What Is Browser Fingerprinting and How It Works
By cryptoke, developer and editor at SafeLinkWrite. Reviewed for technical accuracy.
Browser fingerprinting is the practice of identifying a device by the characteristics a browser exposes to any site it visits. It is one of the most durable tracking techniques on the modern web, and one of the least visible to users. Research from the Electronic Frontier Foundation's Panopticlick project found that a majority of tested browsers carried a fingerprint unique enough to be re-identified — before any cookie was set.
Unlike cookies, which are files a site stores on your device, fingerprinting extracts information from the browser's own environment. There is nothing to clear. There is no cookie banner to dismiss. The technique works because every browser, on every device, exposes enough distinct signals that two visits from the same machine often look more like each other than they look like visits from any other machine. This guide covers the signals, the major techniques, what actually reduces exposure, and the myths that lead readers to believe they are protected when they are not.
What Fingerprinting Is — and Is Not
Fingerprinting is often confused with two neighbouring concepts. Drawing the line is useful because countermeasures differ:
- Cookies — files the site stores on the device. Removable by clearing browser data.
- Fingerprinting — data derived from the browser and device itself, computed on the fly. Not stored locally; nothing to delete.
- Network-level tracking — IP addresses, TLS fingerprints, DNS query patterns. Observed by the ISP or the destination, not by the browser.
Fingerprinting is the middle category. It is passive from the visitor's perspective, active from the tracker's perspective, and it survives most of the countermeasures that work against the other two.
Technical Breakdown: Signals, Sources, Distinctiveness
| Signal | Exposed by | How distinctive | Changeable by user |
|---|---|---|---|
| User agent string | HTTP header (JavaScript also reads navigator.userAgent) |
Moderate — dozens of combinations | Partially — extensions can spoof, but spoofing itself becomes a signal |
| Screen resolution, color depth, pixel ratio | screen.* and window.devicePixelRatio |
High on desktop — hundreds of combinations | No — resolution is fixed by hardware |
| Language and preferred languages | navigator.language, navigator.languages |
Low to moderate — narrows region | Yes — configurable in browser settings |
| Timezone | Intl.DateTimeFormat() |
Low — approximately one per region | Yes — via browser or OS setting |
| Logical CPU cores | navigator.hardwareConcurrency |
Low — power-of-two buckets | No |
| Reported device memory | navigator.deviceMemory |
Low — power-of-two buckets | No |
| Font list | Measured indirectly by rendering text and comparing widths | Very high — strongly correlated with OS, region, software | Rarely — few users install or remove fonts |
| Plugins and MIME types | navigator.plugins, navigator.mimeTypes |
Moderate — collapsing in modern browsers | Partially |
| Canvas rendering | Off-screen <canvas> drawing, then pixel hash |
Very high — depends on OS, GPU, driver, fonts | No — surface can be randomised by some browsers |
| WebGL vendor / renderer | WebGL context strings | Very high on desktop and even higher on mobile | No |
| Audio processing output | Web Audio API parameter extraction | High — varies per driver and hardware | No |
| IPv4 vs IPv6, TLS handshake details | Network layer | Moderate — but observed even with JS disabled | Rarely |
Each entry is common. The combination is not. With a few dozen fields, the space of possible signatures is large enough that most visitors to a mid-sized site will have a unique one — even before the tracker correlates across sites.
The Big Three Techniques
Canvas fingerprinting
A site asks the browser to render text or a shape onto an off-screen <canvas> element, then reads the resulting pixels and hashes them. The rendered pixels depend on the operating system, graphics driver, font rendering engine, and specific hardware. Two identical browsers on different machines produce slightly different pixels. The difference is invisible to a human and stable enough to distinguish devices. Because canvas is a standard part of browser functionality, sites can perform it quietly during normal page activity. Blocking it entirely would break features users rely on, so most privacy tools reduce its precision rather than eliminate it.
WebGL fingerprinting
WebGL fingerprinting is similar but operates on the GPU. A site retrieves the vendor and renderer strings exposed by the WebGL context, then renders a scene and reads back the result. On many systems the renderer string alone is enough to identify the graphics hardware and the operating system. On mobile devices it is often even more distinctive, because the combinations of hardware and software are more limited.
Font fingerprinting
Fonts installed on a system vary widely across users. A site can detect which fonts are installed by rendering a piece of text with a candidate font and measuring its width against a fallback. If the width differs, the font exists. Because font sets correlate strongly with language, region, and installed software, they add substantial distinguishing information to a fingerprint.
Example: What a Tracker Actually Sees
Suppose a visitor opens a page on a tracker-equipped site. During page load, scripts quietly compute a set of values and combine them into a hash. A simplified example of the fields a single request could contribute:
{
ua: "Mozilla/5.0 ... Firefox/128.0",
screen: "1920x1080@24",
langs: ["en-US", "en"],
tz: "Europe/Amsterdam",
cores: 8,
mem: 8,
canvasHash: "a7c8b1e9...",
webglVendor: "Google Inc. (NVIDIA)",
webglRenderer: "ANGLE (NVIDIA, GeForce GTX 1650...)",
audioHash: "d3e5f9a1...",
ipFamily: "IPv6"
}Every individual field aside from the canvas, WebGL, and audio hashes is shared with millions of users. The hashes collapse that sharing. The combination is unlikely to match more than a handful of devices — and typically only one on a given site's audience. Nothing in this payload could have been removed by clearing cookies. Nothing in it changes when the visitor opens a private window. This is the entire trade fingerprinting makes with the tracking ecosystem.
