xiry.

Development · GitHub repo

supercookie

Browser fingerprinting demonstration that tracks visitors across sessions via favicon caching

From the Xiry library · Updated 10 October 2026

Visit github.com ↗

supercookie is an open-source proof of concept that demonstrates how web browsers can be fingerprinted using favicon caches (F-Cache). Because favicon caches are often shared and persistent across regular and incognito sessions, it assigns a unique identifier that survives cookie deletion, cache flushes, VPNs, and ad blockers. It serves as an educational resource to illustrate browser security vulnerabilities.

What it's for

  • Test whether a specific browser or privacy configuration is vulnerable to favicon-based fingerprinting
  • Study how browsers handle favicon caching across private and standard browsing contexts
  • Demonstrate web tracking vulnerabilities in security and privacy presentations

Features

  • Favicon-based tracking bypassing typical incognito mode boundaries
  • Resistance to standard cache clearing, browser restarts, and VPN use
  • Scalable bit-allocation system using redirects to distinguish up to 2^N unique visitors
  • Ready-to-deploy Docker and Node.js setup for self-hosting local demonstrations

Pricing

Open source

Details

Type
GitHub repo
Category
Development
Topic
Security & Privacy
Open source
Yes
Platforms
Web, Self-hosted
For
Security researchers, web developers, and privacy enthusiasts
Alternative to
FingerprintJS
Tags
fingerprinting, cybersecurity, privacy, tracking, browser, infosec

Why it was saved

  • @tom_doerr, 16 November 2025: Reference for understanding favicon-based tracking; a live demo of a persistent tracking method that bypasses common privacy defenses.

Related

  • Argus

    Python interactive CLI toolkit for automated OSINT, network reconnaissance, and security checks

  • LeakIX

    Threat intelligence search engine tracking exposed internet services and data leaks

  • agent-browser

    Browser automation CLI and engine purpose-built for AI agents

  • Mediabunny

    Fast, dependency-free JavaScript media toolkit for browser-based video and audio processing

  • OpenOSINT

    AI OSINT agent, MCP server, and framework chaining intelligence tools

  • Robin

    AI-powered dark web OSINT tool for automated querying and summaries

Updated