Every session here is fully encrypted — the scrambled hex strip and jittering payload bytes never resolve into anything readable. But encryption only hides content. It does not hide how many bytes are in each packet, which direction they travel, or when they arrive — and a network observer (ISP, WiFi neighbour, compromised router) sees all three.
Different sites and apps produce distinctive, fairly repeatable size/timing shapes: a page load is a big early burst of resource fetches, a video call is a steady comb of same-sized packets, a chat app is sparse and bursty, a stream pulls a large chunk every couple of seconds. This simulator bins each session's traffic into time buckets and compares the resulting "shape" against a library of previously recorded shapes using cosine similarity — the same class of technique behind real encrypted website-fingerprinting research.
- Record a profile to add its canonical shape to the library.
- Capture mystery session replays a fresh, randomly-picked encrypted session and correlates its shape against every recorded fingerprint, live.
- Padding defense rounds every packet up to a fixed size bucket, jitters timestamps and injects random dummy packets — the payload is exactly as encrypted as before, but the size/timing shape is blurred, and match confidence visibly collapses.