Why It Matters
Fingerprinting survives most traditional privacy measures:
- Clearing cookies does not change a canvas signature.
- Private browsing does not change installed fonts or the GPU renderer.
- Blocking JavaScript disables fingerprinting — but also disables most of the modern web.
- A VPN changes the IP the site sees, not the device signature. It is orthogonal to fingerprinting.
The consequence is that a tracker can re-identify the same visitor across sessions, across different cookies, and across sites, without ever storing anything on the device.
How to Reduce It — Realistically
No single fix works. A combination of measures reduces exposure:
- Use a browser with active anti-fingerprinting. Firefox strict mode randomises several signals per session. Brave randomises canvas and WebGL outputs. Safari excludes fonts and plugins from third-party scripts.
- Install a content blocker that prevents fingerprinting scripts from running. uBlock Origin with the "AdGuard Annoyances" or "EasyPrivacy" filter lists blocks many known fingerprinting endpoints.
- Disable JavaScript on sites that do not need it. A site with JS disabled cannot read canvas, WebGL, or audio parameters. This is the only true elimination method — and it is impractical for most workflows.
- Accept the irreducible floor. Screen size, language, timezone, and TLS handshake details are exposed in virtually every mainstream configuration. These alone are usually insufficient to uniquely identify a visitor, but they are never zero.
- Inspect what you can. Extensions such as CanvasBlocker or the EFF's Cover Your Tracks tool show what a site can currently see. Knowing the baseline makes the countermeasures intelligible.
Fully defeating fingerprinting is not currently possible in a normal browsing context. Reducing the amount of signal, and using browsers designed to resist it, is a reasonable goal.
Myths vs Facts
| Myth | Fact |
|---|---|
| "Clearing cookies resets my fingerprint." | Fingerprint signals are computed fresh on each visit and are independent of cookies. Clearing cookies does not change a canvas hash or a GPU renderer string. |
| "Private/incognito mode hides my fingerprint." | Private mode prevents local persistence. It does not alter screen, fonts, GPU, audio, or any other exposed signal. |
| "A VPN defeats fingerprinting." | A VPN changes the IP address the destination sees. It has no effect on browser- and device-level signals. |
| "Blocking JavaScript fixes everything." | It removes the largest signal sources, but network-level signals — IP family, TLS parameters — remain visible and can still contribute to a fingerprint. |
| "Only sketchy sites fingerprint." | Fraud prevention, bot detection, and even major CDNs use fingerprinting as part of their normal operation. The technique is mainstream. |
| "If a site shows a cookie banner, it isn't fingerprinting." | Consent flows govern cookies specifically. Fingerprinting is often performed by scripts that arrive before the banner loads and are not covered by the banner's consent scope. |
| "A safelink prevents fingerprinting." | A safelink is an intermediate page. It hides the referrer — the URL of the page the visitor came from — from the destination. It does not alter the browser's own fingerprint. Fingerprinting happens at the destination regardless of how the visitor arrived. |
Safelinks, Referrer Privacy, and Fingerprinting — Where the Line Is
A safelink is sometimes described as a privacy tool. For one specific problem — the referrer header — it can be. A correctly built safelink sends the destination an empty referrer and hides the URL of the page the visitor came from.
Fingerprinting is a separate problem. The destination receives the browser's signals whether the visitor arrived by direct link, by shortener, or by safelink. Nothing about an intermediate page changes canvas rendering, font detection, or the GPU renderer string. Any claim that a safelink reduces fingerprinting is misleading, and publishers who make that claim weaken the credibility of the parts of the tool that do work.
The honest framing: safelinks address referrer leakage and destination transparency. Fingerprinting requires browser-level countermeasures. Mixing the two invites a complaint that the tool overpromises — and AdSense review, at scale, treats that as a trust signal.
Why Sites Use It — and Where Disclosure Matters
Fingerprinting is not inherently malicious. Advertisers use it because third-party cookies are increasingly blocked. Fraud-prevention systems use it to distinguish real users from bots. Security teams use it to detect credential-stuffing attacks. A small amount of fingerprinting is a legitimate defensive posture.
The problem is not the existence of the technique. It is the lack of disclosure. Most visitors have no way to know which of the sites they visit are fingerprinting, how that signature is stored, or which third parties receive it. Every jurisdiction that regulates personal data — GDPR, CCPA, and equivalents — considers device-level identification a form of personal data. Disclosure is not a courtesy; it is the baseline.
If you build tools that collect fingerprinting signals, disclose it explicitly. Describe what signals are collected, how long they are retained, and who receives them. That is the only way the practice stays within bounds — and the only way users can make an informed choice about using the tool.
Conclusion
Fingerprinting works because the browser is a rich source of stable, distinct information, and the signals combine in more ways than the underlying fields suggest. It cannot be defeated by clearing cookies or opening a private window. It cannot be defeated by a VPN. It can be reduced by browsers designed to randomise signals, by blockers that stop tracking scripts, and by turning JavaScript off on sites that do not need it — at the cost of the modern web experience. The reasonable goal is not invisibility. The reasonable goal is a fingerprint generic enough that identifying you is no longer the cheapest way to track a visitor. Open Cover Your Tracks in the next tab and check what your browser currently tells the world.