH is a privacy-enhancing DNS protocol that adds a proxy layer between the client and the DNS resolver. The client encrypts the DNS query, sends it to a proxy, which forwards it to the resolver. The proxy doesn't see the query content, and the resolver doesn't see the client's identity. This separation prevents any single party from seeing both who is asking and what they're asking.

Layman's terms: ODoH is like having a secret messenger deliver your questions to an expert. The messenger doesn't know the question, and the expert doesn't know who asked. This way, no single person knows both who you are and what you're looking up on the internet.

Trusted Execution Environment (TEE)

Technical definition: A TEE is a secure area within a processor that guarantees code and data loaded inside are protected with respect to confidentiality and integrity. Intel SGX, ARM TrustZone, and AMD SEV are hardware implementations. TEEs enable privacy-preserving computation where even the server operator cannot access the data being processed. Used in privacy-preserving ad measurement and secure enclaves for cryptographic operations.

Layman's terms: A TEE is like a vault inside your computer's brain. Even if someone has complete control of the server, they can't see what's happening inside the vault. It's used for things like processing sensitive data without anyone — not even the server owner — being able to peek.

---

Web Application Security

Content Injection

Technical definition: Content injection occurs when an attacker can introduce arbitrary content into a web page served to other users. This includes HTML injection (adding visible elements), script injection (XSS), and style injection (manipulating appearance). Unlike XSS, HTML and style injection may not require JavaScript execution but can still mislead users through visual deception.

Layman's terms: Content injection is when an attacker manages to add their own content to a website you're visiting — fake login forms, misleading messages, or hidden elements. It's like someone slipping a fake page into a magazine you're reading.

One common target for injection attacks is contact information — scrapers harvest email addresses from pages to spam. Our Email Obfuscator scrambles email addresses in your HTML so humans can read them but bots can't collect them, reducing a common attack surface.

DOM-Based XSS

Technical definition: DOM-based XSS occurs when client-side JavaScript reads attacker-controlled input from the DOM (e.g., location.hash, document.referrer) and writes it to a dangerous sink (innerHTML, eval, document.write) without sanitization. Unlike reflected XSS, the malicious payload never reaches the server — the vulnerability exists entirely in client-side code.

Layman's terms: Most XSS attacks go through the server, but DOM-based XSS happens entirely in your browser. A malicious URL fragment (the part after #) gets processed by JavaScript and inserted into the page in a dangerous way. The server never sees the attack — it all happens on your machine.

Prototype Pollution

Technical definition: Prototype pollution is a JavaScript vulnerability where an attacker can modify the Object.prototype through crafted input, affecting all objects that inherit from it. When merged with user-controlled input using patterns like _.extend() or Object.assign() without sanitization, properties like __proto__, constructor, or prototype can be overwritten, leading to XSS, remote code execution, or denial of service.

Layman's terms: In JavaScript, there's a master blueprint (Object.prototype) that every object inherits from. Prototype pollution is when an attacker modifies this blueprint, and the changes ripple through every object in the application. It's like someone poisoning the water supply — everything downstream is affected.

Open Redirect

Technical definition: An open redirect is a vulnerability where a web application accepts a user-controlled parameter that specifies an external URL, and redirects the user to that URL without validation. Attackers use open redirects in phishing attacks (making a legitimate URL redirect to a malicious site), OAuth token theft, and bypassing security filters.

Layman's terms: An open redirect is when a legitimate website has a link that says "go to this page" but actually sends you somewhere else entirely — often a phishing site. Attackers abuse this because the link starts with a trusted domain, making it look safe even though it's taking you somewhere dangerous.

Understanding URL structure is key to spotting these attacks. Our URL Encoder reveals how special characters, encoded paths, and query parameters are represented — the same encoding tricks attackers use to disguise malicious redirect targets.

Clickjacking

Technical definition: Clickjacking (UI redress attack) tricks a user into clicking on a hidden element by overlaying it with visible content from another site. The attacker loads the target site in a transparent iframe and positions a deceptive UI element over the clickable area. Defenses include the X-Frame-Options header and the frame-ancestors CSP directive.

Layman's terms: Clickjacking is like putting a transparent sheet of paper with a button over another button. You think you're clicking "Play Video" but you're actually clicking "Confirm Purchase" on a hidden page. The X-Frame-Options header prevents sites from being embedded in hidden iframes, stopping this attack.

