Browser Fingerprinting: What It Is and How It Works

⏱️ Reading time: 16 min

You clear your cookies, open an incognito tab, and even turn on a VPN, but the site still shows you the same personalized content as yesterday. That’s not magic: it’s browser fingerprinting, a technique that identifies your device by how your hardware responds, not by a file you saved on disk.

📑 En este artículo

1. TL;DR
2. What is browser fingerprinting?
3. Why it matters: it survives clearing cookies and using a VPN
4. How it works: the signals that give you away
   1. Network signals: fragile but immediate
   2. Code execution signals: stable and permission-free
   3. Time zone, fonts, and the list you didn’t know you were exposing
5. Practical examples: from a simple fingerprint to a combined hash
6. How to detect and reduce your browser fingerprint
7. Real-world use cases
8. Common mistakes and best practices
9. Comparison with alternatives
10. Going deeper: how much information it takes to identify you
11. Frequently Asked Questions
    1. Does incognito mode protect me from hardware-based tracking?
    2. Does a VPN change my browser fingerprint?
    3. Which browser offers the best protection against device fingerprinting?
    4. Do privacy extensions reduce or increase cookieless tracking?
    5. How do I know if a site is using device fingerprinting on me?
12. References

Unlike a cookie, there’s nothing to delete. The identifier comes from your GPU, your installed fonts, and the way your browser draws an invisible canvas, and that doesn’t change even if you restart your router or connect from another country.

TL;DR

• Browser fingerprinting combines GPU, fonts, and audio to identify you without cookies.
• Clearing cookies or connecting a VPN doesn’t change your hardware, so the identifier stays stable across sessions.
• Canvas, WebGL, and AudioContext expose your GPU and drivers with a single line of JavaScript.
• Brave applies farbling (noise) while Tor and Mullvad make all users look identical.
• Tools like coveryourtracks.eff.org and amiunique.org measure how unique your browser is compared to millions of others.

What is browser fingerprinting?

Browser fingerprinting is an identification technique that combines dozens of hardware and software signals (GPU, installed fonts, screen resolution, time zone, audio behavior) to generate a unique identifier per device, without relying on cookies or any data the user can manually delete.

The result is similar to an actual fingerprint: each person has different fingers, but the pattern on each finger stays stable for life. Your laptop doesn’t change GPUs between sessions, so the pattern it generates doesn’t change either.

The key difference from a cookie is who stores the data. A cookie lives on your disk and you can delete it. Device fingerprinting isn’t stored anywhere on your side: it’s recalculated every time you load the page, and it gives the same result because your hardware is still the same hardware.

Why it matters: it survives clearing cookies and using a VPN

A VPN changes your IP address, not your graphics card. That’s why browser fingerprinting cuts straight through the two defenses most people use to feel anonymous: clearing cookies and changing IP. Neither one touches the signals that actually identify the device.

This matters because the business behind it isn’t just showing you a relevant ad. Any site running the script can sell that persistent identity to third parties: name, activity, purchase history, whatever its privacy policy allows it to share. Over time, that profile can know more about you than your friends do.

There’s a concrete history behind why this escalated. When third-party cookies got bad press (Safari and Firefox had already been blocking them since 2019), the advertising industry’s response wasn’t to abandon tracking, but to look for a signal that cookies never fully guaranteed: one that survives incognito mode.

How it works: the signals that give you away

Network signals: fragile but immediate

When your browser requests a page, the request itself hands over data without a single line of JavaScript running. Your IP address reveals your provider and, almost always, your city. The User-Agent and Accept-Language headers give away the browser, the operating system, and the configured language.

The problem for a tracker is that these signals are fragile. The IP rotates if you use mobile data, changes if you use a VPN, and gets shared if you’re on an office wifi network. They’re useful as a first filter, but on their own they’re not enough to consistently recognize you.

Code execution signals: stable and permission-free

The truly stable signals appear when the site can run code in your browser, because that’s when it can measure your hardware without asking you for any permission. Neither you nor the browser sees a prompt, because technically it’s not accessing any file of yours: it just asks the GPU to draw something and measures how it draws it.

• Canvas: the site draws text and shapes on an invisible <canvas>. The pixel result varies depending on the GPU, the driver, and the operating system’s subpixel rendering.
• WebGL: directly exposes your GPU’s manufacturer and model, and how it renders 3D shadows and textures.
• AudioContext: processes a synthetic audio wave and measures how the sound hardware distorts it, inaudibly to the user.
• Installed fonts: measures which typefaces the system has, which gives away installed programs (design, engineering, languages).
• Resolution, pixel ratio, and refresh rate: combined, they narrow down the screen model considerably.

This is how all these signals get combined into a unique identifier before reaching the tracker’s database:

flowchart TD
    A["HTTP Request"] --> B["User-Agent, language, IP"]
    C["JavaScript in the browser"] --> D["Canvas, WebGL, audio, fonts"]
    B --> E["Signal combiner"]
    D --> E
    E --> F["Unique device hash"]
    F --> G[("Tracker's database")]

Time zone, fonts, and the list you didn’t know you were exposing

Beyond canvas and audio, there are simpler signals that still contribute their share. The system’s time zone, detectable with a single line of JavaScript (Intl.DateTimeFormat().resolvedOptions().timeZone), narrows down your location even if your IP is behind a VPN. The exact list of installed fonts, not just the ones from the operating system but also those that come with Photoshop, LaTeX, or an IDE, varies so much between users that on its own it can contribute several bits of entropy.

