Browser Fingerprinting: How Websites Track You

What Is Browser Fingerprinting?

Browser fingerprinting is a tracking technique that identifies you based on your browser and device configuration rather than storing data on your computer. Unlike cookies, which you can delete, a fingerprint is assembled from information your browser willingly shares with every website you visit.

When combined, these seemingly harmless details create a unique identifier that can track you across websites without your knowledge or consent. Research shows that over 90% of browsers have a unique fingerprint, making this one of the most effective tracking methods in use today.

What Data Makes Up a Fingerprint?

Websites collect dozens of data points from your browser. Each one alone is not unique, but together they form a highly distinctive profile:

• User-Agent string — Your browser name, version, and operating system
• Screen resolution — Display dimensions and color depth
• Installed fonts — The list of fonts available on your system
• Timezone — Your local time offset from UTC
• Language settings — Browser language and preferred languages list
• Installed plugins — Active browser plugins and their versions
• Canvas rendering — How your GPU draws a hidden image (varies by hardware)
• WebGL data — Graphics card model, driver, and rendering capabilities
• AudioContext — How your device processes audio signals
• Hardware concurrency — Number of CPU cores
• Device memory — Amount of RAM reported by the browser
• Touch support — Whether your device has a touchscreen
• Do Not Track setting — Ironically, enabling DNT makes you more unique

Canvas Fingerprinting

Canvas fingerprinting is one of the most powerful techniques. A website draws an invisible image using the HTML5 Canvas API and reads the pixel data back. Because different GPUs, drivers, and operating systems render the image slightly differently, the result is a nearly unique hash.

This works because graphics rendering is affected by:

• GPU manufacturer and model
• Graphics driver version
• Operating system font rendering engine
• Sub-pixel rendering and anti-aliasing settings

WebGL and AudioContext Fingerprinting

WebGL fingerprinting queries your graphics card's renderer and vendor strings, plus supported extensions. A website can render a complex 3D scene and hash the output, similar to canvas fingerprinting but using the WebGL API.

AudioContext fingerprinting exploits differences in how devices process audio. A website generates a sound wave using the Web Audio API and measures the output. Variations in audio hardware and drivers produce different results across devices.

Testing Your Browser Fingerprint

Before making changes, check how unique your current fingerprint is:

Reducing Your Fingerprint

Complete anonymity through fingerprint resistance is extremely difficult. The practical goal is to make your fingerprint less unique by blending in with as many other users as possible.

Firefox: Enhanced Fingerprinting Protection

Firefox has built-in fingerprinting resistance. Open about:config and set:

privacy.resistFingerprinting = true

This single setting enables a wide range of protections:

• Reports a generic user-agent and platform
• Rounds screen resolution to standard sizes
• Spoofs timezone to UTC
• Limits font enumeration to a standard set
• Adds noise to canvas and WebGL readouts
• Returns fixed values for hardware concurrency and device memory

For additional protection in Firefox, also consider:

webgl.disabled = true                    // Blocks WebGL fingerprinting (breaks some sites)
media.peerconnection.enabled = false     // Blocks WebRTC IP leaks
privacy.trackingprotection.enabled = true // Enables Enhanced Tracking Protection

Anti-Fingerprinting Browser Extensions

Several extensions can help reduce fingerprinting:

• CanvasBlocker — Adds random noise to canvas, WebGL, and AudioContext readouts instead of blocking them. This is better than outright blocking because it doesn't break websites while still defeating fingerprinting.
• uBlock Origin — Blocks known fingerprinting scripts from loading in the first place. Enable the "EasyPrivacy" and "Peter Lowe's Ad and tracking server list" filter lists.
• Privacy Badger — Learns and blocks invisible trackers, including some fingerprinting scripts, based on their behavior across multiple sites.

Tor Browser: The Gold Standard

The Tor Browser is designed from the ground up to resist fingerprinting. All Tor Browser users share the same fingerprint because:

• Same user-agent string for all users
• Same window size (rounded to multiples of 200x100)
• Same timezone (UTC)
• Same font list (bundled fonts only)
• Canvas and WebGL return uniform results
• JavaScript timing precision is reduced

If fingerprinting resistance is your top priority, Tor Browser is the most effective solution. See our Complete Tor Browser Guide for setup instructions.

Brave Browser Approach

Brave takes a different approach to fingerprinting than Firefox. Instead of trying to make all users look identical, Brave randomizes fingerprint values on every session:

• Canvas and WebGL outputs are randomized per-session and per-domain
• Hardware concurrency and device memory are spoofed
• Language preferences are limited
• Randomization happens automatically with no configuration needed

This means every time you visit a site, your fingerprint looks different, making it impossible to track you across sessions. The advantage over Tor's approach is that fewer websites break.

