# Geospoof: a firefox add-on for convenient geolocation privacy **URL:** https://discuss.privacyguides.net/t/geospoof-a-firefox-add-on-for-convenient-geolocation-privacy/36159 **Category:** Project Showcase **Created:** 2026-03-10T18:20:47Z **Posts:** 137 ## Post 1 by @sgro — 2026-03-10T18:20:47Z ### Website > **[GeoSpoof — Spoof your browser location & timezone](https://www.geospoof.com)** > > GeoSpoof overrides your browser geolocation, timezone, and WebRTC APIs so websites see exactly where you want them to. ![screenshot2](https://forum-uploads.privacyguidesusercontent.com/original/3X/2/b/2b4a91dff329d658106838bcddbef5df7ce29840.png) ### Short Description **Disclosure:** I am the developer :slight_smile: Your browser leaks your location through multiple channels: the Geolocation API, timezone offsets, `Intl.DateTimeFormat`, and WebRTC. You get almost no control over it. A VPN changes your IP, but these signals still point right back to where you’re sitting. GeoSpoof is a browser extension that spoofs your geolocation, timezone, and WebRTC to prevent websites from identifying your real location. Set your location to match your VPN, mismatch it on purpose for extra obfuscation, or pick somewhere entirely different. GPS coordinates, timezone, `Intl` locale data, and WebRTC all stay in sync with whatever you choose. **Now Available on:** - [Firefox (desktop + Android)](https://addons.mozilla.org/firefox/addon/geo-spoof/) - [Chrome / Brave / Edge](https://chromewebstore.google.com/detail/geospoof/dgdbdodafgaeifgajaajohkjjgobcgje) - [Safari (iOS, iPadOS & macOS)](https://apps.apple.com/app/geospoof/id6765719745) Open source: [https://www.github.com/anthonysgro/geospoof](https://www.github.com/anthonysgro/geospoof) #### Features: - Works on Firefox, Chrome, Brave, Edge, and Safari across desktop, Android, iOS, and iPadOS - Spoof geolocation API with any coordinates - VPN Region Sync (auto-detect your VPN exit and match your location to it) - Automatic timezone spoofing based on location - WebRTC IP leak protection - Search locations by city name or enter coordinates manually - Toggle protection on/off easily **It does NOT:** - Track your browsing activity - Collect analytics or telemetry - Store data on external servers Some features (city search, VPN sync) make network requests to third-party APIs to function. See the [docs](https://github.com/anthonysgro/geospoof?tab=readme-ov-file#external-services) for details --- ## Post 2 by @parkerchandler1979 — 2026-03-10T18:36:48Z Can you explain if installing and using this will have any impact on browser fingerprint? Or does it not really matter in your view if this is randomizing it all every browsing session/every time you restart your browser? Also clarify if this is going to be randomizing all that it will be spoofing (cause I’d really like that and would be an obvious ask to further the obfuscation efforts). --- ## Post 3 by @sgro — 2026-03-10T18:42:55Z There is no randomization feature as of now. Today the user can either A) provide explicit latitude and longitude values or B) provide a geographical place via the [Nominatim api](https://nominatim.org/). The extension then injects a script into your browser that overrides the browser geolocation/timezone/WebRTC apis so websites can only see the value you set. I think a randomization feature would be pretty neat. I would love to know the things you care about regarding geolocation fingerprinting, how often you would like to randomize locations, maybe an “anywhere BUT x, y…” filter, etc. --- ## Post 4 by @parkerchandler1979 — 2026-03-10T18:45:06Z I just installed it. I see how it it works now. I have tested the three options you link to in the extension itself. I am however on Mullvad and while Time Zone and Geolocation is matching the location I chose, WebRTC page is showing my VPN location. Is this how it’s supposed to work or is it meant to provide obfuscation primarily when not on a VPN? --- ## Post 5 by @parkerchandler1979 — 2026-03-10T18:48:22Z > [@sgro](#): > > I would love to know the things you care about regarding geolocation fingerprinting, how often you would like to randomize locations, maybe an “anywhere BUT x, y…” filter, etc. Well, I ask this because if I am visiting a website everyday, the website can still try to infer from my browser fingerprint that it is me (hence my first question above). However, if I select or provide a few options within the extension, then ideally I’d want GeoSpoof to randomize between those selected preferred locations upon every browser reboot/browsing session. Alternatively, it’d be very cool to have it change the location after a set number of hours that we select. For example: location is changed every 4 hours. These are just ideas I am having for such a tool as it would only further what GeoSpoof is trying to do. No? --- ## Post 6 by @parkerchandler1979 — 2026-03-10T18:51:42Z More observations: other websites that tell you your geolocation and IP address and whatnot are providing mixed results. Some are showing the one I selected and others are showing my VPN location ( I use Mullvad btw, if that makes any difference). --- ## Post 7 by @sgro — 2026-03-10T18:56:01Z > I have tested the three options you link to in the extension itself. I am however on Mullvad and while Time Zone and Geolocation is matching the location I chose, WebRTC page is showing my VPN location. Is this how it’s supposed to work or is it meant to provide obfuscation primarily when not on a VPN? Yes, so basically WebRTC is a backdoor that allows websites to see your true IP address even if you are on VPN. WebRTC is allowed to bypass the standard HTTP proxy/VPN settings to ask your operating system for its local and public IP addresses. So consider the example where you live in Los Angeles, set your VPN to Tokyo, and set Geospoof to Berlin: 1. **Without WebRTC Protection:** A website can detect your true IP address is in Los Angeles. 2. **With GeoSpoof’s WebRTC Protection:** A website will not be able to see your true IP address, they will only see Tokyo. WebRTC does not impact the geolocation apis in the browser (the ones you set to Berlin). Moreover the general point is that your IP address is fundamentally different from your browser’s declared Geolocation API (and timezone etc). This extension cannot (and doesn’t claim to) obfuscate your IP address. If a website deduces your location from your IP address, Geospoof will have **no effect**. However, if a website deduces your location from your geolocation or timezone browser api, your VPN will have no effect (and you will need Geospoof). My original use case was for users to be able to set their VPN and Geospoof settings to the same location so that they could successfully convince any website of a manually selected location. I hope this clears up any confusion --- ## Post 8 by @sgro — 2026-03-10T18:57:57Z > More observations: other websites that tell you your geolocation and IP address and whatnot are providing mixed results. Some are showing the one I selected and others are showing my VPN location ( I use Mullvad btw, if that makes any difference). This is most likely because some websites are determining your location via IP address, some are determining your location via the geolocation apis. Sophisticated sites use a combination, date/timezone api, offset, Daylight savings time, etc. The original intention of this extension was to align your Browser geolocation to your VPN IP so that all locations you are emitting are synchronized. --- ## Post 9 by @parkerchandler1979 — 2026-03-10T19:04:41Z > [@sgro](#): > > This extension cannot (and doesn’t claim to) obfuscate your IP address. Sorry for the dumb question but then how are you defining spoofing in your tool? I mean, how are you seeing and prefer people see and understand the difference between your tool and what a VPN does? I’m guessing the means through which both try to obfuscate your IP/location is different and that’s how? > [@sgro](#): > > However, if a website deduces your location from your geolocation or timezone browser api, your VPN will have no effect (and you will need Geospoof). Assumption being that IP address and your time zone being different means you’re in the time zone and not really with that VPN IP address. So, I would not say the VPN has no effect but the VPN does not stop the website from inferring this info. Slight difference but an important distiction if you ask me. > [@sgro](#): > > My original use case was for users to be able to set their VPN and Geospoof settings to the same location so that they could successfully convince any website of a manually selected location. Hah! That’s literally what I was thinking too - as to the real use case for such a tool. --- ## Post 10 by @parkerchandler1979 — 2026-03-10T19:08:21Z > [@sgro](#): > > Yes, so basically WebRTC is a backdoor that allows websites to see your true IP address even if you are on VPN. WebRTC is allowed to bypass the standard HTTP proxy/VPN settings to ask your operating system for its local and public IP addresses. So consider the example where you live in Los Angeles, set your VPN to