DNS Rebinding

Technical definition: DNS rebinding is an attack that bypasses the Same-Origin Policy by dynamically changing the DNS resolution of an attacker-controlled domain. The first DNS response points to the attacker's server (serving a malicious page), then the DNS record is changed to point to a local network address (like 127.0.0.1 or 192.168.1.1). The malicious JavaScript then makes requests to internal services, believing they're same-origin.

Layman's terms: DNS rebinding is like sending someone to a legitimate store, then secretly changing the store's address to your house while they're inside. The browser thinks it's still at the original address, but it's actually talking to the attacker's server, which can now access your local network.

Spectre via SharedArrayBuffer

Technical definition: SharedArrayBuffer enables true multi-threading in JavaScript by allowing multiple web workers to share memory. However, this enables high-precision timing attacks (via Atomics.wait()) that can be used for SPECTRE-style side-channel attacks. Browsers require Cross-Origin-Isolation (via Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy headers) to enable SharedArrayBuffer.

Layman's terms: SharedArrayBuffer lets JavaScript programs run multiple threads simultaneously, which is great for performance but creates a security risk. It can be used to build extremely precise timers that exploit CPU vulnerabilities. Browsers only allow it when specific security headers are in place, creating an isolated environment.

---

Data Privacy Regulations

General Data Protection Regulation (GDPR)

Technical definition: GDPR is the EU's comprehensive data protection regulation, effective since May 2018. It requires lawful basis for processing personal data (consent, legitimate interest, contract, etc.), mandates data protection impact assessments for high-risk processing, grants data subjects rights to access, rectify, erase, and port their data, and imposes fines up to 4% of global annual revenue or €20 million. Applies to any entity processing data of EU residents regardless of the entity's location.

Layman's terms: GDPR is Europe's strict privacy law. It says companies must have a good reason to collect your data, must tell you what they're doing with it, must delete it when you ask, and face massive fines if they break the rules. It applies to any company anywhere in the world that handles data of EU residents.

California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)

Technical definition: CCPA (effective 2020) and its amendment CPRA (effective 2023) grant California consumers the right to know what personal information businesses collect, the right to delete it, the right to opt out of its sale, and the right to non-discrimination for exercising privacy rights. CPRA created the California Privacy Protection Agency (CPPA) and added the right to correct personal information. Applies to businesses meeting revenue or data-processing thresholds.

Layman's terms: CCPA/CPRA is California's privacy law, similar to Europe's GDPR. It gives you the right to see what data companies collect about you, delete it, and stop them from selling it. If a company doesn't comply, you can sue them. It applies to any large company that does business in California.

Global Privacy Control (GPC) Legal Status

Technical definition: GPC is legally enforceable under CCPA/CPRA. The California Attorney General and CPPA have confirmed that businesses must honor GPC signals as a valid opt-out of the sale/sharing of personal information. Failure to honor GPC can result in enforcement actions. Colorado, Connecticut, and Virginia also recognize GPC or similar universal opt-out mechanisms.

Layman's terms: If you're in California, a website that ignores your GPC signal is breaking the law. The state's privacy regulator has confirmed that GPC is a legally valid way to say "don't sell my data." Several other states have similar rules.

Data Minimization

Technical definition: Data minimization is a privacy principle requiring that organizations collect only the personal data that is strictly necessary for the specified purpose. Under GDPR Article 5(1)(c), personal data must be "adequate, relevant and limited to what is necessary." This principle extends to retention — data should be deleted once the purpose is fulfilled.

Layman's terms: Data minimization means companies should only collect the data they actually need, nothing more. A grocery delivery app needs your address; it doesn't need your contacts, photos, or location history. This principle is a core part of modern privacy laws.

Purpose Limitation

Technical definition: Purpose limitation is a data protection principle requiring that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. Under GDPR, further processing for archival purposes, scientific research, or statistical purposes is compatible if appropriate safeguards are in place.

Layman's terms: When a company collects your data for one reason, they can't just use it for something completely different without telling you. If you give your email to receive a receipt, they can't sell it to advertisers. Your data should only be used for the reason you provided it.

Right to Be Forgotten (Erasure)

Technical definition: The right to erasure (GDPR Article 17) allows individuals to request the deletion of their personal data under specific circumstances: the data is no longer needed, consent is withdrawn, the data was unlawfully processed, or a legal obligation requires deletion. Exceptions include freedom of expression, legal claims, and public health interests.

