How do sites know my time zone?

Through JavaScript's Intl and Date, available to every page without a permission prompt. The IP's time zone comes from the same kind of location database that places your IP in a city.

How do I fix a mismatch?

Set the system time zone to one in the country your IP is in: on Windows in Settings → Time & language, on macOS in System Settings → General → Date & Time, on phones in the date and time settings. A browser extension that only changes JavaScript's time zone is easy to catch: the browser environment check shows why.

Why is a different zone in the same country only a warning?

Large countries have several time zones, and an IP is often placed in the right country but the wrong city. A zone of another country is a clear contradiction; a zone of the same country is only a hint.

Time zone check

Every page can read your system's time zone without asking, and every site knows roughly where your IP is. When the two disagree, say an IP in Japan and a clock on China Standard Time, it's one of the first signs sites use to spot a VPN or proxy. Here are both, side by side.

Your time zone against your IP

System time zone…
Time zone of the IP…
Clock format…
Location…
Your clock…

79 sniffers · no permission asked

Who sites think you are

You're probably from , and right now you're in . You speak , and your computer runs on with a clock.

You're on , using , with a screen and graphics: .

You get online through , ; the DNS server that looks up sites for you is in . .

You like , and . . Your fonts drop a hint: . As for your age, .

Browser fingerprint IDThe same on every site, in private windows and behind a VPN

Disguise check

–

Sniffing…

Time zone vs IP
- Set the system time zone to the IP's
- Windows: Settings → Time & language
- macOS: System Settings → General → Date & Time
Language vs IP
- Put the IP country's language first in the browser
- Not passing as a local? Leave it
System language vs IP
- The system has another language pack installed, and its fonts and voices show it
- Use a system or virtual machine without those languages
- Or pick a region that matches the system's language
DNS leak
- Clash / Mihomo: DNS with fake-ip, or TUN mode
- V2Ray / Xray: send DNS through the proxy too
- Browser: turn on Secure DNS
Split routing
- To hide it: switch to global mode
- Local sites going direct on purpose? Leave it
WebRTC leak
- Proxy client: turn on TUN mode
- Or limit WebRTC in the browser (Chrome: WebRTC Network Limiter)
Round trip
- A proxy always adds this leg, and sites can measure it
- A server closer to you, with less latency, narrows the gap
- Residential or mobile exits raise fewer eyebrows than data center IPs
Data center IP
- Use a home or mobile exit instead
- Streaming, AI and payment sites often block data centers
User agent vs system
- Don't change the user agent alone: the graphics card gives it away
- Need several identities? Use an anti-detect browser
Tampered environment
- Extensions that change the user agent, language or time zone only change what JavaScript reads; the request headers and the functions underneath stay as they were
- To pass for elsewhere, change the system itself: its language and time zone
- With an anti-detect browser, make sure its settings agree with each other
Trackable fingerprint
- Use Brave (scrambles the fingerprint)
- Or Firefox with resistFingerprinting
- Or Tor Browser
Automation
- Close Selenium, Puppeteer or other automation, then reload

Connection

HTTP/3
- Let the proxy carry UDP (Clash / Mihomo: TUN mode, udp: true)
- Allow UDP 443 on the firewall
- Check QUIC isn't turned off in the browser
ECH
- Turn on secure DNS (DNS over HTTPS) in the browser
- Proxy: turn off fake-ip, or have its DNS return HTTPS records
- Use a browser that supports ECH: Chrome, Edge, Firefox
Post-quantum
- Update the browser
- Turn off HTTPS scanning in your antivirus, or ask whether the company proxy decrypts traffic
WARP
- Cloudflare WARP: switch it in the 1.1.1.1 app

Where do you want to seem to be?

Target region

Every sniffer and what it read

Any site can read all of this, without a permission prompt.

What the server sees15

IP address…CF-Connecting-IP

Location…request.cf.city

Coordinates…request.cf.latitude

Network (ASN)…request.cf.asOrganization

DNS resolver…edns.ip-api.com

Time zone of the IP…request.cf.timezone

Reverse DNS…DNS PTR

Nearest data center…request.cf.colo

HTTP and TLS…request.cf.tlsVersion

Key exchange…/cdn-cgi/trace · kex, sni

Cloudflare WARP…/cdn-cgi/trace · warp

TLS fingerprint…TLS ClientHello

Your clock…Date.now()

WebRTC addresses…RTCPeerConnection · STUN

Local address…WebRTC host candidate

Exits6

Site in mainland China…myip.ipip.net

IP service abroad…api.ip.sb

ChatGPT…chatgpt.com/cdn-cgi/trace

Claude…claude.ai/cdn-cgi/trace

Cloudflare…www.cloudflare.com/cdn-cgi/trace

IPv4 and IPv6…Cloudflare Radar · IPv4 / IPv6

Request headers7

User agent…User-Agent

Languages…Accept-Language

Browser brands…Sec-CH-UA

Platform…Sec-CH-UA-Platform

Compression…Accept-Encoding

Do Not Track…DNT · Sec-GPC

Came from…Referer · document.referrer

Language and region8

Browser languages…navigator.languages

Locale…Intl.DateTimeFormat

System time zone…Intl …timeZone

Clock format…Intl …hourCycle

Week starts…Intl.Locale weekInfo

Number and date format…Intl.NumberFormat

Keyboard layout…navigator.keyboard

Speech voices…speechSynthesis

Fingerprints7

JS engine…Error.message

Canvas…canvas.toDataURL

WebGL…WebGL getParameter

Audio…OfflineAudioContext

Font list…fonts → SHA-256

Combined fingerprint…SHA-256

Fingerprint protection…canvas × 2

Device22

Operating system…userAgentData

Browser…userAgentData.brands

CPU architecture……architecture · bitness

Screen…screen · devicePixelRatio

Refresh rate…requestAnimationFrame

Screens…screen.isExtended · screenX

Window…innerWidth · availHeight

Graphics card…WebGL RENDERER

WebGPU…navigator.gpu adapter.info

WebGL capabilities…WebGL2 · MAX_TEXTURE_SIZE

CPU cores…hardwareConcurrency

Memory…navigator.deviceMemory

Touch and pointer…maxTouchPoints · pointer

Battery…navigator.getBattery

Connection…navigator.connection

Cameras and mics…enumerateDevices

Audio hardware…AudioContext.sampleRate

Biometrics…PublicKeyCredential

Bluetooth…bluetooth.getAvailability

Video codecs…MediaSource.isTypeSupported

DRM…requestMediaKeySystemAccess

Storage quota…storage.estimate

Browser settings14

Color scheme…prefers-color-scheme

Animations…prefers-reduced-motion

Display colors…color-gamut · dynamic-range

Accessibility…prefers-contrast · forced-colors

Opened as…display-mode

Privacy signals…doNotTrack · GPC

Cookies…navigator.cookieEnabled

Permissions…permissions.query

PDF viewer…pdfViewerEnabled

Automation…navigator.webdriver

Ad blocker…bait element

Extensions…window.ethereum · DOM marks

Tab history…history.length

Installed fonts…canvas measureText