Tokyo, and set Geospoof to Berlin: > > 1. **Without WebRTC Protection:** A website can detect your true IP address is in Los Angeles. > 2. **With GeoSpoof’s WebRTC Protection:** A website will not be able to see your true IP address, they will only see Tokyo. Thank you for this clarification. I was confused about this for a minute. I’m still learning about privacy so WebRTC, Secure DNS, VPNs, and other things your tool uses still confuse me as to how they all work and with each other especially. I always check on Mullvad if I have WebRTC protection. I always do. --- ## Post 11 by @sgro — 2026-03-10T19:12:18Z > how are you defining spoofing in your tool? I mean, how are you seeing and prefer people see and understand the difference between your tool and what a VPN does? I’m guessing the means through which both try to obfuscate your IP/location is different and that’s how? spoof = user can set browser values to anything they want in accordance with privacy rights and device ownership. Your other questions: this is good feedback because I think I need to make the distinction clearer to people. Your VPN is not fullproof. You know how you go to a website and it KNOWS you have a VPN on? That is because websites detect inconsistencies in your IP address, WebRTC true IP, browser geolocation apis, timezone, daylight savings time settings, etc. A VPN alone is not enough to fully mask your location. At the end of the day, if you want to mask your location, you need both: 1. A VPN to reroute your IP address to a different location 2. GeoSpoof to reroute your browser’s geolocation and timezone apis to a different location 3. WebRTC is common in VPNs as a network-level feature, but GeoSpoof ensures that the browser knows WebRTC protection is on. If you are missing one or the other your location is not truly masked --- ## Post 12 by @parkerchandler1979 — 2026-03-10T19:17:42Z Thank you for the clarification again. That’s what I was thinking too but it’s good to have confirmation from someone much more knowledgeable on the matter. Btw, reading your Github and using and testing GeoSpoof, I’m really liking it. It does indeed resolve the issue VPN falls short on. I’ll buy a coffee with that link you have once I get paid later this month. My main concern going forward using GeoSpoof: 1. Longevity. Open source products are not always sustainable and last for years one end. Few can make that promise and stick with it. How do you see/respond to such a concern? I’d like this tool to be maintained for years on end without worrying about it becoming deprecated some time in the future. Are you going to be able to ensure of this? I am no developer but I’m guessing it is made simply and doesn’t take too much to keep up with it? --- ## Post 13 by @parkerchandler1979 — 2026-03-10T19:19:14Z Lastly, I hope you take the suggestion for it auto selecting and randomizing location. It would be even better coupled with a VPN for all your spoofing and obfuscation needs/wants. Thank you for engaging with me here. I look forward to the community auditing your tool as best as they can for a more final verdict (not that I don’t trust you and your promises being made with it). --- ## Post 14 by @sgro — 2026-03-10T19:25:29Z > Longevity. Open source products are not always sustainable and last for years one end. Few can make that promise and stick with it. How do you see/respond to such a concern? I’d like this tool to be maintained for years on end without worrying about it becoming deprecated some time in the future. Are you going to be able to ensure of this? I am no developer but I’m guessing it is made simply and doesn’t take too much to keep up with it? This is a classic problem for open source products, you are correct. While I cannot guarantee I won’t get hit by a bus tomorrow (knock on wood), I can say I fully intend on maintaining this project because I use it myself :sweat_smile: At its core, Geospoof is a very lightweight extension and quite maintainable (modern tooling, thorough unit/integration tests, etc) so others can contribute as well. --- ## Post 15 by @parkerchandler1979 — 2026-03-10T19:27:25Z Excellent. Thank you again. I know you don’t have such incentives with an open source project like this, but please be mindful of enshittification. That’s the only other concern I have. We’d all still like to have at-least some nice things in the future too, as bleak as it is appearing to be. --- ## Post 16 by @parkerchandler1979 — 2026-03-10T19:40:39Z I think you missed my very first question about impact on browser fingerprinting with this extension. Please clarify on that as well. I didn’t catch that until now as I was busy testing the tool while commenting promptly. --- ## Post 17 by @privacy.slouchy — 2026-03-10T19:42:58Z > [@sgro](#): > > WebRTC is a backdoor that allows websites to see your true IP address even if you are on VPN It seems WebRTC spoofing is a main feature of the tool - can you speak more towards that threat vector? How is WebRTC traffic a more vulnerable and potent source of IP leakage than any other kind of traffic? What kind of ‘backdoor’ is inherent to WebRTC, but absent from REST, SOAP, gRPC, Webhooks, or GraphQL traffic? --- ## Post 18 by @sgro — 2026-03-10T19:43:47Z I am not super knowledgable on fingerprinting but my guess is this has very little effect one way or another. But if you set your geolocation to a very lowly populated city, I suppose that would make you more unique than if you set it to a megacity. But to be honest there are so many javascript attributes someone could use to de-anonymize you that the ones my extension changes will probably have little effect. --- ## Post 19 by @any1 — 2026-03-10T19:50:30Z > [@sgro](#): > > But if you set your geolocation to a very lowly populated city, I suppose that would make you more unique than if you set it to a megacity. I still don’t understand the reason behind “spoofing” your location when it is behind a prompt. --- ## Post 20 by @sgro — 2026-03-10T19:57:47Z > How is WebRTC traffic a more vulnerable and potent source of IP leakage than any other kind of traffic? What kind of ‘backdoor’ is inherent to WebRTC, but absent from REST, SOAP, gRPC, Webhooks, or GraphQL traffic? WebRTC traffic is designed to find and communicate with unknown peers as a P2P protocol. The goal is to connect two people (ex: like a video call) without a server bridging the gap. To support this, the browser has to bypass any firewall or router etc. To find the shortest path between peers, WebRTC uses [ICE (Interactive Connectivity Establishment)](https://en.wikipedia.org/wiki/Interactive_Connectivity_Establishment). This protocol is allowed to bypass standard proxies and can directly ask your computer “what is your ip address”. So with standard traffic protocols (REST, gRPC, etc) the browser sends a TCP packet to the VPN tunnel and the VPN sends it to the server. With WebRTC, my understanding is that the browser sends a UDP package to a [STUN server (Session Traversal Utilities for NAT)](https://en.wikipedia.org/wiki/STUN) hosted by Mozilla or Google or even whichever website you are on can inject a STUN server for `stun.malicious-marketing.com`. This packet literally just bypasses the VPN tunnel and exposes your real IP address. The browser can leverage this to get your true IP address just by running some javascript on your device. --- ## Post 21 by @sgro — 2026-03-10T20:03:14Z > I still don’t understand the reason behind “spoofing” your location when it is behind a prompt. Yes, absolutely. If you do not want any location-dependent services, feel free to continue to decline location permissions. However, GeoSpoof is for when you want to appear in a specific location. Example: modern websites are very very suspicious, so if you use a VPN to appear in Tokyo but block the geolocation prompt, the website will see a conflict: - IP Address: Tokyo - Geolocation API: Access denied - Timezone: Los Angeles (EST) - WebRTC: Los Angeles IP Address Many websites will block the legitimate use of digital services because of these inconsistencies. Some websites literally will not work unless you grant geolocation access. Spoofing is the only way to satisfy the website’s technical requirements for location while still maintaining your privacy. --- ## Post 22 by @any1 — 2026-03-10T20:04:28Z > [@sgro](#): > > Some websites literally will not work unless you grant geolocation access. I have never heard of this before. Got any examples of sites that require geolocation? --- ## Post 23 by @parkerchandler1979 — 2026-03-10T20:11:27Z Few problems: 1. Testing it more. Noticing an issue. On every YT page, it says to refresh the page to apply protection. Does not work after refreshing and even a browser restart. 2. How soon upon opening a new page or a website from clicking a link does GeoSpoof begin working? How can one be sure GeoSpoof isn’t “leaking” or taking more time than needed to do its job because it kinda defeats the whole purpose if it works less than 100% of the time properly. 