Layman's terms: You can legally ask companies to delete your personal data, and they have to comply in most cases. If you close an account, they should delete your information. If they've been collecting data about you without a good reason, you can demand they erase it.

Privacy by Design

Technical definition: Privacy by Design is an approach to systems engineering that integrates data protection into the design and architecture of IT systems and business practices from the outset, rather than as an afterthought. Mandated by GDPR Article 25, it requires implementing appropriate technical and organizational measures (pseudonymization, encryption, access controls) to ensure data protection principles are met by default.

Layman's terms: Privacy by Design means building privacy into a product from the very beginning, not bolting it on later. It's like building a house with locks already installed versus adding them after someone breaks in. GDPR requires companies to do this by default.

---

Password & Authentication Tools

Password Manager

Technical definition: A password manager is a software application that generates, stores, and auto-fills unique, high-entropy passwords for each user account. Passwords are encrypted with a master password using algorithms like AES-256-GCM and PBKDF2 or Argon2. Leading options include 1Password, Bitwarden, and KeePass. A password manager enables every account to have a unique, random 16+ character password without requiring memorization.

Layman's terms: A password manager is like a digital safe for all your passwords. You remember one strong master password, and it remembers everything else. It can also create unguessable passwords for each website, so even if one site gets hacked, your other accounts are safe. It's the single most impactful thing you can do for account security.

If you need to generate a strong master password or individual account passwords without a full manager, our Password Generator creates cryptographically random strings with configurable length and character sets — the same quality a password manager would use.

Multi-Factor Authentication (MFA)

Technical definition: MFA requires two or more independent authentication factors: something you know (password), something you have (hardware token, phone), and something you are (biometric). TOTP (Time-based One-Time Password) generates 6-digit codes from a shared secret and current time. FIDO2/WebAuthn uses public-key cryptography with hardware security keys or platform authenticators. SMS-based MFA is the weakest due to SIM-swapping attacks.

Layman's terms: MFA means proving your identity with more than just a password. It's like needing both a key and a PIN to open a safe. Even if someone steals your password, they still need your phone or security key to get in. Hardware-based MFA (like a YubiKey) is the strongest option.

Many modern authentication systems issue JWTs (JSON Web Tokens) after MFA verification. Our JWT Decoder lets you inspect these tokens to see exactly what claims and permissions they carry — useful for debugging and understanding what data your authentication flow exposes.

Passkeys

Technical definition: Passkeys are FIDO2 credentials that replace passwords with public-key cryptography. A passkey consists of a private key stored on the user's device (in a secure enclave) and a public key registered with the website. Authentication uses a challenge-response protocol — the server sends a challenge, the device signs it with the private key, and the server verifies with the public key. Passkeys sync across devices via iCloud Keychain or Google Password Manager.

Layman's terms: Passkeys are the future of login — no more passwords at all. Instead, your device and the website exchange cryptographic keys. Your phone proves it's your phone by responding to a challenge, and the website verifies it. It's more secure than passwords and can't be phished, because the key never leaves your device.

Hardware Security Key

Technical definition: A hardware security key is a physical device that performs cryptographic operations (signing, encryption) in an isolated chip. Standards include FIDO2/WebAuthn and TOTP. Keys like YubiKey use NFC, USB, or Bluetooth to communicate with the device. The private key never leaves the hardware, making it immune to software-based theft, phishing, and remote compromise.

Layman's terms: A hardware security key is a small physical device (like a USB stick) that proves your identity. Since the secret key is locked inside the device and never transmitted, even a skilled hacker can't steal it remotely. It's the most phishing-resistant form of authentication available.

TOTP (Time-based One-Time Password)

Technical definition: TOTP is an algorithm that generates temporary 6-digit codes based on a shared secret and the current time (typically 30-second intervals). Defined in RFC 6238, it uses HMAC-SHA1 or HMAC-SHA256 to produce codes that both the authenticator app and server can compute independently. The server allows a small time window and counter drift to account for clock skew.

Layman's terms: TOTP is the 6-digit code that changes every 30 seconds in apps like Google Authenticator or Authy. Both your phone and the website know a secret code, and they both use the current time to generate the same number. Since the number changes constantly, even if someone sees it once, it's useless seconds later.

