Privacy
A DNS tool that quietly tracked you would be self-defeating. Here is exactly what happens when you run a check.
No third-party scripts
This site loads no analytics, no tag managers, no advertising scripts, no fonts from a CDN and no icon stylesheets from a CDN. There is nothing on the page that reports your visit to anyone.
Country flags are rendered as Unicode emoji by your own operating system rather than fetched as images, so viewing a result does not tell an image host your IP address.
What we store when you run a check
Nothing. A check runs entirely in memory and the result is discarded when you close the tab. There is no account, no cookie and no session record.
Server logs may contain request metadata as a normal function of hosting, but no scan result is written to a database unless you explicitly create a share link.
What a share link stores
Only if you press "Share this result". Your public IP address is truncated before it is saved — the final segment is replaced, so 203.0.113.47 becomes 203.0.113.x. The full address is never written to the database.
The resolver addresses themselves are kept in full. Those are infrastructure addresses belonging to DNS services, not to you.
Also stored: your ISP name, ASN and country, the observed resolvers, the expected-vs-actual comparison and the behavioural test results.
Share links expire automatically 30 days after creation, after which the row is unreadable through the API.
Third parties involved in a check
bash.ws operates the authoritative nameserver that observes which resolver looks up your probe hostnames. They necessarily see those lookups — that is the measurement. A serverless app cannot bind UDP port 53, so this step has to be delegated.
ip-api.com is queried from our server, not your browser, to turn IP addresses into ISP, ASN and city. Your IP is sent to them as part of that lookup.
The behavioural tests request known test hostnames such as sigok.verteiltesysteme.net and internetbadguys.com. Those requests come from your browser and reach whoever operates those domains.
The method is published
Every test states what it did and how it could be wrong, inline with the result. The behavioural tests are labelled indicative because a browser cannot read DNS responses directly — only whether a request succeeded.
We do not infer what kind of service a resolver is. An IP address cannot tell you whether a resolver belongs to a VPN, a filtering service or someone’s home server, so we report the operator name and network and stop there.