Best viewed on a desktop, with a mouse. This page is about something a website did to your pointer, so a touch screen has nothing to take over. There is an on-screen pad, but the joke does not survive it.
Internet Explorer 6, 2001. You could draw the pointer, but the number deciding where it clicked lived inside the file, invisible, and nothing made it agree with the picture.
Round 1.
no cursor yet
Close the windows. Nine open at once and you are done. Click the desktop to give it the keyboard, then M switches the arrow keys on and Escape ends the run.
This is the part that was about the web. You did not install these. Somebody pasted one line into their page and every visitor got it.
<style>* {cursor: url('sparkle.cur'), auto !important;}</style>That rule ends in auto because it has to. MDN calls the keyword a single mandatory value, so you cannot name a custom cursor without also naming the operating system cursor it falls back to. The grammar keeps a way back to the OS.
Hover any one to wear it right now. Click it to keep it, and the game below will use it. 694 cursors, 226 of them animated.
wearing: the normal pointer
The 45 at the end, names like SmoothHourglass and blackwait, are the real 2006 and 2007 sets by Vlasta, chrisyco and Squiddy22, CC BY. The other 649 are rehosted from cursors-4u.com, handing out paste-in cursors since 2004 and stating no license we can rely on: credited and linked, not claimed.
A browser will not decode .ani at all, so the animated Windows cursors of the era, the spinning hourglass and the working-in-background pointer, cannot be worn on a web page even now. Thirteen of the files fetched for this plate were .ani; none survived that test. The animated ones here are .webp, a modern format doing an old job.
Round 1's file declares 2,2 and draws its tip at 2,2. Nothing was corrected and nothing was simulated: your clicks landed where you pointed because the number agreed with the picture. That agreement was never guaranteed. It was a choice the author made, or did not.
A real pointing hand, drawn by Squiddy22 in 2007, 4,286 bytes. Its header declares (0,0). Its first drawn pixel is at (5,0). You were aiming with a fingertip five pixels away from the thing doing the clicking, and nothing on screen could have told you.
Decoding the file...
CSS could not express a hotspot at all until the CSS3 UI working draft of 3 July 2003. Before that, the number could only come from inside the file.
Precision Select is one single Windows role. The three sets in this corpus that ship one, all published in 2006 and 2007, declare (16,16), (14,14) and (11,11). Three sets, three answers. There was no convention to look up, so everybody picked a number.
| Declared | Set | By | Published |
|---|---|---|---|
| (16,16) | Advanced Crosshair | Andy161 | 2007 |
| (14,14) | Plain Black | chrisyco | 2006 |
| (11,11) | Antialiased Classic | Vlasta | 2006 |
Round 3 used (16,16), which twelve of the thirteen Advanced Crosshair files declare regardless of what they draw.
The full corpus is 141 files, but four of its eight sets were uploaded to rw-designer in July and August 2026. They declare four further Precision Select hotspots and carry most of the mismatches. Measured in corpus/hotspot-table.txt, kept off this page, because a 2026 upload is not evidence about 2006.
On 20 November 2006 somebody filed a Firefox bug showing that a big, mostly transparent cursor with a moving hotspot could fake the address bar. Mozilla picked a limit on 24 January 2007 and landed it on trunk the next day: 128 by 128. Firefox 67, on 21 May 2019, started dropping any cursor over 32 px that would leave the content viewport. Blink and WebKit still carry the 128; the 32 px near-chrome rule belongs to Gecko and Blink.
The URL bar can be spoofed by using a large, mostly transparent custom cursor image and dynamically modifying the hotspot coordinates as per CSS3 specs (http://www.w3.org/TR/css3-ui/#cursor). Cursors will overflow outside of the browser content area. Affects Firefox 1.5 and later.
Bugzilla 361298, comment 0, filed 2006-11-20
That last sentence is the whole of round 4. The darker band is this page recreating the clampdown: the thing that made round 4 playable is the thing that killed the toy. Take the big cursor to the top of your own browser window and watch it disappear without our help.
Both files are ours, generated by curfmt/make-cur.py, 4,286 bytes each, identical except for the two hotspot fields at offsets 10 and 12, one byte different in each. Pick one, then try to click the small square. Nothing intercepts your click: the browser reads the number out of the file and puts the click where the file says.
Pick a cursor, then click the square.
Same drawn arrow both times. In the second, the click lands 19 px right and 23 px down from the tip you are aiming with, in your own browser, with nothing running.
Seven genuine Windows cursor binaries, published 2006 and 2007, rehosted rather than hotlinked. Bit depth, declared hotspot and first drawn pixel are parsed from each file's own bytes; author, date and license come from its gallery page, because no .cur carries any of those. The last column is where the artwork starts, which is not usually the number in the header.
Comet Cursor was a browser plugin whose whole job was repainting the pointer. Its demo page from April 2000 names, in the markup, the four roles it could take over: Normal, Hyperlink, Ibeam, Wait. Windows carries fifteen such roles, by the count in Cursors-4U's cursor editor documentation, a commercial site's product copy rather than a Microsoft source. A binary plugin, on two plugin APIs, to address a quarter of the vocabulary.
All other versions of the Comet Cursor contact our servers to record logs of cursor impressions using a GUID (Globally Unique IDentifier).
Comet Systems privacy policy, Wayback capture 2000-05-11
No install count is given here because none of the captured pages is a source for one.
In 1999 a button that made a clicking noise cost you an invisible EMBED with HIDDEN, NAME and MASTERSOUND set, a plugin the visitor had to already have, and a browser sniff around the whole thing. Netscape's own JavaScript guide names "create buttons that make clicking noises" as the use case, and states that a MASTERSOUND attribute must accompany any NAME.
The sounds here are the real Windows 98 .wav files: DING on a window closing, CHORD on a miss, TADA on a cleared run. They are Microsoft's, rehosted from a public archive and credited below rather than claimed. The one-second tick is a single oscillator, because Windows never shipped a ticking clock to borrow.
Linkselect-cursor.cur and Crossout-cursor.cur, both Squiddy22, both starting at (5,0). The number lives at bytes +4 and +6 of a 16-byte directory entry, in the slots the icon format calls wPlanes and wBitCount. No Microsoft document behind this plate describes that repurposing; it is verified by parsing files, not by reading a spec..CUR and .ANI are the only supported cursor types. No GIF, no PNG, no JPEG. All 62 period files measured here are 32 by 32, as are the other 79 in the corpus.A pointer is the one thing on a screen that is always yours to look at and never yours to change. A stranger's web page could change it, which is the appeal and the whole reason free-cursor sites existed. What went away is not the property, it is the reach.
What took it was not taste. It was that the invisible number could lie, and people worked out what to do with that. The clampdown is datable, one bug at a time from 2007 to 2020.
CSS UI 3 answers the security questionnaire on itself. Does this specification allow an origin some measure of control over a user agent's native UI? Yes.
Your page could borrow the pointer, right up until somebody aimed the borrowed thing at the address bar.