---

Advanced Concepts

Subresource Integrity (SRI) Deep Dive

Technical definition: SRI uses base64-encoded SHA-256 or SHA-384 hashes embedded in the integrity attribute of <script> or <link> tags. The browser computes the hash of the downloaded resource and compares it to the specified hash. If they don't match, the resource is blocked. SRI works only with same-origin or CORS-enabled cross-origin resources. The crossorigin attribute must be set for cross-origin resources.

Layman's terms: Think of SRI as a digital fingerprint check. When your browser downloads a file from a CDN, it computes a fingerprint and compares it to the one in the HTML. If they match, the file is authentic. If not — whether because of a hacker or a CDN error — the file is rejected. It's simple but powerful protection against supply-chain attacks.

Web Cryptography API

Technical definition: The Web Cryptography API (SubtleCrypto) provides cryptographic primitives directly in the browser: AES-GCM encryption, RSA-OAEP, ECDSA signatures, PBKDF2/Argon2 key derivation, SHA-256/SHA-384 hashing, and random number generation (crypto.getRandomValues()). It enables client-side encryption, digital signatures, and secure authentication without plugins or server round-trips.

Layman's terms: The Web Cryptography API gives your browser the ability to do real, professional-grade encryption and decryption. Website developers can use it to encrypt your data before sending it anywhere, generate unguessable random numbers, and verify digital signatures — all without any external software.

Entropy Pool

Technical definition: An entropy pool is a buffer of random bytes maintained by the operating system, used as a source of randomness for cryptographic operations. On Linux, /dev/urandom draws from the pool, which is seeded by interrupt timing, mouse movements, keyboard input, and hardware random number generators. On modern systems, hardware RNGs (Intel RDRAND, ARM RNDR) provide high-quality entropy. The pool is critical for generating secure keys, nonces, and salts.

Layman's terms: An entropy pool is your computer's jar of true randomness. It collects unpredictable data from hardware events — when keys are pressed, when the mouse moves, electronic noise in the chip — and uses this to generate secure random numbers. Without enough entropy, cryptographic keys could be predictable and therefore breakable.

For generating random numbers in your own projects, our Random Number Generator uses the browser's crypto.getRandomValues() — the same cryptographically secure API that powers the Web Cryptography API — to produce unbiased random numbers in any range.

CSP Nonce

Technical definition: A CSP nonce is a unique, randomly generated value included in the Content Security Policy header and in individual <script> or <style> tags. The browser only executes scripts or applies styles whose nonce matches the one in the CSP header. A new nonce must be generated for each request to prevent caching issues. This allows specific inline scripts to run while blocking all others.

Layman's terms: A CSP nonce is like a one-time password for scripts. Your server generates a random number, includes it in the security policy, and puts the same number on the specific scripts it wants to run. Any script without the right number gets blocked. It's a way to allow legitimate inline scripts while stopping attackers.

Fingerprinting Resistance

Technical definition: Browser fingerprinting resistance refers to a set of techniques that reduce the uniqueness of a browser's fingerprint. Strategies include: standardizing canvas rendering (Firefox's privacy.resistFingerprinting), limiting WebGL information, normalizing font lists, reducing timer precision, spoofing user-agent strings, and returning uniform screen dimensions. Tor Browser applies the most comprehensive resistance, making all users appear identical.

Layman's terms: Some browsers try to make all users look the same to fingerprinters. Firefox and Tor can fake your canvas output, hide your real fonts, and return standard screen sizes. The goal is to make you blend in with everyone else, so fingerprinting can't tell you apart.

Tor and Onion Routing

Technical definition: Tor (The Onion Router) routes traffic through a network of volunteer-operated relays in three encrypted layers (guard, middle, exit). Each relay only knows the previous and next hop, preventing any single relay from linking source to destination. The Tor Browser applies uniform fingerprinting resistance, enforces HTTPS, and isolates circuits per destination. Onion services (.onion addresses) provide end-to-end encryption without an exit relay.

Layman's terms: Tor bounces your internet traffic through three random computers around the world, each adding a layer of encryption. The first computer knows who you are but not where you're going. The last computer knows where you're going but not who you are. No single computer knows both, making it extremely hard to trace your activity.

DNS over HTTPS (DoH)

Technical definition: DoH encrypts DNS queries within HTTPS connections (port 443), preventing ISPs, network operators, and attackers from intercepting or manipulating DNS lookups. Defined in RFC 8484, it uses the same encryption as regular web browsing. Browsers support DoH with resolvers like Cloudflare (1.1.1.1), Google (8.8.8.8), and NextDNS. DoH prevents DNS-based censorship and surveillance but centralizes DNS visibility with the resolver provider.

