What is browser fingerprinting

You clear cookies, open a private window, switch IP, and a site still seems to know it is you. That is usually browser fingerprinting at work. It stores nothing on your machine. It gathers the information your browser volunteers anyway, computes a hash, and treats the result as an ID. Each piece on its own is ordinary; together they are frequently unique.

How a site recognises you without cookies

Open any page and your browser tells the server a great deal: the User-Agent string, Accept-Language, screen resolution and colour depth, time zone, which fonts are installed, which codecs are supported, how many CPU cores you have, roughly how much memory, whether there is a touchscreen. These are legitimate APIs, built so pages can adapt to the device.

One level deeper, a page can make the browser do some work and inspect the outcome. Draw a line of text and a few shapes on a canvas, then export the pixels. Render a triangle with WebGL and, while there, ask for the graphics card model. Generate a short signal through Web Audio and read the waveform back. The results depend on your GPU, its driver, how the operating system rasterises fonts, the browser version, even whether a particular font happens to be installed. Different machines produce subtly different pixels, and after hashing those differences become stable identifiers.

Concatenate those few dozen values in a fixed order, run SHA-256 over the string, and you have a "visitor ID". That is exactly how the Visitor ID on this site's fingerprint page is produced.

Entropy: why ordinary attributes stop being ordinary in combination

Information theory measures how finely an attribute divides a population with "entropy". An attribute that splits people 50/50 carries 1 bit; one where only one person in a thousand matches you carries roughly 10 bits. Singling out one person among several billion takes a little over 30 bits in theory.

No single attribute gets close. A 1920×1080 screen is everywhere, so is Chrome, and a zh-CN language setting says nothing at all among Chinese-speaking users. But entropy accumulates, as long as attributes are not strongly correlated. Screen, time zone and language together may give you a few bits; add your font list (not many people have the full Adobe suite plus a couple of unusual CJK faces), the full WebGL renderer string (model plus driver version) and a canvas hash, and you cross the uniqueness threshold with room to spare.

The EFF's Panopticlick project, now called Cover Your Tracks, does precisely this: it collects fingerprints from volunteers, tallies the distribution of each attribute, and tells you what fraction of browsers it has seen share your value. The "uniqueness" statistics at the bottom of this site's fingerprint page follow the same idea, with this site's visitors as the sample. The smaller the number, the more that attribute gives you away.

Fingerprints versus cookies

A cookie is a note the site leaves in your browser, and you can tear it up whenever you like. A fingerprint is different. Nothing is stored on your side, so there is no "clear" operation. It is cross-site by nature: two sites running the same script with the same hashing get the same ID. And private browsing barely affects it, because private mode isolates storage and changes nothing about your hardware or fonts.

Fingerprints have weaknesses too. A browser update may change canvas rendering; a new monitor changes resolution; installing one font changes the font list. So fingerprints drift, and a tracker cannot rely on exact matches. It has to fuzzy-match, tolerating a change or two and checking whether the rest still lines up. That is also why the high-entropy, stable attributes (GPU model, audio hash) are the most valuable to trackers.

The thinking behind the "fingerprint authenticity" score

At the top of the fingerprint page there is a large number labelled fingerprint authenticity. It does not grade your privacy. It answers a different question: does this browser look like a real, ordinary browser, or like a modified environment?

The score starts at 100 and loses points for every contradiction found:

Check	Deduction
User-Agent in the HTTP header differs from navigator.userAgent in JavaScript	30
Engine features contradict the browser the UA claims (says Chrome, behaves like Firefox)	25
Client Hints platform or brand contradict the UA	15
Time zone inferred from IP ≠ JavaScript time zone	15
JavaScript clock differs from IP-time-zone time by more than 3 minutes	5
Primary Accept-Language ≠ navigator.language	10
Public IP exposed via WebRTC ≠ IP of the HTTP connection	15
navigator.webdriver is true, or headless signals present	30
Impossible screen values (available width larger than total width, etc.)	10
Desktop UA with a software renderer (SwiftShader, llvmpipe)	10
Zero plugins on desktop Chrome	5
Canvas drawn twice gives different results (noise extension)	10

Notice that "your fingerprint is too unique" is not on the list. The score cares about consistency, for a practical reason: anti-fraud and risk systems think the same way. An ordinary browser whose attributes are all normal and agree with each other does not stand out in a crowd. A browser whose UA has been changed to Windows and time zone to New York, while the WebGL renderer still says Apple M2 and Accept-Language still says zh-CN, gets flagged immediately. Faking every attribute without letting them contradict one another is far harder than faking nothing.

That makes the score useful to two kinds of people. Anyone using a circumvention tool can check for tells; the most common are an IP time zone that disagrees with the system time zone, and WebRTC exposing the real IP. Anyone using an anti-detect browser can check whether the disguise is self-consistent. Each check has its own article: time zone and language consistency, WebRTC leaks, bot detection.

What this site does with your data

The fingerprint lab stores only hashes and coarse attributes: hashes of canvas, WebGL, audio and fonts, plus the browser family, OS family, screen size, time zone, language and renderer name used for uniqueness statistics. Raw canvas pixels, audio waveforms and IP addresses never enter the database. There is a "take part in statistics" option on the page; untick it and nothing is uploaded, and the results are shown locally only.

FAQ

Can fingerprinting be avoided entirely? With difficulty. Tor Browser's strategy is to make every user look identical (fixed window size, most APIs disabled), at the cost of a poor web experience. In a normal browser the realistic goal is to reduce high-entropy attributes: avoid installing many fonts, use a mainstream resolution, enable features like Firefox's "resist fingerprinting".

Do canvas-noise extensions help? They make every hash different, which does break exact matching. But they also put you in the small group of people whose canvas output changes, and that is a feature in itself. This site deducts 10 points for it. See Canvas, WebGL and audio fingerprints.

Why do Chrome and Firefox on the same computer produce different fingerprints? Because the rendering engine, font fallback strategy and audio pipeline all differ. A fingerprint identifies "this browser on this machine", not the machine alone.