What is browser fingerprinting?
- It needs no cookies and no storage, so there is nothing to clear and no consent banner to decline.
- Incognito does not help — private windows use the same GPU, fonts and screen.
- About 33 bits of entropy is enough to identify one person on Earth. A few strong signals get most of the way there.
- Blocking scripts can backfire: refusing to answer is itself rare, and rare is identifying.
- It also powers genuine fraud prevention — the technology is neutral, its application is not.
The useful analogy is a witness description. “Brown hair” describes millions of people. Brown hair, 5'11", left-handed, a limp and a Canadian accent describes almost nobody. Fingerprinting works the same way — stack enough weak signals and you arrive at one person.
Canvas fingerprinting, in the open
Your browser is drawing this right now. The pixels it produces differ from another device’s — that difference is the fingerprint.
normally drawn off-screen — shown here so you can see it
rendering…Same instructions, different result on different hardware. Your GPU, driver, font rasteriser and anti-aliasing all nudge individual pixels — invisible to you, perfectly measurable in code.
How uniqueness actually works
Each signal narrows the field. Toggle them to see how quickly “anonymous” disappears.
You share this combination with roughly 462,560 of the world’s ~5 billion internet users.
Bit values are published averages, not a measurement of you personally. Roughly 33 bits is enough to identify one person on the planet — which is why so few signals are needed.
Every signal, grouped
Hardware
- Screen resolution & pixel ratio
- CPU cores, device memory
- GPU model via WebGL
- Touch support & max touch points
The hardest to change, and therefore the most reliable to track.
Software
- Operating system & browser version
- Installed fonts
- Language & keyboard layout
- Browser extensions, indirectly
Font lists alone contribute more entropy than almost any other single signal.
Rendering
- Canvas pixel output
- WebGL renderer & shader precision
- AudioContext waveform processing
Same instructions, different output per device — the strongest category by far.
Behaviour
- Mouse movement & scroll rhythm
- Typing cadence
- Navigation flow through a site
Increasingly used for fraud scoring, and much harder to fake convincingly.
TLS fingerprinting: identified before the page loads
When your client opens an HTTPS connection it announces which cipher suites, extensions and elliptic curves it supports — and crucially, in what order. That ordering is a property of the software, not the user. Chrome sends one arrangement, Firefox another, and Python’s requests library something obviously different from both.
Hashing that arrangement produces a JA3 fingerprint. It is why a scraper can be blocked on its very first packet no matter how perfect its headers are: the server knew it was not a real browser before it ever sent one.
A browser-perfect user agent arriving with a Python TLS signature. The mismatch is the tell.
Use a client that mimics a real browser TLS stack, or drive an actual browser engine.
Directly relevant if you are scraping — see our web scraping lesson.
How a fingerprint follows you
No cookies are involved. The same ad network is present on all four, and recognises the same device each time.
Nothing known yet. Watch the same fingerprint appear on four unrelated sites.
What actually works
Lower is better — this is how much your browser stands out from the crowd.
Values change every visit, so sessions cannot be linked. Brave takes this route. Best general-purpose privacy choice.
The counter-intuitive lesson: trying too hard to hide makes you easier to spot. Blending in beats blocking out. For account work the answer is different again — see antidetect browsers.
The other side of fingerprinting
Fraud prevention
Banks and payment processors use device recognition to notice a login from hardware never seen on that account before.
Account security
The “new device” email you get after signing in from a different laptop is fingerprinting doing something genuinely useful.
Bot detection
Spotting automation whose fingerprint is synthetic, contradictory, or identical across thousands of sessions.
Test yourself
1Roughly how many bits of entropy are needed to identify one person on Earth?
2A VPN protects you from browser fingerprinting.
3Which defence tends to make you MORE identifiable?
4TLS/JA3 fingerprinting happens…
5Why is the canvas signal so strong?
Fingerprinting FAQ
1What is browser fingerprinting?
It is a way of identifying a device by combining many small details your browser reveals — screen size, fonts, GPU, timezone, language and more. No single detail identifies you, but together they form a signature that is often unique.
2How is it different from cookies?
Cookies are stored on your device and can be deleted or blocked. A fingerprint is recalculated from your hardware and settings on every visit, so there is nothing to remove. It also works across unrelated sites and largely sidesteps the consent rules written for stored data.
3Does incognito or private browsing stop it?
No. Private windows prevent history and cookies from persisting, but they use the same GPU, fonts, screen resolution and timezone. Your fingerprint comes out essentially identical to a normal window.
4Does a VPN protect me from fingerprinting?
Only partly. A VPN changes your IP address, which is one signal among dozens. Every device-level signal — canvas, WebGL, fonts, screen — is unchanged, so a tracker can still recognise the same browser behind a different IP.
5Why does blocking fingerprinting scripts backfire?
Because refusing to answer is itself unusual. If almost nobody returns a blank canvas and you do, that refusal becomes a distinctive signal. You have swapped a common fingerprint for a rarer one, which is easier to track.
6How many bits does it take to identify me?
Roughly 33 bits of entropy is enough to single out one person from the world’s population, because 2^33 is about 8.6 billion. A handful of strong signals — canvas, fonts, WebGL — can get most of the way there on their own.
7What is TLS or JA3 fingerprinting?
It identifies the software making a connection from the way it negotiates encryption, before any JavaScript runs. The order of cipher suites and extensions differs between Chrome, Firefox and Python’s requests library, which is why a scraper can be spotted from its very first packet.
8Is browser fingerprinting legal?
It occupies a grey area. Under GDPR and similar regimes it is generally treated as personal data requiring a lawful basis and consent, but enforcement lags well behind the rules covering cookies, so the practice remains widespread.