Layman's terms: DoH encrypts the phonebook lookups your browser makes. Normally, when you type a website address, your ISP can see every site you're trying to visit. With DoH, those lookups are encrypted, so your ISP only sees encrypted HTTPS traffic to a DNS provider, not which specific sites you're visiting.

DNS over TLS (DoT)

Technical definition: DoT encrypts DNS queries using TLS on port 853, separate from regular HTTPS traffic. Unlike DoH, DoT operates on its own port, making it easier to block but also easier to implement for system-wide DNS privacy. It's widely supported on Android (Private DNS) and by DNS resolvers like Cloudflare and Quad9.

Layman's terms: DoT is similar to DoH but uses a dedicated port for encrypted DNS queries instead of mixing them with regular web traffic. It's easier to configure at the system level (like on Android's Private DNS setting) but also easier for network administrators to block if they want to.

Zero-Knowledge Proof

Technical definition: A zero-knowledge proof is a cryptographic protocol that allows one party (the prover) to convince another party (the verifier) that a statement is true without revealing any information beyond the validity of the statement itself. Types include interactive proofs (where the verifier sends challenges) and non-interactive proofs (zk-SNARKs, zk-STARKs). Used in privacy-preserving authentication, blockchain privacy, and verifiable computation.

Layman's terms: A zero-knowledge proof is like proving you know a secret without actually saying what the secret is. You could prove to someone that you're over 21 without revealing your birthday, or prove you solved a puzzle without showing the solution. It's the ultimate in privacy-preserving verification.

Secure Enclave / Trusted Platform Module (TPM)

Technical definition: A TPM is a dedicated hardware chip (or firmware implementation) that stores cryptographic keys and performs security-critical operations in an isolated environment. It generates and stores RSA/ECC key pairs, measures boot integrity (PCR registers), and supports remote attestation. Apple's Secure Enclave, Google's Titan M, and Intel PTT are implementations. TPMs are required for Windows 11 and are central to FIDO2/WebAuthn hardware key operations.

Layman's terms: A TPM is a tiny, tamper-resistant computer inside your computer that guards your most important cryptographic keys. Even if someone hacks your operating system completely, they can't extract keys from the TPM. It's like having a vault inside a vault.

---

Quick Reference Glossary

---

Frequently Asked Questions

What is the most important browser privacy setting in 2026?

The single most impactful setting is enabling Global Privacy Control (GPC) in your browser. Firefox, Brave, and DuckDuckGo send this signal by default. In California and several other US states, websites are legally required to honor it as an opt-out of data selling. It takes zero effort and carries legal weight.

Can websites track me without cookies in 2026?

Yes. Browser fingerprinting techniques — canvas, WebGL, AudioContext, font enumeration — can identify you without any cookies or stored data. These methods work in private browsing mode and survive cookie deletion. The Tor Browser offers the strongest resistance by making all users appear identical, but it comes with performance trade-offs.

Are password managers safe to use?

Yes, password managers are significantly safer than reusing passwords or using weak ones. A password manager with a strong master password protected by Argon2 and 2FA means that even if the provider's servers are breached, your encrypted vault remains protected. The risk of not using a password manager (reused or weak passwords) far outweighs the risk of using one.

What is the difference between TLS and end-to-end encryption?

TLS encrypts data in transit — between your browser and the server. The server can still read your data once it arrives. End-to-end encryption encrypts data on your device and only decrypts it on the intended recipient's device. The server never sees the plaintext. Use E2EE tools (Signal, ProtonMail) when you don't trust the server operator.

Do I need to worry about SPECTRE as a regular user?

As an individual user, the main protection against SPECTRE is that your browser already has mitigations built in (site isolation, reduced timer precision). However, these mitigations increase memory usage. The real concern is for high-value targets — journalists, activists, corporate networks — where a sophisticated attacker with physical or extended network access could exploit these hardware flaws.

Is Incognito mode actually private?

Incognito mode only prevents your browser from saving history, cookies, and form data. It does not hide your activity from your ISP, employer, the websites you visit, or any network-level observer. It also does not prevent fingerprinting. Use it to keep browsing activity off a shared computer, not for actual privacy from surveillance.