Storage Partitioning & Cross-Site Isolation Tester

Modern browsers isolate high-performance pages via COOP/COEP and partition third-party storage to prevent cross-site tracking. This tool probes your current execution context to reveal whether you're cross-origin isolated, whether SharedArrayBuffer is unlocked, and how storage partitioning applies to you.

Privacy, Security & Web APIs 100% Local All probes run in the current context. Nothing is transmitted.

The test runs automatically and reflects this page's context. To observe third-party storage partitioning, load this tool inside a cross-origin iframe.

What Is Cross-Origin Isolation?

When a page sends COOP: same-origin and COEP: require-corp, the browser sets window.crossOriginIsolated = true, unlocking SharedArrayBuffer, high-resolution timers, and performance.measureUserAgentSpecificMemory().

What Is Storage Partitioning?

Browsers key storage by (top-level site, current frame site). A third-party iframe gets a separate storage bucket from the same site loaded top-level, preventing cross-site tracking.

Timer Precision

To mitigate Spectre-style attacks, browsers reduce performance.now() precision unless the page is cross-origin isolated. Measuring precision reveals isolation status independently.

Introduction

High-performance web features like multithreading via Web Workers and SharedArrayBuffer are gated behind cross-origin isolation. Meanwhile, storage partitioning silently changes how third-party storage behaves. Both are hard to observe — this tool makes them visible.

How It Works

Reads window.crossOriginIsolated and window.isSecureContext.
Attempts to instantiate a SharedArrayBuffer to confirm availability.
Samples performance.now() to measure timer precision.
Queries document.hasStorageAccess() and detects iframe nesting.
Reads the storage quota via navigator.storage.estimate().

Privacy

All probes run locally in the current browsing context. No content is transmitted. No API calls, no tracking.

Limitations

Cannot test third-party partitioning from a top-level page — the tool must be embedded in a cross-origin iframe to observe it.
Cannot read the actual COOP/COEP response headers; it infers isolation from observable behavior.
Timer precision thresholds vary by browser and version.

FAQ

Why is SharedArrayBuffer unavailable?

SharedArrayBuffer requires a cross-origin isolated context. Add Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp response headers.

Does storage partitioning affect my top-level site?

No — partitioning affects third-party contexts (iframes). Your top-level storage is unchanged, but any embedded third-party widgets get their own partitioned storage.

Is my data uploaded?

No. Everything runs locally in your browser. Nothing is transmitted.

Related Tools

Version and changelog

Version: 1.0.0
Last updated: August 13, 2026
Changelog: Initial production release.