# Have We Met? How a Website Knows You Came Back By Suraj Mondem · Published 2026-11-02 · 11 min read Original: https://www.mondemsuraj.com/writing/have-we-met > No cookie, no sign-in, no name. A website can still count you as one person, and some can recognise you next week. Here's how the counting works on my site, and how far the same trick can go. Part 1 ended on a question. Say you open my article three times. That's three notes, three views. But it's still just you. So how would a website know those three notes came from the same person, when it never asked your name? The first time I saw "unique visitors" sitting next to "views" on my own dashboard, I was kind of curious about it. How could it tell people apart? My site doesn't set cookies. Nobody signs in. And yet my dashboard has a number for people, not only for views. I wanted to know where that number comes from, and how far the same idea can be pushed. This post walks from the gentle end of that idea to the uncomfortable end. First, what my own counter writes down and how it counts people without knowing them. Then what happens when a site decides to remember. ## The shop owner's problem Back to the shop from part 1. The owner has a clicker at the door, and it counts entries just fine. What it can't do is tell faces apart. There are really only three ways the owner could recognise a regular. 1. Hand out a loyalty card. Every time you come in, you show the card. That's a **cookie**: a small label the site hands your browser and asks for back next time. You can throw the card away, and in most places the shop has to ask before handing it to you. 2. Jot down a rough description at the door. "Red jacket, phone in hand, came from the mall side." Then tear the page out at midnight. Today the owner can tell you walked in three times. Tomorrow you're a stranger again. 3. Remember your face. No card, no notebook to tear out. You walk in next month and the owner knows it's you. Part 3 is about the loyalty card. This post is about the other two, because neither one needs a cookie, and neither one needs your name. My site uses the second one. Let me show you what goes in the notebook. ## What my counter actually writes down In part 1, the box at the end listed what your browser tells any page you open. That was the raw material. Here's what my counter actually keeps from it, plus what it learns by watching how you read. For every visit, the note that reaches my dashboard can say: - Which page you opened, and when. - Where you came from: LinkedIn, Google, an email, or nothing at all. - Your country. Just the country, worked out from where your request entered the network. - What kind of device: phone, tablet or computer. Which browser and system, in broad buckets: "Chrome on Android", never "Chrome 131 on a Pixel 8". - How far you scrolled, at 25, 50, 75 and 100 percent. - How long you actually read. The clock only runs while the tab is visible and you've scrolled, typed or tapped in the last 30 seconds. Leave the tab open and walk away, and it stops. - Whether you "read" the post. On my site that means you got 75% of the way in and spent a reasonable amount of time getting there. A fast scroll to the bottom is a view, not a read. - How fast the page loaded on your device. That's already more than "someone showed up." It's the third step of the ladder from part 1: not just where you came from, but what you did. Here's what it doesn't have. - No cookie. The only thing my script ever stores in your browser is an off switch, if you ask for one. - No name, no email, no account. - No exact location. Country, and that's it. - No IP address. More on that in a second, because it's the clever part. - No link to other sites. What you do here stays here. > **Interactive: What my counter writes down.** One example visit as it reaches my dashboard: the page, where the visit came from, the country, a coarse device and browser, how far the reader scrolled, time spent reading, whether it counts as a read, and how fast the page loaded. Beside it, what the counter never sees: a name or email, a cookie, the IP address, an exact location, other sites. Example values. ## Counting people without knowing them Here's the trick behind the "people" number. When your note arrives, the counting service takes four things: your network address (your **IP address**, roughly where on the internet your request came from), your browser's ID string, my site's name, and a random secret that only exists for today. It runs them through a **hash**. A hash is like a blender. Put the same ingredients in and you always get the same smoothie. But you can't pour the smoothie back out into strawberries and bananas. Same inputs, same code. No way back to the inputs. So your three visits today all produce the same code. My dashboard sees one code three times and says: one visitor, three views. It never learned who you are. It only learned that the same browser on the same network came back. On my site, even the network address gets disguised before it leaves my server. The counting service gets a stand-in that works for matching, never the real address. So when my dashboard says something like 38 views from 14 people, that 14 is a count of codes, not of names. Then midnight comes, and the day's secret is thrown away. Tomorrow there's a new secret, so the same you produces a completely different code. You're a stranger again. That's the torn-out page from the shop. > **Interactive: The daily visitor code.** Four made-up ingredients (a network address, the browser, the site and that day's secret) go through a hash and come out as a short code. Opening the page again on the same day gives the same code, so it counts as one visitor. Switching networks or moving to the next day gives a new code, so the same person counts again. It has costs, and I'd rather say them out loud. - I can't tell you came back tomorrow. "New vs returning" only works within one day. - Two people in the same office, on the same Wi-Fi, with the same phone and browser, can blur into one visitor. - Weekly and monthly "people" numbers are really sums of daily ones, so they run high. I'm fine with all three. I want to know if people read, not who they are. I'm not the only one doing this. Plausible, a privacy-focused analytics tool, builds its daily visitor code from almost the same ingredients: a daily secret, the site, the IP address and the browser string, with the secret deleted every 24 hours. PostHog, the tool behind my dashboard, has a cookieless mode that works the same way. The beacon posts to `/ingest/batch` on my own domain. That route runs on Vercel and forwards events to PostHog in cookieless