Storage APIs
Which Storage Surfaces You Expose
Cookies, localStorage, sessionStorage, IndexedDB, Cache Storage, Service Worker, WebSQL, plus the storage quota bucket.
Storage APIs
Reading signal in your browser...
Patterns anti-bot vendors watch
- All storage disabled at once. Extremely rare on real browsers; either a hardened build or a headless container with cookies disabled.
- WebSQL "available" on a modern Chrome UA. Chrome removed WebSQL from browser contexts in v119. Presence = you're on an old Chrome or you're lying about the version.
- Absurd storage quota (a few MB, or many hundreds of GB). Real quotas cluster around device capacity.
- Cookies fail but localStorage works. Contradictory for most real modes; could be third-party iframe or a bug.
Frequently asked questions
→Why is storage availability a fingerprint signal?
Because the combination of what works and what throws is browser + mode + third-party-context specific. Safari's Private mode kills localStorage; regular Safari keeps it. Firefox in strict tracking-protection mode blocks IndexedDB in third-party iframes. WebSQL still exists in old Safari but not Chrome. The pattern narrows down which browser you're really in.
→What is the storage quota?
The upper bound on total storage this origin can use across all APIs, exposed via navigator.storage.estimate().quota. It's bucketed to reduce entropy, but a small quota (a few GB) hints at mobile / limited devices, and a huge quota (100+ GB) hints at desktop.
→Should scrapers block cookies to reduce fingerprint?
No, blocking cookies is a signal in itself. Real browsers accept cookies by default. Instead: accept them, isolate them per profile, and clear them between crawls. Cookie policies from the anti-bot side are actually looking for real cookie behavior (Cf-Chl-* cookies being set, followed and returned).
→What breaks if Service Worker isn't available?
Some background sync and offline patterns. From a fingerprint perspective, presence of Service Worker is the norm on modern browsers. Absence usually means you're in a private-mode profile, an insecure context, or an unusual embedded WebView.
→How is IndexedDB used for tracking?
Same idea as localStorage but with larger quotas and structured data. 'Evercookies' write a small ID token to every available surface (cookies, localStorage, IndexedDB, Cache Storage, ETags). If a user clears one, the token is restored from another. From a scraper's perspective: clear all of them between sessions.