3. Also noticing that the extension frequently gives me the “error” with a yellow exclamation on the icon and then to green. It also sometimes upon the first loading of the page stays on with the error asking to refresh the page. Doesn’t it already defeat the purpose even if it works after? Please check on your end for these bugs if you can reproduce them. I’m seeing these often. It would also be nice to see what exactly it was unable to spoof if there’s an error. --- ## Post 24 by @sgro — 2026-03-10T20:17:44Z > I have never heard of this before. Got any examples of sites that require geolocation? Many, many examples such as live sports, television stremaing, some regulated industries like futures trading, gambling, banking, crypto. Digital services that require geolocation such as uber, doordash, instacart, etc. Also web development for quality-assurance testing actual customer workflows that depend on specific geolocations. To be completely transparent, you have a right to privacy and to change data on your own device. Using this tool is not illegal _unless used to commit actual fraud, identity theft, bypassing international sanctions, etc._ I absolutely **do not endorse any illegitimate or illegal use of this tool** , this is purely in the interest of legitimate privacy use and development purposes. --- ## Post 25 by @sgro — 2026-03-10T20:22:55Z Looking into this, thank you for reporting and being an early user. I can reproduce this on my end as well, I’ll work on a fix this evening Edit: I hit the daily limit on new member posts but I’ll be posting updates for this bug on [[Bug] Extension displaying caution badge often · Issue #2 · anthonysgro/geospoof · GitHub](https://github.com/anthonysgro/geospoof/issues/2) --- ## Post 26 by @parkerchandler1979 — 2026-03-10T20:24:52Z Thank you. Opening many of my bookmarks one after an other and randomly. It consistently doesn’t appear to work on the first web page load of any website and on some not at all. That’s enough testing for tonight. Will see more tomorrow. And will let you know here so you can keep improving. --- ## Post 27 by @parkerchandler1979 — 2026-03-10T21:42:22Z > > > Bug report: > > > Testing it more. Noticing an issue. On every YT page, it says to …refresh the page to apply protection. Does not work after refreshing and even a browser restart. > > > How soon upon opening a new page or a website from clicking a link does GeoSpoof begin working? How can one be sure GeoSpoof isn’t “leaking” or taking more time than needed to do its job because it kinda defeats the whole purpose if it works less than 100% of the time properly. > > > Also noticing that the extension frequently gives me the “error” with a yellow exclamation on the icon and then to green. It also sometimes upon the first loading of the page stays on with the error asking to refresh the page. Doesn’t it already defeat the purpose even if it works after? > > Tracking issue here Good lord you’re fast! Darn you though, given the swift response and fix I’m now only compelled to bump up my donation when I make it. I encourage others to donate if you can spare a few. This seems like its definitely going to be a permanent addition to my extension list. The opportunity cost may as well be too high to not use especially with a VPN. --- ## Post 28 by @Protagonist — 2026-03-11T14:10:50Z Hi Was browsing and stumbled upon this. Made an account here to just say thanks for making this. Having been trying it for the past couple of hours and it works well. Kinda fixes the problem VPNs can’t. I do wish there was a Chromium version of this to be used on Brave or Helium. But since it’s brand new, I understand if that may take time. And reading this thread, glad to learn that you plan on keep maintaining it. Also surprised Mullvad Browser doesn’t have this built in especially when you’re using it coupled with Mullvad VPN. --- ## Post 29 by @any1 — 2026-03-11T14:17:22Z > [@Protagonist](#): > > Also surprised Mullvad Browser doesn’t have this built in especially when you’re using it coupled with Mullvad VPN. Since this will interfere with the protections Mullvad Browser provides. --- ## Post 30 by @any1 — 2026-03-11T14:24:40Z I would recommend against using this with RFP or FPP (with JSDateTimeUTC) since it does not cover all timezone metrics. --- ## Post 31 by @sgro — 2026-03-11T14:28:42Z > Since this will interfere with the protections Mullvad Browser provides. This is correct, this extension modifies browser APIs like navigator.geolocation, Date.prototype.getTimezoneOffset, and Intl.DateTimeFormat. Those overrides change the browser’s fingerprint to make it more unique and therefore, identifiable. I think it is most accurate to say this extension is less of a fingerprinting utility and more of a companion for VPN to fully mask your browser location. > I would recommend against using this with RFP or FPP (with JSDateTimeUTC) since it does not cover all timezone metrics. This is also correct, I can put out an update to cover all of the date/time apis firefox exposes, though since the project was so new I was focused on only covering the most common ones. I am actually a bit suspicious that there are some deeper issues with RFP/FPP compatibility. Those features patch the timezone at the Gecko level which completely bypasses the JS script injected by this extension. So when RFP is on, you are forcing engine-level UTC while the JS level in the extension is forcing the timezone of the spoofed geolocation. I will have to think more on how to properly handle this case, or if it should be handled at all --- ## Post 32 by @any1 — 2026-03-11T14:34:24Z @sgro Is it intended that it directly feeds the “spoofed” location to every site that gets visited? There is no prompt anymore asking for permission to access the location and it grants it directly. --- ## Post 33 by @sgro — 2026-03-11T14:38:27Z > @sgro Is it intended that it directly feeds the “spoofed” location to every site that gets visited? There is no prompt anymore asking for permission to access the location and it grants it directly. Yes, that is by design. When protection is enabled, the extension intercepts geolocation requests and returns the spoofed location directly, bypassing the browser’s permission prompt. Since the data returned is your chosen fake location (not your real one), there’s no privacy risk from the location itself. That said, I can see how some users would prefer to still be asked per-site. This is something I’m considering for a future update - - potentially adding an option to preserve the permission prompt while still spoofing the coordinates when granted. Would you be interested in something like that? --- ## Post 34 by @byte — 2026-03-11T14:39:27Z Hmmm. Interesting. But you should add language spoof too. Websites with agressive checks looks on this too --- ## Post 35 by @any1 — 2026-03-11T14:40:31Z > [@sgro](#): > > Since the data returned is your chosen fake location (not your real one), there’s no privacy risk from the location itself. This is nonsense. Providing a location is providing much more entropy compared to the Firefox default of prompting. --- ## Post 36 by @sgro — 2026-03-11T14:43:11Z > [@any1](#): > > This is nonsense. Providing a location is providing much more entropy compared to the Firefox default of prompting. From a fingerprinting perspective yes you have a point, but as I said before this extension is not necessarily a fingerprinting utility, it is more of a VPN companion that aligns your browser settings to match your VPN location. But you definitely have a point that overriding the prompt is probably not a good solution. I can prioritize a feature to preserve the prompt so users can reject it --- ## Post 37 by @byte — 2026-03-11T14:44:36Z > [@sgro](#): > > I can prioritize a feature to preserve the prompt so users can reject it IMO: add toggle to disable this feature fully --- ## Post 38 by @Protagonist — 2026-03-11T15:00:27Z To be able to install this extension on other Gecko based browsers, I’m also going to need a .xpi file to manually install it. I’m hoping this is possible? Please consider this as well along with a couple other improvements mentioned thus far. --- ## Post 39 by @sgro — 2026-03-11T15:08:36Z Thanks for all the feature requests guys :slight_smile: I’m making github issues to track them all --- ## Post 40 by @jonah — 2026-03-11T15:21:06Z > [@sgro](#): > > I can prioritize a feature to preserve the prompt so users can reject it Do you have a list of location data that can be accessed with or without this prompt? Like, there is no prompt for a site to get your timezone, so you should continue to spoof it, while you shouldn’t spoof data that is locked behind that prompt. If you had a list of all the data points similar to timezone where no prompt is required in the first place that would be useful. --- ## Post 41 by @any1 — 2026-03-11T15:42:34Z > [@jonah](#): > > Like, there is no prompt for a site to get your timezone, so you should continue to spoof it, It would probably be best to have the extension be per-site opt in and not global. So having it bypass the prompt wouldn’t be such an issue. --- ## Post 42 by @jonah — 2026-03-11T15:44:48Z That would probably be easier to do, but I’m not sure why it would