GoKawiilDeveloper releases Onionspector to reveal what Tor sites can learn about visitors
A developer who previously built Onionservatory, a tool to audit Onion Service security configurations, has now released a companion tool called Onionspector. This new tool flips the perspective, showing users exactly what data points—from HTTP headers to browser fingerprinting signals like screen size, fonts, and Canvas/WebGL output—a website can collect about them when they connect, even over Tor.
GoKawiil's interpretation of the reporting above, not reported fact.
Browser fingerprinting doesn't rely on a single identifying trait but on the unique combination of dozens of small technical details, which is exactly what Tor Browser tries hard to normalize away. Onionspector gives privacy-conscious users and developers a practical way to verify whether their setup is actually blending in with the crowd or unintentionally standing out.
- Onionspector complements Onionservatory by inspecting the client side of Onion Service connections instead of the server side.
- Even without JavaScript, HTTP headers like User-Agent and Accept-Language can leak meaningful browser configuration data.
- Fingerprinting risk comes from combining many small signals—screen size, fonts, GPU, timezone—into a distinguishing profile.
O'Reilly "Web Application Security" by Andrew Hoffman — If poking at HTTP headers, fingerprinting surfaces and security policies sounds like fun, this book walks through exactly how browsers and servers leak information and how to lock it down. It's a great companion for anyone building their own scanning tools like Onionspector or hardening a site's headers.
See O'Reilly "Web Application Security" by Andrew Hoffman on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: 0ut3r.space, 2026-09-06
Published there as: “Onionspector – now let's see what The Onion knows about you”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.