Browser Fingerprinting

Browser fingerprinting identifies a visitor by collecting many small, individually harmless details about their browser and device, then combining them into one signature. No single item identifies you. Together, they often do — with surprising precision.

The analogy is a witness description. "Brown hair" describes millions of people. Brown hair, 5'11", left-handed, a limp, and a Canadian accent describes almost nobody. Fingerprinting works the same way: stack enough weak signals and you arrive at one person.

What gets collected

• Screen and window — resolution, colour depth, available space, device pixel ratio
• System — operating system, CPU cores, memory, timezone, language, keyboard layout
• Fonts — which typefaces are installed, often a strong signal because font sets vary by software
• Canvas and WebGL — how your GPU and drivers render a hidden test image
• Audio — tiny differences in how your sound stack processes a generated waveform
• Browser — user agent, plugins, supported features, TLS handshake details

Entropy: why unusual settings hurt

Each detail contributes entropy — a measure of how much it narrows the field. Running Windows contributes very little, since most people do. Running Linux with a rare screen resolution and an unusual font set contributes a great deal.

This produces the counter-intuitive rule at the heart of the subject: being unusual makes you easier to track. Studies have repeatedly found the majority of browsers to be uniquely identifiable from these signals alone.

Why trackers prefer it to cookies

Cookies can be cleared, blocked, and increasingly are by default. A fingerprint is computed fresh from your hardware and settings on every visit, so there is nothing to delete. Private browsing does not help either — incognito uses the same GPU, the same fonts, and the same screen. It also works across unrelated sites, and largely sidesteps the consent rules written specifically around stored data.

Defences, and the trap in the obvious one

Blocking scripts outright tends to backfire, for the reason above: a browser that refuses to answer is itself distinctive. The approaches that work take one of two opposite routes.

• Randomisation — return slightly different values each visit, so sessions cannot be linked. This is what Brave does.
• Uniformity — make everyone look the same. The Tor Browser standardises window size, fonts, and more so users share one fingerprint.
• Consistent personas — anti-detect browsers give each profile a complete, plausible, internally consistent fingerprint that stays stable over time, so a profile resembles a separate ordinary person rather than someone hiding.

That last point is the practical one for multi-account work. Contradictions are what get caught: a user agent claiming iPhone while WebGL reports a desktop GPU is a far louder signal than any single value.

It is not only surveillance

Banks use fingerprinting to notice logins from unfamiliar devices, and anti-fraud systems use it to spot one actor behind many accounts. The same technique that enables ad tracking also blocks a great deal of genuine fraud.