Browser fingerprinting explained

A browser fingerprint is the set of properties a website can read about your browser and device, combined into one identifier. No cookie is stored, no permission is asked, and the identifier is the same in a private window, after clearing data and on every site that computes it the same way. Websites use it to recognize returning visitors, fraud systems use it to spot a browser pretending to be something it is not, and trackers use it as the fallback when cookies are blocked.

This article explains what goes into a fingerprint and how each part works, why "unique" is not a yes-or-no property, what consistency means if you run more than one account, and where anti-fingerprinting tools genuinely help and where they do not.

Passive and active signals

The first layer needs no script at all. Every request carries headers that describe the browser: the user agent, the accepted languages and content types, their exact order, and in Chromium browsers the client hints. The set, order and values differ between browsers and versions, so even a page with JavaScript disabled learns a lot. You can see your own on the HTTP headers page.

The second layer is what a script can ask the browser. That is where most of the identifying information lives, and where the names you have probably heard come from: canvas, WebGL, audio, fonts.

Component	What is read	Why it differs between devices
User agent and client hints	Browser, version, engine, operating system, mobile flag	Different software
Screen	Resolution, available size, color depth, pixel ratio	Different displays and scaling
Time zone and languages	The system zone and the browser's language list	Different locations and settings
Canvas	Hash of an image drawn with text, shapes and gradients	Fonts, anti-aliasing, GPU and driver change the pixels
WebGL	Graphics vendor and renderer strings, plus a hash of a rendered scene	Different GPU, driver and operating system
Audio	Hash of a silent signal processed by the audio engine	Different audio stacks and floating-point behavior
Fonts	Which fonts from a probe list are installed	Operating system, installed software, language packs
Hardware	CPU core count, device memory, touch points	Different machines
Plugins and media capabilities	Installed plugins, supported codecs	Browser build and platform

Each line is weak on its own. Millions of people share your browser version, your screen resolution, your language. The identifier comes from the combination.

How the main components work

Canvas

The script draws text in several fonts, overlapping shapes and a color gradient onto an invisible HTML5 canvas, reads the pixels back and hashes them. The drawing instructions are identical for everyone, but the result is not: the operating system's text rasterizer, sub-pixel anti-aliasing, the graphics driver and the GPU each leave tiny differences in the pixels. The hash of those pixels is stable on one machine and different on another. The canvas fingerprint page shows the exact image your browser draws and its hash, and the glossary has a short definition under canvas fingerprint.

WebGL

WebGL exposes the graphics stack more directly. A debug extension reports the vendor and renderer, which on many systems names the exact GPU model and driver backend; some browsers now return a generic string instead. A script can also render a small 3D scene and hash the output, which varies with the GPU and driver the way canvas does. The renderer string is one of the strongest cross-checks against a spoofed user agent: a browser that claims to be on Windows while reporting an Apple GPU is lying, and anti-fraud systems look for exactly that.

Audio

The audio fingerprint uses the Web Audio API to generate a signal, pass it through an oscillator and a compressor in an offline context, and hash the resulting samples. No sound plays and no microphone is used. Small differences in how audio stacks and floating-point math behave produce different values on different hardware and browser builds.

Fonts

Browsers do not list installed fonts, so scripts infer them: render a test string in a font that may or may not exist, with a known fallback, and measure the width. If the width differs from the fallback's, the font is installed. A list of a few hundred common fonts, probed this way, yields a pattern that reflects the operating system, the office suite, design tools and language packs on the machine.

Client hints

Chromium browsers reduced the detail in the user agent string and moved it into client hints: the Sec-CH-UA headers sent with every request, plus higher-entropy values such as the full version, platform version, architecture and device model that a site can request. The user agent string still exists but is frozen to generic values, so a site that wants precision asks for hints. The user agent page shows both your string and the hints your browser sent, and whether they agree.

Why "unique" is a spectrum

Fingerprinting articles like to say that a fingerprint is unique. The honest answer is that it depends on 3 things.