be better than relying on the solution for this already included in the browser? --- ## Post 43 by @any1 — 2026-03-11T16:49:36Z If it isn’t made per site, you would have to remember to toggle it off globally if you want to use your actual location. Explicitly opting into the extension and then the browser prompt seems kind of redundant. --- ## Post 44 by @anon16234852 — 2026-03-11T17:01:31Z I guess I’m too European because I can’t think of a single way this would be more helpful than harmful. --- ## Post 45 by @parkerchandler1979 — 2026-03-11T18:08:42Z Do you not see value in obfuscating browser data that couples well with you using a VPN for a more private browsing sesson? --- ## Post 46 by @any1 — 2026-03-11T18:17:30Z You aren’t gaining general privacy by doing this. This would only be useful for select sites that you explicitly want to share your location with. --- ## Post 47 by @parkerchandler1979 — 2026-03-11T18:21:53Z I mean, depends on how you see this be useful to yourself, right? I like the fact that no website would know my real IP or the other metadata from which they can infer my general location. How is this not gaining general privacy when coupled with a VPN? What if I want to cover every website and not just those select ones? How would I know which select websites to actually obfuscate from given their bad practices? --- ## Post 48 by @any1 — 2026-03-11T18:25:26Z You should instead be using the builtin browser protections RFP/FPP (with more targets) by default which already cover these metrics. --- ## Post 49 by @anon16234852 — 2026-03-11T18:25:36Z I really don’t see the point in installing an extension when multi-hop is good enough. --- ## Post 50 by @parkerchandler1979 — 2026-03-11T18:26:04Z I don’t know what this means. Can you explain and elaborate on how I can ensure of this the way you’re suggesting? --- ## Post 51 by @sgro — 2026-03-11T18:26:44Z > You aren’t gaining general privacy by doing this. This would only be useful for select sites that you explicitly want to share your location with. I want to be more clear about this. Timezone and Intl APIs are exposed to every site automatically with no permission prompt. Every page you visit can call new `Date().getTimezoneOffset()` or `Intl.DateTimeFormat().resolvedOptions().timeZone` and get your real IANA timezone. Even if you spoof this data, websites can determine you are using VPN because your public IP does not match your timezone data. Furthermore, blocking geolocation data heavily reduces functionality for many digital services. Some websites will completely block you. GeoSpoof allows you to provide a consistent synchronized identity across your geolocation footprint so that you can appear as a plausible user instead of someone presenting impossible metadata (like timezone in NYC, geolocation in Tokyo, public IP in Berlin, etc) The extension also allows you to customize which location you want to set in your browser api so that your finderprinting is consistently aligned across the geolocation apis. --- ## Post 52 by @parkerchandler1979 — 2026-03-11T18:27:11Z VPN’s don’t hide other metadata like your time zone and whatnot that this tool does. That’s the point. --- ## Post 53 by @sgro — 2026-03-11T18:28:06Z > [@anon16234852](#): > > I really don’t see the point in installing an extension when multi-hop is good enough. I don’t think multi-hop changes anything related to browser api data. It only obfuscates public ip. You would easily be flagged as a VPN user without aligning your browser geolocation to your public ip. --- ## Post 54 by @parkerchandler1979 — 2026-03-11T18:29:22Z > [@sgro](#): > > You would easily be flagged as a VPN user without aligning your browser geolocation to your public ip. To be fair you already are going to be since they/websites can already infer from browser data that you’re likely in the time zone your browser shows and not your IP especially when VPN IPs can easily be known to websites and other services. --- ## Post 55 by @sgro — 2026-03-11T18:29:24Z > [@any1](#): > > You should instead be using the builtin browser protections RFP/FPP (with more targets) by default which already cover these metrics. RFP is great for general fingerprint resistance, but it sets your timezone to UTC for everyone, which is its own kind of fingerprint and breaks a lot of sites. GeoSpoof lets you pick a plausible timezone that matches your VPN exit instead of defaulting to one that nobody actually lives in (or is mismatched with your public ip) --- ## Post 56 by @anon16234852 — 2026-03-11T18:29:33Z They can be handled in the browser without an extension. --- ## Post 57 by @parkerchandler1979 — 2026-03-11T18:30:03Z Okay. How? --- ## Post 58 by @parkerchandler1979 — 2026-03-11T18:31:07Z > [@sgro](#): > > GeoSpoof lets you pick a plausible timezone that matches your VPN exit Should you choose to though. Or you can pick any and let the website wonder where you actually are - if that’s the kind of obfuscation you’re looking for (for any reason). --- ## Post 59 by @anon16234852 — 2026-03-11T18:32:42Z Mullvad Browser. --- ## Post 60 by @parkerchandler1979 — 2026-03-11T18:33:12Z Oh good lord… we’re discussing Firefox here, presumably given the talk in the context of this tool. --- ## Post 61 by @any1 — 2026-03-11T18:33:25Z > [@sgro](#): > > I want to be more clear about this. Timezone and Intl APIs are exposed to every site automatically with no permission prompt. Every page you visit can call new `Date().getTimezoneOffset()` or `Intl.DateTimeFormat().resolvedOptions().timeZone` and get your real IANA timezone. Even if you spoof this data, websites can determine you are using VPN because your public IP does not match your timezone data. It is generally recommended to use robust built-in browser protections (RFP/FPP), which already cover these metrics. Your IP not matching your time zone is not what most sites would use to detect whether you are using a VPN. They instead see that the IP is not a regular residential IP or is coming from a known VPN network provider. > [@sgro](#): > > Furthermore, blocking geolocation data heavily reduces functionality for many digital services. Some websites will completely block you. This would be the only recommended use case. > [@sgro](#): > > The extension also allows you to customize which location you want to set in your browser api so that your finderprinting is consistently aligned across the geolocation apis. Once you allow/spoof your location, you are already doing worse than just using the prompt. --- ## Post 62 by @anon16234852 — 2026-03-11T18:35:51Z If you’re really worried about these things, then Mullvad or Tor is the only real solution.. --- ## Post 63 by @sgro — 2026-03-11T18:37:02Z > They instead see that the IP is not a regular residential IP or is coming from a known VPN network provider. Yes that is correct. At the end of the day there is no way to get around server side checks like this > Once you allow/spoof your location, you are already doing worse than just using the prompt. This isn’t necessarily true. Denying the geolocation prompt on a site that requires it means you can’t use the site at all. Spoofing with plausible coordinates is better than giving your real location or being locked out entirely. --- ## Post 64 by @parkerchandler1979 — 2026-03-11T18:37:13Z > [@any1](#): > > This would be the only recommended use case. Man.. that’s such a conclusive statement that no way applies to all objectively. I can think of so many reasons and use cases for such a tool when coupled with a VPN. What if you want to browse a webiste, social media platform, or a specific forum where you don’t the website to learn anything from you or your browsing activity including them inferring your general area - for the purposes of ensuring there is only going to be an inaccurate profile they may still build for you for advertising purposes. No PII whatsoever, or even close to it if using this tool, as I see it. --- ## Post 65 by @parkerchandler1979 — 2026-03-11T18:38:03Z I don’t think you’re getting the point of why one may still want to use such a tool. I see value in it. It’s okay if you don’t. But let’s stop going round in circles. --- ## Post 66 by @any1 — 2026-03-11T18:38:06Z > [@sgro](#): > > This isn’t necessarily true. Denying the geolocation prompt on a site that requires it means you can’t use the site at all. Spoofing with plausible coordinates is better than giving your real location or being locked out entirely. > [@any1](#): > > ![](https://forum-cdn.privacyguides.net/user_avatar/discuss.privacyguides.net/sgro/48/20059_2.png) sgro: > > > Furthermore, blocking geolocation data heavily reduces functionality for many digital services. Some websites will completely block you. > > This would be the only recommended use case. I said this right here. --- ## Post 67 by @jonah — 2026-03-11T18:38:22Z > [@sgro](#): > > which is its own kind of fingerprint It should probably be noted that if you are already using RFP/FPP then _also_ using GeoSpoof would make you worse off. Same would go for installing GeoSpoof in Tor/Mullvad Browser. Like @parkerchandler1979 I can think of a lot of