server hash mode. The route never forwards your real IP. It replaces it with a keyed pseudonym: an HMAC-SHA256 of the client IP with a secret only the server holds, written as an address in the private `fd00::/8` range. PostHog uses that value only as one input to its daily hash, then deletes it before storing the event. The route also drops bots by user agent, sets the country from Vercel's `x-vercel-ip-country` header, buckets device, browser and OS, and strips every query parameter except `utm_*`. Nothing is sent from previews, under automation, with Global Privacy Control or Do Not Track on, or after `?notrack`. The trade-off is in PostHog's own docs: the salt rotates daily, so uniques are daily uniques. ## Now take away the midnight So far, this is the gentle version. The notebook gets torn out every night, and the IP address, the one ingredient that really points at you, is thrown away. Now imagine a site that doesn't do either. It skips the daily secret, so your code stays the same tomorrow. And it stops relying on your IP address, because that changes every time you move from home Wi-Fi to mobile data. Instead it builds the code from things that stay put on your device. You've seen most of them already, in the box at the end of part 1: - Your screen size and how sharp it is. - Your language and time zone. - Your browser and system. - The fonts installed on your machine. - How many processor cores you have, and roughly how much memory. And a few you didn't see. The cleverest one is canvas. A page quietly draws a small hidden image, some text and a few shapes, and reads it back. Your graphics chip, drivers and fonts each draw it very slightly differently. Different enough that the result works like a signature. Put all of those through a hash and you get a **fingerprint**: a code for your device, built from what it says about itself. That's the shop owner remembering your face. > **Interactive: Your browser's fingerprint.** Your browser's traits (browser and system, the full browser ID, screen, time zone, languages, processor cores, memory, touch points and how it draws a hidden image) combined into one short code. Untick a trait to see the code change. It is worked out in your browser, nothing is sent or saved, and this site never uses it to recognise you. Here's what makes it different from a cookie. - There's nothing to delete. A cookie lives in your browser, so you can clear it. A fingerprint is worked out fresh every time you visit. - Private mode barely helps. Your screen, fonts and graphics chip are the same in a private window. - You can't see it happen. There's no banner, because nothing is being stored on your device. ## How unique are you, really? This is the part I didn't expect. It depends a lot on who you are. In 2016, researchers behind a site called AmIUnique collected fingerprints from 118,934 browsers. 90% of the desktop fingerprints were unique. On phones, 81% were. Two years later, some of the same researchers ran a much bigger study, about 2 million fingerprints from visitors to a large French website. This time only 33.6% were unique. Why the gap? The first study's visitors chose to test themselves, and people who do that tend to have unusual setups. The second study caught ordinary people. And ordinary phones look a lot alike. Two people with the same iPhone model, the same iOS version and the same default settings are hard to tell apart. So the honest answer is: the more ordinary your device, the better you blend in. A gaming PC with custom fonts stands out. A standard phone with default settings hides in the crowd. Fingerprints aren't perfect either. They drift. Update your browser, plug in a second screen, install a font, and the code changes. Serious trackers deal with that by matching "close enough" fingerprints together. > **Interactive: Finding one phone in a crowd.** An illustration, not data: 100 phones, and each trait added (screen size, language, time zone, fonts, how it draws a hidden image) leaves fewer that match, 38, 21, 9, 3, then 1. ## Who actually does this? Not every fingerprint is sinister. Banks use device fingerprints to spot a login from a device you've never used. Sites use them to block bots and fraud. That's the fingerprint working for you. Advertising is where it gets uncomfortable. In December 2024, Google announced that from 16 February 2025, advertisers using its platforms would be allowed to use fingerprinting. The UK's data protection regulator, the ICO, called the change "irresponsible" and said fingerprinting still needs consent and transparency under the law. Browsers are pushing back. Safari, Firefox and Brave all ship protections that blur or hide some of these details, so fingerprints come out less unique. It's an arms race, and it's still going. ## Where I drew the line Here's how the three ways of recognising someone compare. > **Interactive: Three ways a site can tell you came back.** A cookie (a loyalty card) remembers you for days to years, can be cleared, can work across sites and usually asks first. A daily code (a torn-out page, what this site uses) lasts one day, clears itself at midnight, stays on one site and needs no consent. A fingerprint (your face) lasts until your device changes, cannot be cleared, can work across sites, and should ask first but rarely shows it. My counter sits in the middle column. It uses some of the same ingredients a fingerprint would, but it buckets them, mixes in a secret that dies every night, and never computes a fingerprint at all. The ingredients are the same. What makes a counter or a tracker is what you do with them. ## What to remember from part 2 - A website can count people, not just views, without a cookie or a name. - The polite way is a daily code: same browser, same day, same code. At midnight it forgets. - The other way is a fingerprint: a code built from what your device says about itself. It doesn't forget, and you can't clear it. - How unique you are depends on how ordinary your device is. - Before trusting a "privacy-friendly" label, ask one thing: does it forget? A counter forgets you at midnight. A fingerprint doesn't. ## The card you agreed to Everything in this post happened without a single cookie and without you clicking anything. Now think about the last time a banner asked if you'd "Accept all." You probably clicked it. Most of us do. That button hands you the loyalty card. And unlike my notebook, it doesn't stay in one shop. It can follow you to the next site, and the one after that, until your feed seems to know what you were thinking about before you searched for it. What does that card actually say about you, and who gets to read it? That's part 3.