The population. Uniqueness is always relative to a set of other visitors. A fingerprint that is unique among the visitors of a small specialist site may be shared by thousands on a large general one. Early academic studies on privacy-conscious volunteers found most browsers unique; a later study on a mainstream site found that only a minority were. Both were right about their own population.

The number of components. Each component removes some candidates. A rare combination of a few is enough; a common combination of many may not be. Phones are harder to tell apart than desktops because they share hardware, screens and fonts with every other phone of the same model.

Stability. An identifier is only useful if it is the same tomorrow. Browser updates change the version and often the canvas and audio output; a new monitor changes the screen; a driver update changes WebGL. Trackers cope by matching fingerprints approximately and by combining them with the IP address and whatever cookies survive, which is why a fingerprint rarely works alone.

That is why the browser fingerprint page shows you each component and a combined hash, but does not print a "1 in N" number: we do not keep a database of visitors to compare you with, and any such number from any site is only as meaningful as the population behind it.

What consistency means for multi-account users

For someone managing several accounts from several browser profiles, the goal is not to be unique or to be anonymous. It is for each profile to tell one consistent story, and for different profiles to tell different ones. Detection systems check the story before they check the identifier.

Contradiction	How it is spotted
User agent says Windows, WebGL renderer names an Apple or Android GPU	Platform mismatch between 2 components
Client hints absent or disagreeing with the user agent	Every real Chromium browser sends Sec-CH-UA; a missing or mismatched header is an edited string
Mobile flag set, no touch points, desktop screen size	Device class mismatch
Browser language and time zone that do not fit the IP's country	A timezone mismatch or language mismatch
Fonts typical of one operating system on a user agent claiming another	Font list mismatch
Window larger than the reported screen	Impossible geometry
Canvas hash that changes on every read	Noise injection, a sign of a protection or a spoofing tool

A profile that fails one of these is in a worse position than a plain, unmodified browser, because an unmodified browser is at least coherent. Three rules follow:

1. Spoof whole platforms, not individual values. If a profile claims Windows and Chrome, every component must say Windows and Chrome: user agent, client hints, fonts, renderer, screen sizes that exist on Windows machines.
2. Keep each profile stable. The same profile should produce the same hash week after week, except for the changes a real browser update would cause. Rotating values on every visit looks like a tool, not a person.
3. Match the connection. Time zone and languages have to agree with the IP address the profile uses, and must be updated when the address changes. The connection side is covered on the anonymity score page, which runs the browser components next to the IP checks.

The honest limits of anti-fingerprinting

Tools that fight fingerprinting take 2 approaches, and both have costs.

Uniformity. Tor Browser and Firefox with resistFingerprinting make every user report the same values: a fixed window size, a generic time zone, a bundled font set, a blank or standard canvas. You hide in a crowd of identical browsers, which works as long as the crowd is large and you do not stand out by other means, such as your IP address or your behavior. The price is that the browser is recognizable as a privacy browser, and some sites treat that as a reason for extra friction.

Randomization. Brave's farbling and most antidetect browsers add small, per-site or per-profile noise to canvas, audio and WebGL results, so the hash a tracker stores today does not match tomorrow's. That defeats long-term tracking. It does not defeat a system that reads the component twice and notices the result changed, or that checks whether the renderer string matches the noise pattern of a known tool.

Neither approach touches what a fingerprint cannot change:

• The network. IP address, network type, DNS and WebRTC behavior are independent of the browser's reported values. A perfect fingerprint on a datacenter address is still a datacenter address.
• The transport. The way a browser negotiates TLS and HTTP/2 is characteristic of its real engine and is observed on the server before any script runs. A script can report any user agent it likes; the handshake still belongs to the engine that made it. Tools built on the real engine they imitate pass this check; edited user agents on a different engine do not.
• Behavior. Typing cadence, mouse movement, navigation patterns and the timing of requests are measured by the larger anti-fraud systems and are not part of any fingerprint value.

The definition under browser fingerprint summarizes the concept in a paragraph. The practical takeaway is longer: a fingerprint is neither a password you can hide nor a mask you can swap. It is a description of your browser, and the most defensible description is the one that is internally consistent, matches the connection it arrives on, and changes only when a real browser would change.