reasons GeoSpoof would be useful if you _aren’t_ using RFP/FPP though. * * * I had another comment too but I’ll leave it [on GitHub](https://github.com/anthonysgro/geospoof/issues/1#issuecomment-4041308015) for you. --- ## Post 68 by @any1 — 2026-03-11T18:39:19Z > [@parkerchandler1979](#): > > inferring your general area Don’t allow access to your location. --- ## Post 69 by @parkerchandler1979 — 2026-03-11T18:39:25Z > [@jonah](#): > > n think of a lot of reasons GeoSpoof would be useful if you _aren’t_ using RFP/FPP though. I still don’t know what this is and how to ensure of it without this tool. But that’s the point. Very few or only the very tech savvy are going to know this. For the average person out there, this is very useful nonetheless. --- ## Post 70 by @parkerchandler1979 — 2026-03-11T18:40:01Z I said inferring. It means them trying to deduce even if location is not allowed access to - through time zone or city you may have selected to set your time zone. --- ## Post 71 by @any1 — 2026-03-11T18:41:39Z Use the builtin Firefox protections instead. --- ## Post 72 by @parkerchandler1979 — 2026-03-11T18:42:08Z For the third time in this discourse… please explicitly explain how to do what and where within FF to ensure of this your way. ELI5 if you will. --- ## Post 73 by @any1 — 2026-03-11T18:45:27Z > **[Firefox - Privacy Respecting Web Browsers for PC and Mac - Privacy Guides](https://www.privacyguides.org/en/desktop-browsers/#firefox)** > > Protects against the following threat(s): | These privacy-protecting browsers are what we currently recommend for standard/non-anonymous internet browsing on desktop systems. Follow this guide. Then you can go to about:config in Firefox, search for privacy.fingerprintingProtection.overrides and add +JSDateTimeUTC into the box. If you encounter issues because of it now having a different timezone, you can selectively turn off the protection per-site by clicking the shield icon in the search bar. > **[What to do if a site seems broken - Enhanced Tracking Protection in Firefox for...](https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop#w_what-to-do-if-a-site-seems-broken)** > > Enhanced Tracking Protection in Firefox automatically protects your privacy as you browse. It blocks trackers that follow you around online to collect information about your browsing habits and interests without breaking site functionality. It also... --- ## Post 74 by @sgro — 2026-03-11T18:53:52Z This is a good discussion, I’m in agreement that if you use FPP then the only use case for GeoSpoof is to align your browser geolocation/timezone data to that of your public ip to get around site restrictions, or for development/QA purposes. Using it for fingerprinting with FPP would simply just be a worse version of FPP. The only minor thing I would say is FPP sets your timezone to UTC. This is a possible inconsistency that may allow websites to detect you are using VPN. But then again there are probably many heuristics sites use that I’m not covering in GeoSpoof either. But that is part of my longer term goal. --- ## Post 75 by @sgro — 2026-03-13T01:20:11Z > [@any1](#): > > since it does not cover all timezone metrics. this is now fixed: [[Feature Request] Complete Date/Time API coverage and fix output format to match native Firefox · Issue #4 · anthonysgro/geospoof · GitHub](https://github.com/anthonysgro/geospoof/issues/4) The full overridden timezone metrics now: ``` | API | Behavior | | ------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | | `Date.prototype.getTimezoneOffset()` | Returns the correct offset for the spoofed timezone, including DST transitions | | `Intl.DateTimeFormat()` constructor | Injects the spoofed IANA timezone into all format options | | `Intl.DateTimeFormat.prototype.resolvedOptions()` | Returns the spoofed timezone identifier | | `Date.prototype.toString()` | Outputs `{weekday} {month} {day} {year} {HH:mm:ss} GMT{±HHMM} ({timezone long name})` using the spoofed timezone | | `Date.prototype.toDateString()` | Outputs `{weekday} {month} {day} {year}` formatted in the spoofed timezone | | `Date.prototype.toTimeString()` | Outputs `{HH:mm:ss} GMT{±HHMM} ({timezone long name})` using the spoofed timezone | | `Date.prototype.toLocaleString()` | Delegates to `Intl.DateTimeFormat` with the spoofed timezone injected | | `Date.prototype.toLocaleDateString()` | Delegates to `Intl.DateTimeFormat` with the spoofed timezone injected | | `Date.prototype.toLocaleTimeString()` | Delegates to `Intl.DateTimeFormat` with the spoofed timezone injected | ``` --- ## Post 76 by @polyester_apricot650 — 2026-03-16T17:31:02Z Thank you for developing this product! Really interested in trying this out! Just got some questions regarding your software. Will there be a variant for Firefox derivatives like Librawolf and Mullvad? What about Brave? Is it compatible with Firefox on Android? Will there be iOS and macOS support? Do you know for sure that this will enhance our privacy in practice, or is this just theoretical in nature? --- ## Post 77 by @sgro — 2026-03-16T18:22:21Z Thanks for the questions! > Will there be a variant for Firefox derivatives like Librawolf and Mullvad Yes, so the extension is compatible for all Gecko and Chromium browsers. I have explicitly tested it on LibreWolf, Firefox, Waterfox, Brave, Google Chrome, and Firefox for Android without issues. I do want to support Safari on iOS and macOS in the future, but today it is not supported. There are some deeper issues with Mullvad browser. Mullvad Browser uses Firefox’s resist fingerprinting (RFP) which forces UTC timezone at the engine level. No extension can override engine-level protections, and the two would conflict creating a detectable fingerprint. You can see a discussion of this here: [timezone problems · Issue #9 · anthonysgro/geospoof · GitHub](https://github.com/anthonysgro/geospoof/issues/9#issuecomment-4064230901) . You can also use the arkenfox test suite to see any “lies” detected by spoofing in your browser: [TZP](https://arkenfox.github.io/TZP/tzp.html) > Do you know for sure that this will enhance our privacy in practice, or is this just theoretical in nature? It depends on your threat model and tolerance. Use Mullvad or Tor if you cannot allow any adversarial fingerprints from any api on your browser. The tradeoff is that you will always be stuck in UTC+0 timezone. If you want to spoof any timezone you want, you can use my extension. The tradeoff is that advanced actors or scripts can detect your true timezone offset and that you are lying (they most likely cannot detect your true geolocation if used with VPN). Though for common use cases like avoiding georestrictions, ad-trackers, etc this is fine. Some open questions I need to think more about: - It may be possible to set your system clock (maybe use a VM for this) to a different timezone and use this extension to more credibly spoof your location - You may be able to spoof a different geolocation within your timezone without any adversarial footprints. - I am considering an allow-list feature so that users can reduce blast radius if they really want to get around georestrictions for only a handful of sites but otherwise appear like a regular Mullvad user to all other sites. Thanks for the questions --- ## Post 78 by @PurpleDime — 2026-03-16T19:22:37Z I am eager to try. > [@sgro](#): > > Set your location to match your VPN, mismatch it on purpose for extra obfuscation, or pick somewhere entirely different. **1) Does it automatically set your time zone to your VPN’s location or do you have to manually do it yourself by checking your chosen location’s time zone?** It is my understanding that by default Firefox automatically offsets your time zone. However, what is unclear to me, is if the default time zone is the same for every FF user, or if FF adjusts it for each user according to their location. From my experience, having FF change my time zone has never rung any alarm bells with websites. However, I wonder if that is because it never sets it off too far away from my actual time zone. I say this because I strongly suspect that if you live in Australia, and set your time zone to the UK, which can be 10 to 11 hours, it will almost certainly ring alarm bells with websites. Even if you adjust your time zone to match your VPN location, I worry that some websites may lock you out if they see that one minute you’re in the UK, and the next you’re in Australia. I guess if you are already logged in, it might not be an issue, but if you’re logging in multiple times a day into the same account from different locations that are very far from each other with a matching time zone, that’s likely a different story. > [@sgro](#): > > Android support I thought Android support meant you have an app for Android, but I see that it just means your add-on works with Firefox’s Android apps? I really need a geo-spoofed for my phone. I’ve noticed that every geo-spoofed apps requires you change certain core settings on your Android phone, and so far it hasn’t really worked for me. An app I use frequently requires I share my location to perform certain tasks, and I don’t want to, so I do those tasks on desktop which is very frustrating. **2) Do you plan to develop an Android app?