What Is Browser Fingerprinting?
How browser fingerprinting identifies you without cookies, which signals carry the weight, what the defenses actually do, and how to test your own browser.
Updated
Browser fingerprinting is a way of recognising a browser without storing anything in it. A page asks the browser to do ordinary work — draw a scene, render audio, report a few properties, compress some bytes — and records how it answers. Individually those answers are mundane. Combined, they narrow the browser down to a small population, and often to one machine.
Cookies are a name tag the site hands you and asks you to wear. A fingerprint is the site describing you from across the room. You can take the name tag off. The description holds until the machine itself changes.
How a fingerprint is built
Every signal is a question with a stable, machine-specific answer. The dictionary on the front page groups them by where the answer comes from:
- Rendering. Canvas fingerprinting hashes the pixels of a drawing; the GPU, driver, and font rasteriser leave marks. WebGL fingerprinting reads the graphics stack's parameters, many of which are decided in software rather than by the card.
- Hardware. AudioContext fingerprinting renders sound nobody hears and hashes the output; the interesting value turns out to be the buffer size, not the hash.
- Environment. User-Agent Client Hints are the structured replacement for the user-agent string. The gzip OS byte is a compile-time constant that reports the OS the browser binary was built for, whatever the user agent claims. Incognito detection recovers one bit: private window or not.
- Network. The WebRTC leak once exposed local IP addresses. It is mostly closed; what remains is the shape of the candidate list.
- Detection. Headless browser detection is the inverse problem: not who is this, but is anyone there at all.
A single signal rarely identifies anyone. The value is in the combination, and in consistency: a browser whose canvas says macOS, whose gzip byte says Windows, and whose user agent says Linux is more identifiable than any one of those values alone, because the contradiction itself is rare.
Why there is no entropy score here
Fingerprinting write-ups like to attach a number of bits to each signal. That number is a property of the population being measured, not of the signal — a figure from a 2016 study of a privacy-conscious audience says nothing about who visits your site in 2026. Each entry in this dictionary says what a signal reveals instead, and several of them reveal the same underlying fact.
What the defenses do
Privacy tools take one of two approaches, and each is detectable in its own way.
Randomise. Brave and Firefox with privacy.resistFingerprinting add small
per-session noise to canvas, audio, and WebGL readouts. Two readings of the
same scene disagree, which defeats naive matching but also announces that
randomisation is switched on — a narrowing signal of its own.
Homogenise. Tor Browser makes everyone return the same values by rendering through a locked-down path. A reading that matches the Tor constant is a fingerprint too, of Tor.
The only defenses that carry no signal are the ones that make you look like a large, common crowd. That is hard, and it is why browser vendors mostly fix individual leaks rather than promise anonymity.
Test your own browser
The front page runs every probe in this dictionary against the browser you are reading this with and shows the values, live. Each entry shows the exact probe source that produced its reading, so you can see what was measured rather than trust a summary.
What is missing
This dictionary is deliberately incomplete. Some signals are not written up yet. Others depend on browser bugs that vendors have not fixed, and publishing a working technique before the fix ships helps trackers more than it helps you. Those entries go up when the fixes do.