What Fingerprinting Cannot Track

Understanding the limitations of fingerprinting helps you make informed privacy decisions:

• Different browsers on the same device — Firefox and Chrome produce completely different fingerprints
• After a major OS update — New drivers, new fonts, or browser updates change the fingerprint
• Virtual machines — VMs have generic hardware profiles that blend in
• Private/Incognito mode — Does NOT protect against fingerprinting (a common misconception)

Practical Protection Strategy

Here is a layered approach, from least effort to maximum protection:

Now Do It Yourself: Watch Six Ordinary Details Identify One Person

The claim that over 90% of browsers are unique is easy to read past. It is also arithmetic you can run in five minutes, and doing so changes which defences look sensible — including one that is widely recommended and makes things worse.

You need only Python, which is already on macOS and Linux and installs from python.org on Windows. Every output below came from running these exact scripts. The percentages are realistic round numbers, not measurements of any real population — the point is the shape of the arithmetic, which does not depend on the exact figures.

import math

POPULATION = 100_000

# Roughly what fraction of people share your value for each attribute.
ATTRS = {
    "browser + version": 0.08,
    "operating system":  0.30,
    "screen resolution": 0.20,
    "timezone":          0.05,
    "language":          0.40,
    "installed fonts":   0.01,
}

print(f"Starting population: {POPULATION:,} people\n")
remaining = float(POPULATION)
bits = 0.0
for name, share in ATTRS.items():
    remaining *= share
    bits += -math.log2(share)
    print(f"  + {name:<18} -> {remaining:12,.1f} people still match   ({bits:5.1f} bits known)")

print(f"\nAfter {len(ATTRS)} attributes: {remaining:,.2f} people match you.")
print(f"That is {bits:.1f} bits of identifying information.")
print(f"{bits:.1f} bits distinguishes 1 person in {2**bits:,.0f}.")

python3 fingerprint.py

Starting population: 100,000 people

  + browser + version  ->      8,000.0 people still match   (  3.6 bits known)
  + operating system   ->      2,400.0 people still match   (  5.4 bits known)
  + screen resolution  ->        480.0 people still match   (  7.7 bits known)
  + timezone           ->         24.0 people still match   ( 12.0 bits known)
  + language           ->          9.6 people still match   ( 13.3 bits known)
  + installed fonts    ->          0.1 people still match   ( 20.0 bits known)

After 6 attributes: 0.10 people match you.
That is 20.0 bits of identifying information.
20.0 bits distinguishes 1 person in 1,041,667.

python3 fingerprint.py

date +%Z
date +%z
echo $LANG

EEST
+0300
en_US.UTF-8

import math

def bits(shares):
    return sum(-math.log2(s) for s in shares)

base = [0.08, 0.30, 0.20, 0.05, 0.40, 0.01]
print("A. Ordinary browser, default settings")
print(f"   {bits(base):.1f} bits  ->  1 in {2**bits(base):,.0f}\n")

hardened = [0.001, 0.30, 0.20, 0.05, 0.40, 0.01, 0.002]
print("B. Same browser + a rare 'privacy' extension that makes you unusual")
print(f"   {bits(hardened):.1f} bits  ->  1 in {2**bits(hardened):,.0f}")
print("   You did not hide. You became easier to pick out.\n")

uniform = [0.99, 0.99, 0.99, 0.99, 0.99, 0.99]
print("C. Tor Browser: everyone reports identical values")
print(f"   {bits(uniform):.1f} bits  ->  1 in {2**bits(uniform):,.1f}")
print("   Nothing to single you out, because you look like everyone else.")

python3 blending.py

A. Ordinary browser, default settings
   20.0 bits  ->  1 in 1,041,667

B. Same browser + a rare 'privacy' extension that makes you unusual
   35.3 bits  ->  1 in 41,666,666,667
   You did not hide. You became easier to pick out.

C. Tor Browser: everyone reports identical values
   0.1 bits  ->  1 in 1.1
   Nothing to single you out, because you look like everyone else.

python3 blending.py

Summary

Browser fingerprinting is a powerful tracking technique that works without cookies, making it harder to detect and block. While perfect anonymity is nearly impossible, you can significantly reduce your trackability:

• Test your fingerprint to understand your starting point
• Use Firefox with privacy.resistFingerprinting for daily browsing
• Install CanvasBlocker and uBlock Origin (no more)
• Use Tor Browser when anonymity is critical
• Remember: the goal is to blend in, not to be invisible