# supercookie

> Browser fingerprinting demonstration that tracks visitors across sessions via favicon caching

supercookie is an open-source proof of concept that demonstrates how web browsers can be fingerprinted using favicon caches (F-Cache). Because favicon caches are often shared and persistent across regular and incognito sessions, it assigns a unique identifier that survives cookie deletion, cache flushes, VPNs, and ad blockers. It serves as an educational resource to illustrate browser security vulnerabilities.

Website: https://github.com/jonasstrehle/supercookie

## What it is for

- Test whether a specific browser or privacy configuration is vulnerable to favicon-based fingerprinting
- Study how browsers handle favicon caching across private and standard browsing contexts
- Demonstrate web tracking vulnerabilities in security and privacy presentations

## Features

- Favicon-based tracking bypassing typical incognito mode boundaries
- Resistance to standard cache clearing, browser restarts, and VPN use
- Scalable bit-allocation system using redirects to distinguish up to 2^N unique visitors
- Ready-to-deploy Docker and Node.js setup for self-hosting local demonstrations

## Pricing

Open source

## Details

- Type: GitHub repo
- Category: [Development](https://xiry.app/topics/development.md)
- Open source: yes
- Platforms: Web, Self-hosted
- For: Security researchers, web developers, and privacy enthusiasts
- Alternative to: FingerprintJS
- Tags: fingerprinting, cybersecurity, privacy, tracking, browser, infosec

## Why it was saved

- [@tom_doerr, 16 November 2025](https://x.com/tom_doerr/status/1990064116682121566): Reference for understanding favicon-based tracking; a live demo of a persistent tracking method that bypasses common privacy defenses.

## Related

- [Argus](https://xiry.app/resources/argus): Python interactive CLI toolkit for automated OSINT, network reconnaissance, and security checks (GitHub repo, Open source)
- [LeakIX](https://xiry.app/resources/leakix): Threat intelligence search engine tracking exposed internet services and data leaks (Website, Freemium)
- [agent-browser](https://xiry.app/resources/agent-browser): Browser automation CLI and engine purpose-built for AI agents (GitHub repo, Open source)
- [Mediabunny](https://xiry.app/resources/mediabunny): Fast, dependency-free JavaScript media toolkit for browser-based video and audio processing (Web app, Open source)
- [OpenOSINT](https://xiry.app/resources/openosint): AI OSINT agent, MCP server, and framework chaining intelligence tools (GitHub repo, Open source)
- [Robin](https://xiry.app/resources/robin): AI-powered dark web OSINT tool for automated querying and summaries (GitHub repo, Open source)

Updated 10 October 2026. Page: https://xiry.app/resources/supercookie

Make your own library: Xiry takes your saved reels, tweets, Reddit bookmarks and Watch Later videos, makes them searchable and pulls the useful stuff out, like this library. It's invite-only for now; join the waitlist at https://xiry.app/#waitlist.