** --- ## Post 79 by @sgro — 2026-03-17T04:36:10Z > **1) Does it automatically set your time zone to your VPN’s location or do you have to manually do it yourself by checking your chosen location’s time zone?** Yes there is a convenience toggle to sync with VPN: ![Screenshot 2026-03-17 at 12.32.40 AM](https://forum-uploads.privacyguidesusercontent.com/original/3X/9/f/9f057f33b22d9378c9a5afc29060d2a914c5d8e4.png) > However, I wonder if that is because it never sets it off too far away from my actual time zone. I say this because I strongly suspect that if you live in Australia, and set your time zone to the UK, which can be 10 to 11 hours, it will almost certainly ring alarm bells with websites. It depends on the service. Yes if you access a site under one timezone then re-access it with spoofing faster than one could physically travel to that country, then you could be detected. This is a classic speed-of-light problem. It is up to the user to consistently apply spoofing for the website of choice. I am planning an allow-list feature to help users always present a geolocation per site. > **2) Do you plan to develop an Android app?** Not on my roadmap but that is an interesting idea. Right now I have only been targetting the browser. But I could do some exploratory research to see what is possible on the device level. --- ## Post 80 by @Regime6045 — 2026-03-18T09:42:02Z Very nice idea, I will give it a try. Mullvad has an extension for Firefox where you can set a different proxy for different domains. There’s also more generic extensions for this functionality, like FoxyProxy. Can the VPN sync take that into account and spoof the geolocation depending on the website you’re on? I wouldn’t think so, right? Also, is **“Access your data for all websites”** needed as a permission? --- ## Post 81 by @anon25722375 — 2026-03-18T09:46:09Z > [@Regime6045](#): > > Also, is **“Access your data for all websites”** needed as a permission? Yes, but it’s optional. I’ve disabled it for myself. It’s on by default. But the sync with VPN option doesn’t work if you do. So, its your choice. --- ## Post 82 by @polyester_apricot650 — 2026-03-18T13:27:10Z Thanks for the hard work. I would love to see support on Android, iOS, and the Mac. One day, I’d love to use your extension on GrapheneOS. Now that would be very cool and game-changing. --- ## Post 83 by @anon25722375 — 2026-03-18T13:35:34Z This extension already works on Android and GOS and macOS because they all have Firefox where extensions can be installed. What do you mean by your comment? --- ## Post 84 by @sgro — 2026-03-18T16:25:20Z I have a feature request for an allow-list, but very interesting to set default spoofed location per site, or auto-detect proxy settings even. I’ll look into this but it will almost certainly be a follow up on the allow-list feature --- ## Post 85 by @polyester_apricot650 — 2026-03-18T20:37:13Z I didn’t know such an extension existed! Can you elaborate on how that FF extension works? Will the Mullvad FF extension work on Firefox for Android too? --- ## Post 86 by @polyester_apricot650 — 2026-03-18T20:39:00Z I think that is a great idea that needs to be implemented. It would be amazing if that works on desktop and GrapheneOS Firefox. Do you think development will be hard and long? --- ## Post 87 by @polyester_apricot650 — 2026-03-18T20:39:27Z Not all desktop FF extensions work on Android. --- ## Post 88 by @anon25722375 — 2026-03-18T20:51:35Z This one does, is what I meant. --- ## Post 89 by @polyester_apricot650 — 2026-03-18T21:49:52Z Sorry, I wasn’t sure. That’s why I asked. --- ## Post 90 by @anon25722375 — 2026-03-18T21:50:32Z > [@anon25722375](#): > > This extension already works on Android and GOS and macOS because they all have Firefox where extensions can be installed. I mean.. I literally said this in my very first response to your comment if you read it again. --- ## Post 91 by @Regime6045 — 2026-03-19T10:21:25Z > [@polyester_apricot650](#): > > Will the Mullvad FF extension work on Firefox for Android too? No it doesn’t. > **Offtopic - how to use Mullvad proxies in Firefox for Android** > > The Mullvad Firefox extension can’t talk to the Mullvad app on Android for some reason. I asked Mullvad and they said they put it on their ideas list but with no plans to fix it. > > But if you want a different proxy per site you can do it on Firefox Android with the FoxyProxy extension: > > 1. Find SOCKS5 address and port number for a [Mullvad server](https://mullvad.net/en/servers), e.g. Oslo is `no-osl-wg-socks5-001.relays.mullvad.net:1080` > 2. In Foxyproxy settings: Enter hostname (proxy URL as above but without `:1080` at the end), port (`1080`) and type (`SOCKS5`). Tap on the `+` on “proxy by pattern”, pattern type should be set to `include` & `wildcard` and for the pattern just enter the domain e.g. `example.com` > 3. Then select “Proxy by Pattern” mode in extension main menu. > > The Mullvad VPN (in the Mullvad app) needs to be enabled for this to work. > > It’s a bit fiddly to set up so I would really love to see the Mullvad browser extension working in Android --- ## Post 92 by @polyester_apricot650 — 2026-04-06T04:12:14Z I just downloaded and installed the extension on FF Android. I can’t figure out how to access the settings page. I only see “enabled” and “details” under settings in the Extensions Manager. How do I configure the settings of Geospoof? --- ## Post 93 by @polyester_apricot650 — 2026-04-06T05:15:22Z Finally figured things out, and stupid me for not seeing the obvious. It would be nice if this works with Cromite and Brave on Android. Obviously better if this works system-wide. Not sure if we’ll ever see it on iOS, but that would be awesome. I can’t get “sync with VPN” to work. The error message is “Network Error when attempting to fetch a resource.” What’s going on? Thanks again for the hard work! --- ## Post 94 by @polyester_apricot650 — 2026-04-24T23:34:47Z Is the developer MIA? I’m eager to get in touch with him. This is a good extension! --- ## Post 95 by @sgro — 2026-04-25T00:00:28Z Hi, I am here :slight_smile: glad you are liking the extension! Are you still running into any issues? --- ## Post 96 by @polyester_apricot650 — 2026-04-25T02:04:59Z I can’t get “sync with VPN” to work. The error message is “Network Error when attempting to fetch a resource.” What’s going on? --- ## Post 97 by @sgro — 2026-04-25T04:03:56Z Can you make a GitHub issue for this? [GitHub - anthonysgro/geospoof: 🛡️ GeoSpoof — Browser extension to spoof your geolocation, timezone, and prevent WebRTC IP leaks. · GitHub](https://github.com/anthonysgro/geospoof) This is the first time I’m hearing about this (it works for me and others), so I may need some more details about your browser, configuration settings, any user.js or overrides you are applying. For more insight basically the Sync with VPN feature requires a network request. I use [https://freeipapi.com/](https://freeipapi.com/) to send user public IP and return the geolocation data. This is of course optional and disclosed on the readme, you can always manually provide the location. Maybe that information will help you identify a setting you have on your browser that may be interfering. Otherwise I can dig into it and try to find an explanation --- ## Post 98 by @polyester_apricot650 — 2026-04-26T01:52:29Z I don’t know how to use GitHub. I’ve never used it before. Is it not easy to use this thread? --- ## Post 99 by @Aruba — 2026-04-27T17:16:34Z Berry niiiice. How much change do you think this affects the webfingerprinting on an Android devices. --- ## Post 100 by @sgro — 2026-05-02T19:00:51Z Hey, I did some digging and made some enhancements to the networking reliability in the latest version 1.18.1 Another possible reason you may be getting network issues is because you have blocked some of the external services I use to deduce your public ip + exit location. For example, Nord VPN has a feature called “Threat Protector” that does this implicitly. Try turning that off to test if it resolves your issues. As always, GeoSpoof does not log or store any of your data outside your own device. I don’t maintain a backend, it runs purely within your browser :slight_smile: --- ## Post 101 by @sgro — 2026-05-02T19:14:50Z I have done extensive testing on this subject with Thorin here: [timezone problems · Issue #9 · anthonysgro/geospoof · GitHub](https://github.com/anthonysgro/geospoof/issues/9) We have gotten Firefox fingerprinting about as tight as possible for a web extension that spoofs your location. Most practical methods to detect lies in the browser are patched (to my knowledge). That being said, Firefox does expose a couple of niche OS-level apis that do expose your system date/time, including Web Workers. There is nothing any extension can do about this. Realistically, the vast majority of trackers and websites are not using these to determine your timezone. However, it IS possible, therefore I cannot recommend this extension for those with extreme threat models. If