From navigator.plugins property
The navigator.plugins property returns a list of plugins installed in the browser. In the past, this revealed installed software like Flash Player, Java, Silverlight, and PDF viewers. However:
Browser plugins (NPAPI) have been deprecated and removed from all modern browsers. Most browsers now return an empty plugins list or fake data. This page documents historical context and why it was a privacy concern.
Browser plugins (NPAPI - Netscape Plugin API) were introduced in the mid-1990s to extend browser capabilities beyond basic HTML. They allowed third-party software to run inside web pages.
Purpose: Animations, games, video playback, interactive content
Peak popularity: Installed on 90%+ of computers in the 2000s
Sunset: Adobe ended support December 31, 2020
Why it died: Security vulnerabilities, poor mobile support, replaced by HTML5
Purpose: Run Java applications in the browser
Use cases: Banking websites, enterprise apps, educational software
Why it died: Constant security patches, slow performance, replaced by JavaScript
Purpose: Rich Internet Applications, video streaming (Netflix used it)
Why it died: HTML5 video made it obsolete
Purpose: View PDFs directly in browser
Status: Replaced by native browser PDF viewers
| Year | Event |
|---|---|
| 2015 | Chrome disables NPAPI plugins by default |
| 2016 | Chrome removes NPAPI support entirely (except Flash) |
| 2017 | Firefox 52 removes all plugins except Flash |
| 2020 | All browsers remove Flash support |
| 2021 | navigator.plugins effectively deprecated |
Typical result: navigator.plugins.length = 5
Fake plugins reported:
Note: These aren't real NPAPI plugins—they're built-in features reported for backward compatibility
Typical result: navigator.plugins.length = 0
Privacy mode: Always returns empty array in privacy-focused configurations
Typical result: navigator.plugins.length = 0-2
May include: Built-in PDF viewer
In the old days, navigator.plugins would reveal every installed plugin:
// Example from Firefox circa 2010
navigator.plugins[0].name = "Shockwave Flash"
navigator.plugins[1].name = "Java Deployment Toolkit"
navigator.plugins[2].name = "Adobe Acrobat"
navigator.plugins[3].name = "QuickTime Plug-in"
navigator.plugins[4].name = "Windows Media Player"
// ... potentially dozens moreUse case: Check if Flash was installed before loading Flash content
// Historical code (no longer relevant)
function hasFlash() {
const plugins = navigator.plugins;
for (let i = 0; i < plugins.length; i++) {
if (plugins[i].name.indexOf('Flash') !== -1) {
return true;
}
}
return false;
}Use case: Determine if browser could display PDFs
Modern approach: All browsers have built-in PDF viewers now
Use case: Check for Java, Silverlight, or other plugin support
Modern approach: Use HTML5 APIs and progressive enhancement
<video> tag| Browser | navigator.plugins.length | Behavior |
|---|---|---|
| Chrome | 5 (fake) | Reports built-in features as "plugins" for compatibility |
| Firefox | 0 | Returns empty array |
| Safari | 0-2 | May report PDF viewer |
| Edge | 5 (fake) | Same as Chrome (Chromium-based) |
| Mobile Browsers | 0 | Never supported plugins |
Steve Jobs famously blocked Flash from iOS in 2010, citing:
Apple's decision to block Flash accelerated the shift to HTML5. Within 10 years, Flash was completely dead.
Plugin fingerprinting was one of the most powerful tracking techniques before plugins were deprecated. Today, it's mostly irrelevant.
Every user had a different set of installed plugins:
// Example historical fingerprint
User A: Flash, Java, Acrobat, QuickTime
User B: Flash, Silverlight, RealPlayer
User C: Flash only
// Each combination = unique identifierWith 10+ common plugins, the combinations were nearly infinite, making almost every user uniquely identifiable.
Plugins reported exact version numbers:
Version variations multiplied the uniqueness factor
Plugin enumeration revealed installed software:
Here's how plugin fingerprinting worked:
Plugin fingerprinting is largely dead because:
The death of browser plugins is one of the biggest privacy improvements in web history. Removing plugins eliminated a massive fingerprinting vector.
Since real plugins no longer exist, there's nothing to control. However, for completeness:
When plugins were still a thing, privacy-conscious users would:
Strategy: Always reports navigator.plugins.length = 0
Effect: No fingerprinting via plugins
Strategy: Returns fake plugin list (same as Chrome)
Effect: Blends in with Chrome users
Enable: about:config → privacy.resistFingerprinting = true
Effect: Returns empty plugins array
If you're stuck on an old browser that still supports plugins:
Old browsers with plugin support are vulnerable to malware and exploits. Update immediately!
<canvas>, WebGL<video> with MP4/WebM