How the Visitor Leaderboard Works

One of the more interesting pieces of this site is the visitor leaderboard — the little counter in the top-right corner that links to a ranked table of everyone who has dropped by. This post explains how it works under the hood.

You Have a Name

Every visitor to this site gets assigned a two-word name like frosted-raven or gilded-otter. The name is derived deterministically from a lightweight browser fingerprint: your IP address, your User-Agent string, and your Accept-Language header are hashed together, and the resulting number is used to index into two lists of 64 words each — one adjective, one noun.

64 × 64 gives 4,096 possible names. For a personal blog, that's plenty.

The name is stable: the same browser on the same network will always produce the same name. A different browser, or a different network, produces a different name.

The Cookie Is Not Your Name

When you first visit, the server mints a random UUID token — something like f7a3c2d1-9b4e-4f2a-8c1d-3e5f6a7b8c9d — and stores the mapping token → name on the server. That token is what goes in your cookie (visitor_token), not the name itself.

This matters because it means you cannot forge someone else's identity by editing your cookie. A cookie containing arctic-frost would do nothing — the server only looks up tokens. The name lives server-side.

If you click Get a new name on the leaderboard page, the server generates a fresh random name and updates the token → name mapping. Your token stays the same; only what it points to changes.

Counting Visits

Every request to a page route (home, posts, the leaderboard itself) passes through a middleware layer that resolves your identity and increments your visit count. Static assets like the CSS and favicon are excluded — only page navigations count.

The counts are stored in a plain text file alongside the session map, so they survive server restarts. No database required.

The Leaderboard

The leaderboard page shows the top ten visitors by page count, with a proportional bar showing each visitor's share of total traffic. If you're outside the top ten, a ⋯ separator appears at the bottom of the table followed by your own row, so you always know where you stand.

Your row is highlighted in blue.

What This Doesn't Do

This setup is intentionally minimal. A few things worth knowing:

• Names are not unique. Two visitors could hash to the same name if their fingerprints collide. Their counts would be merged. For a small blog this is harmless.
• Fingerprints shift. Changing browser, VPN, or network will give you a new fingerprint-derived name the first time — though your token cookie stays constant, so your history follows you as long as the cookie exists.
• There's no authentication. The leaderboard is a curiosity, not a competition. There's no incentive to game it, and no consequence if someone does.

The whole thing is around 500 lines of Rust with no external services, no analytics scripts, and no third-party dependencies beyond the web framework itself.