you are worrying about this, you should be using TOR or Mullvad instead. One workaround for the above is to set your system OS date time to the GeoSpoof timezone. This actually completely passes the Arkenfox fingerprinting test suite here: [TZP](http://arkenfox.github.io/TZP/tzp.html) Otherwise, this is about as good as you can spoof location data on Firefox, Chrome, etc. --- ## Post 102 by @polyester_apricot650 — 2026-05-06T12:15:00Z Thanks for the response, but it still doesn’t work. I really can’t figure this out. At the end of the day, is it an important feature? So let me tell you my setup at the moment. I’m wondering if GeoSpoof is making a difference or not. My Android phone is connected to a router using a VPN. On my Android, I’m using another VPN app, so I’m effectively getting a multi-hop with two different providers. The VPN app can also enable mock GPS, which I have enabled. It gets the GPS location to the VPN location. Finally, I’m using your extension with Firefox. I have location and WebRTC protections enabled. The sync with VPN still doesn’t work for me. Instead, I searched up the city of the VPN that my router is using. I know it sounds confusing, but is the obfuscation likely to work? --- ## Post 103 by @sgro — 2026-05-06T12:50:10Z Your setup sounds solid and your workaround is correct. Manually setting the city to your router VPN’s location is exactly what VPN Sync would have done automatically. The browser-level spoofing should be working fine. VPN Sync failing in a multi-hop setup may be a limitation, I haven’t checked that scenario. To help debug, can you share your VPN provider so I can try to replicate this? If you want to help me diagnose the VPN Sync issue, here’s what to do: 1. **Enable debug logging:** Open the GeoSpoof popup → Details tab → Advanced → enable Debug Logging and set verbosity to Debug 2. **Open the extension inspector:** Go to about:debugging in Firefox → This Firefox → find GeoSpoof → click Inspect 3. **Capture logs In the inspector:** go to the Console tab and clear it. Then click “Sync Now” in the popup. Copy and paste all the log entries. 4. **Capture network requests:** Still in the inspector, switch to the Network tab and clear it. Click “Sync Now” again. Right-click any request → Save All As HAR to export the network log. Send both to [support@geospoof.com](mailto:support@geospoof.com) and I’ll try to help as best I can. --- ## Post 104 by @sgro — 2026-05-07T01:09:31Z Happy to announce that GeoSpoof is now available for Safari on iOS (iPhone + iPad) and macOS: [‎GeoSpoof App - App Store](https://apps.apple.com/us/app/geospoof/id6765719745) Additionally, I now host [geospoof.com](http://geospoof.com) to host all our links, and testing/fingerprinting benchmarks are coming in the future :slight_smile: --- ## Post 105 by @polyester_apricot650 — 2026-05-07T06:38:28Z That’s awesome! How did you make this work for iOS? I thought iOS was too locked down to make this work?! What about Brave or any other browsers on iOS? --- ## Post 106 by @polyester_apricot650 — 2026-05-07T06:41:37Z I’ll get back to you this week; I have more time this weekend. I’m wondering if all this obfuscation will make a difference, or if I should simplify things? It sounds like I’m not missing a whole lot without being able to sync, which is good news. Are you going to make this compatible with Brave on desktop and Android? Will all Firefox-based browsers, including IronFox and Waterfox, be compatible? --- ## Post 107 by @sgro — 2026-05-07T07:13:41Z It only works in Safari browser, it doesn’t change the geolocation settings for the entire device --- ## Post 108 by @polyester_apricot650 — 2026-05-07T09:33:15Z I see that it’s also available on macOS, too? Is it possible for you to make it available for download outside the App Store? On my Mac, I refuse to sign in and use the App Store. --- ## Post 109 by @sgro — 2026-05-07T15:16:07Z Unfortunately no way that I know of. You can only install Safari extensions through the App Store. I can do a bit of research to try to find a way around that but I’m not very hopeful --- ## Post 110 by @polyester_apricot650 — 2026-05-08T03:02:31Z Oh wow. I hope there is a workaround. Really hate how I have to sign in to everything with an account these days. All of this surveillance is annoying! --- ## Post 111 by @sgro — 2026-05-16T19:07:25Z > [@sgro](#): > > That being said, Firefox does expose a couple of niche OS-level apis that do expose your system date/time, including Web Workers I have been working on patching Web Worker timezone leaks, and made some significant progress in the most recent version of GeoSpoof (1.19.1). More updates to come :slight_smile: You can test your browser running GeoSpoof on my new experimental test suite: [Verify your protection | GeoSpoof](https://www.geospoof.com/test) (disclaimer: may have bugs, still in progress). --- ## Post 112 by @polyester_apricot650 — 2026-05-24T23:40:54Z Your link doesn’t work. It seems like it’s blocked on my end, and I don’t know why. I’ve installed your extension on iOS. How come it doesn’t have webRTC protection like on Android? Is there any way to get the extension working on other iOS browsers, even if they’re skinned versions like Brave and Firefox? --- ## Post 113 by @sgro — 2026-05-25T00:28:40Z I have a future update coming out adding WebRTC protection on Safari. It is trickier than Firefox but possible. I just haven’t uploaded the app build for iOS yet. Apple doesn’t support extensions for other browsers on iPhone and iPad so that unfortunately is out of my control (except Safari) Also, something is sounding a bit strange with your network setup if you can’t reach both my website and the sync VPN function. Can you try on a fresh profile of Firefox, Safari, Brave, or any browser? It is hard for me to know the issue without any details on your setup. I genuinely want to help you get to the bottom of it though --- ## Post 114 by @polyester_apricot650 — 2026-05-25T00:53:23Z I agree, and I’m sorry if I’m the one causing the problem. I’m also using Control D and NextDNS as my DNS resolvers. I’m still not comfortable installing your extension on my Mac because I have never signed into the App Store with it and don’t ever plan to. I really hope you’ll come up with a way to install it without the App Store. --- ## Post 115 by @polyester_apricot650 — 2026-05-26T23:48:19Z Just saw an iOS update and it now adds WebRTC protection! @sgro, can you confirm that iOS is now at feature, performance, and security parity with Android? Anything else on your roadmap, or is this as good as it gets for Geospoof? --- ## Post 116 by @sgro — 2026-05-27T05:12:52Z yep WebRTC is now available on the Safari extension. Also, you can now install the dmg directly from my github releases page: [Release v1.19.7 · anthonysgro/geospoof · GitHub](https://github.com/anthonysgro/geospoof/releases/tag/v1.19.7) `geospoof-macos-v1.19.7.dmg` It does not auto-update yet so you will have to keep up with updates manually for now though. --- ## Post 117 by @polyester_apricot650 — 2026-05-27T06:18:20Z What an awesome developer! Everyone should give this a try if they haven’t already! --- ## Post 118 by @sgro — 2026-06-06T21:54:58Z GeoSpoof v1.19.9 is now out on Firefox (soon to be on Chrome store and Safari) with a brand new feature. **Sync with VPN is now automatic**. Previously, when you switched your VPN to a new server you had to open GeoSpoof and press Re-sync to move your spoofed location to match. Now GeoSpoof notices when your exit IP changes and re-syncs on its own, usually within a few seconds of your next page load. It works across browsers (Chrome, Firefox, Brave, Edge) and with both desktop VPN apps and browser-extension VPNs. A few details: 1. It re-checks your public IP as you browse, only doing the work when the IP has actually changed, so it stays light and won’t hammer anything in the background. 2. Re-sync is still there if you want to force an update the instant you switch, rather than waiting for it to catch up. 3. One thing to expect: a page you already had open when you switched servers may need a refresh and cooldown to pick up the new location due to some debouncing time (about 10 seconds) to prevent API throttling. Pages you open afterward get it automatically. Please let me know about any bugs or regressions. I did testing but would love some feedback on my [GitHub Issues page](https://github.com/anthonysgro/geospoof/issues). Thanks :slight_smile: --- ## Post 119 by @sgro — 2026-06-15T15:28:28Z New update for iOS includes an app UI/UX overhaul, check it out if you use Safari on iPhone or iPad :slight_smile: [iOS App Store Link](https://apps.apple.com/us/app/geospoof-spoof-geolocation/id6765719745) Would also love feedback (positive or negative) to help make the app better --- ## Post 120 by @EsperZero — 2026-06-16T07:30:11Z Am I the only one who doesn’t see the point especially in firefox android when forks like ironwolf seems to do things similarly? I am open to knowing the purpose of it but maybe im too lost… --- ## Post 121 by @sgro — 2026-06-16T23:07:56Z Thanks for the question :slight_smile: I’m not super familiar with IronFox, but this came up earlier in the thread re: RFP/FPP, Mullvad Browser, etc. The short version is that they’re solving opposite problems. RFP/IronFox/Mullvad harden defaults to shrink your fingerprinting surface. The goal is to tell sites nothing useful and look like every other hardened browser. GeoSpoof’s value prop is that it doesn’t hide your browser’s location, it replaces it with a location of your choice. You pick a place (or sync to your VPN exit) and it aligns geolocation, timezone, and every patchable browser api to match that location consistently. It’s also convenient and available across all browsers, so you can use it wherever you browse instead of committing to one hardened browser. That said, the tradeoff is that for extreme threat models you should not rely on GeoSpoof to 100% hide your geolocation. That is impossible outside of engineering the browser itself like Mullvad, Tor, RFP, etc. --- ## Post 122 by @sgro — 2026-06-16T23:13:50Z Also, a long awaited feature for allow/denylists is now available :slight_smile: You no longer need GeoSpoof active globally, you can target specific websites to override and it will quietly ignore the rest. Check out v1.21.5 to get this feature. Coming soon to iOS, macOS, and Chrome store as well. ![607646951-ba3bbf4c-4beb-423b-9d22-8b73f3f73f4b](https://forum-uploads.privacyguidesusercontent.com/original/3X/c/4/c4a9d815e01a41eccd5f0ed4217c13b4429a06b2.png) --- ## Post 123 by @polyester_apricot650 — 2026-06-17T01:10:40Z Been using Geospoof for a little while now. Keep up the good work! --- ## Post 124 by @sgro — 2026-06-25T00:31:56Z Been about a week since my last update. I’ve made significant progress on the chromium (Google Chrome, Brave, etc) extension by using the [debugger api](https://developer.chrome.com/docs/extensions/reference/api/debugger) to send direct [CDP commands](https://chromedevtools.github.io/devtools-protocol/) to the tab. This override is applied by the **browser engine itself** , not by JS running inside the page. This enables the extension to spoof the timezone / location in every context, including service workers and cross-origin iframes, and to apply it before the page’s first script runs (closing the cold-start race that page-level injection can’t). Best of all this feature is optional (mostly because most normies dont care about it and it opens up an obnoxious debugging bar, and also opt-in is always nice for trust concerns), you can toggle it with `Engine-level Spoofing` on Details \> Advanced Now available in \>v1.22.5 on chromium ([store link here](https://chromewebstore.google.com/detail/geospoof-spoof-geolocatio/dgdbdodafgaeifgajaajohkjjgobcgje)) :slight_smile: ![Screenshot 2026-06-24 at 8.28.16 PM](https://forum-uploads.privacyguidesusercontent.com/original/3X/e/a/eac54d0cb475d0de2793845b1d169869a8e81ba7.png) --- ## Post 125 by @Regime6045 — 2026-06-25T14:55:05Z Nice. Will this be coming to Firefox as well? Or is it not possible / already implemented? --- ## Post 126 by @sgro — 2026-06-25T15:27:19Z Unfortunately firefox doesn’t expose anything equivalent to chromium’s debugger protocol, so there’s currently no easy way to do this on firefox :frowning: That said, I’ve been exploring a different approach. Firefox supports autoconfig and has a pretty robust fingerprinting-protection infrastructure (like RFP, FPP, etc). My current thinking is that it might be possible to use those pieces to push spoofed geolocation and timezone data deeper into the browser engine than a traditional extension can. Basically the goal is to allow geospoof to pass the extension information like user-defined coordinates, allowlists, favorites, etc into the browser engine itself rather than relying entirely on the current content script. This will probably work well for most apis but I honestly dont know if it will cover things like service workers, cross-origin iframes, etc. I haven’t tested it yet so right now it is more of a nebulous thought bubble instead of something I’m actively working on. But I’ve gotten lots of feedback asking for this so I’m inclined to start testing it out. --- ## Post 127 by @CohibaRobusto — 2026-06-26T11:41:08Z Does it work in Mullvad Browser with random mode turned on?/(I.e. uses different proxy location for each tab … sync timezone for each one) --- ## Post 128 by @sgro — 2026-06-26T18:50:18Z tbh i havent tried testing on mullvad, and i know that extensions generally are a bad idea on mullvad especially any anti fingerprinting or software that changes any API responses from your browser. I’ll let you know if any of that changes in the future though --- ## Post 129 by @sgro — 2026-06-30T20:04:07Z Sharing something fun today, looks like Korben.info (one of the biggest open-source/infosec blogs in Europe) picked up GeoSpoof completely organically today :sweat_smile: [Link to blog post](https://korben.info/geospoof-vpn-navigateur-localisation.html) I’m very happy that he highlighted the automated VPN sync feature so heavily as that was my original gripe with existing geolocation spoofers. Anyway just thought that was cool, also hoping the website doesnt crash lol --- ## Post 130 by @polyester_apricot650 — 2026-07-12T04:39:40Z What is the upcoming device-GPS feature? --- ## Post 131 by @sgro — 2026-07-12T22:16:03Z Glad you asked :slight_smile: Yesterday I just launched the public Beta for GeoSpoof GPS: [Download GeoSpoof GPS for Mac | GeoSpoof](https://geospoof.com/gps) **What is it?** GeoSpoof GPS is a Mac companion app that allows you to spoof your iPhone’s system GPS, right from within the GeoSpoof iOS app. It is very lightweight and runs from your menu bar. Yes, it spoofs your location for all apps on your device. **Requirements:** - Must have a Mac and iOS device with GeoSpoof installed - Willingness to enable developer mode - Willingness to install Xcode - GeoSpoof Pro (1-week free trial, less than $1 a month) **Features:** - No jailbreak required - Spoof GPS on up to 3 separately connected iOS devices - One-time USB bootstrap, connects over Wi-Fi afterwards - Never leaves your device and home network. Completely self-hosted, never touches my server. **Details:** - This is a new feature and I currently consider it experimental while I test across iOS/macOS versions and devices. Please feel free to provide feedback/questions/concerns at [feedback@geospoof.com](mailto:feedback@geospoof.com) Get GeoSpoof for iOS: [‎GeoSpoof: Location Spoofer App - App Store](https://apps.apple.com/us/app/geospoof-location-spoofer/id6765719745) ![IMG_3724](https://forum-uploads.privacyguidesusercontent.com/original/3X/4/a/4a1297d41256092bb1998d0dd5143a65f1ae1d2c.jpeg) ![IMG_3723](https://forum-uploads.privacyguidesusercontent.com/original/3X/c/b/cbd6f27667dd2cbc8efbb229ac4f4397e55b8be9.jpeg) ![IMG_3722](https://forum-uploads.privacyguidesusercontent.com/original/3X/d/3/d3e6aaa0d7bedacba742bb91b8187a468e3808f8.jpeg) --- ## Post 132 by @polyester_apricot650 — 2026-07-12T22:49:07Z How is it any different from today? You made a typo in the post? macOS instead of iOS? --- ## Post 133 by @sgro — 2026-07-12T22:58:01Z Before, the iOS app only spoofed location signals in the Safari browser. This new feature allows GeoSpoof to fully spoof the system GPS. That means your Google Maps, your DoorDash, your Netflix, your Find My apps are all spoofed to whatever location you choose. This capability is only possible while connected to the GeoSpoof GPS app running on your Mac while connected via USB or Wi-Fi --- ## Post 134 by @polyester_apricot650 — 2026-07-13T15:50:33Z It’s a little disappointing that there’s another subscription to consider. I’m going to have to evaluate the long-term value of this. So basically, I’ll need to have a macOS device with me at all times in order to utilize this? Is connecting the iOS device to the MacBook via WiFi fast? Won’t it have to create a wireless network in order to let the iPhone connect? --- ## Post 135 by @sgro — 2026-07-13T17:22:33Z There’s only ever been one subscription (less than $1/mo) that works across all your devices. Also you should have Founder status which gives it to you for free for life since you downloaded the app so early. But yes the only feasible way to spoof GPS requires a desktop device either with USB or on a shared WiFi connection with your phone. No other app on the iOS App Store provides this capability. Apple sandboxes iOS apps so it is functionally impossible to get this functionality from a standalone app alone. --- ## Post 136 by @polyester_apricot650 — 2026-07-14T10:47:41Z How do I confirm that I have Founder Status? Is this still offered today? Please don’t take this wrong way. I meant subscriptions in general. It seems like everything is turning into a subscription these days, and I’m getting fatigued from it. --- ## Post 137 by @sgro — 2026-07-14T15:09:27Z If you open the iOS app you should see a Founders welcome message. If you don’t see that, go to the Settings tab and look at the Subscription row at the top. This will tell you what mode you are on. If you don’t see the Founder’s access, let me know and I can try to generate a code for you.