None of these signals ask the user for permission because technically they aren’t private data in the classic sense: they aren’t your name or your exact GPS location. They’re metadata about the execution environment, and that’s the blind spot that for years let browsers through without blocking them.

Practical examples: from a simple fingerprint to a combined hash

Let’s look at the actual code behind this. The following is a minimal canvas fingerprint, the same principle used by fraud detection libraries and ad networks:

function getCanvasFingerprint() {
  const canvas = document.createElement('canvas');
  const ctx = canvas.getContext('2d');
  ctx.textBaseline = 'top';
  ctx.font = '14px Arial';
  ctx.fillStyle = '#f60';
  ctx.fillRect(0, 0, 100, 20);
  ctx.fillStyle = '#069';
  ctx.fillText('programacion.dev 2026', 2, 2);
  return canvas.toDataURL();
}

console.log(getCanvasFingerprint().slice(0, 60));

The output is a base64 string that always starts with data:image/png;base64,iVBORw0KGgo.... The exact value depends on your GPU and operating system, but two consecutive loads in the same browser return exactly the same string, character for character. That’s precisely the behavior that turns a drawing into an identifier.

Audio works on the same logic, but instead of pixels it measures a synthetic wave processed by your sound hardware:

async function getAudioFingerprint() {
  const ctx = new OfflineAudioContext(1, 5000, 44100);
  const oscillator = ctx.createOscillator();
  oscillator.type = 'triangle';
  oscillator.frequency.value = 10000;
  const compressor = ctx.createDynamicsCompressor();
  oscillator.connect(compressor);
  compressor.connect(ctx.destination);
  oscillator.start(0);
  const buffer = await ctx.startRendering();
  const samples = buffer.getChannelData(0);
  return samples.slice(4500, 4600).reduce((a, b) => a + Math.abs(b), 0);
}

getAudioFingerprint().then(console.log);
// example output: 124.0434765780810 (varies depending on your audio card and its driver)

A tracker doesn’t use a single signal: it concatenates all of them (canvas, audio, fonts, WebGL, time zone) and applies a cryptographic hash to get a short, stable identifier. Here’s what the final step looks like, using the Web Crypto API that already ships in any modern browser:

async function combinarFingerprint(señales) {
  const texto = señales.join('|');
  const datos = new TextEncoder().encode(texto);
  const hashBuffer = await crypto.subtle.digest('SHA-256', datos);
  const hashArray = Array.from(new Uint8Array(hashBuffer));
  return hashArray.map(b => b.toString(16).padStart(2, '0')).join('');
}

combinarFingerprint(['canvas:abc123', 'audio:124.04', 'webgl:ANGLE (Apple, Apple M2)'])
  .then(console.log);
// 9f2b7c4e1a... (64 hexadecimal characters, stable as long as you don't change hardware)

To understand why canvas is so effective, it helps to see the full sequence of what happens inside the browser when that first script runs:

sequenceDiagram
    participant N as Browser
    participant J as Tracking script
    participant GPU as GPU and drivers
    J->>N: requests rendering of a hidden canvas
    N->>GPU: draws text and shapes using the local GPU
    GPU-->>N: returns pixels with hardware-specific variations
    N-->>J: delivers the image buffer as base64
    J->>J: computes a SHA-256 hash of the buffer
    Note over J: the hash is stable across sessions and tabs

How to detect and reduce your browser fingerprint

Before changing anything, it’s worth measuring first. Cover Your Tracks, from the Electronic Frontier Foundation, runs the same kind of tests a real tracker would and tells you whether your combination of signals is unique among the browsers it analyzed, or whether you blend into a large group. AmIUnique does the same thing but also breaks down how much entropy each individual signal contributes: canvas, fonts, plugins, time zone.

With that diagnosis in hand, the real options are few but concrete:

• Firefox: open about:config, search for privacy.resistFingerprinting, and set the value to true. Restart the browser. To confirm it worked, run Cover Your Tracks again: the time zone should report as UTC instead of your real one, and the canvas result should show as blocked instead of unique.
• Brave: go to brave://settings/shields and set fingerprinting blocking to aggressive mode. Brave doesn’t block canvas: it adds different random noise on every load, a technique the project calls farbling. The verification is the same: two AmIUnique readings should give different canvas values from each other.
• Tor Browser or Mullvad Browser: there’s nothing to configure. Their strategy is the opposite of noise: making all users uniform so they all report exactly the same canvas, the same WebGL, and the same font list, regardless of the real hardware underneath.
• Chrome and Edge: don’t have an equivalent fingerprinting protection enabled by default. They isolate storage between sites, but don’t add noise or make hardware signals uniform.

Real-world use cases

Advertising is the best-known case, but not the only one. E-commerce platforms use device fingerprinting to detect fraud: if a new account connects with the same canvas and the same WebGL as an account already blocked for chargebacks, the system flags it even if it uses a different IP and a different email.

Banks and fintechs use it for the opposite side of the same coin: silent authentication. If they recognize your usual device, they let you through without asking for a second factor; if the fingerprint suddenly changes, they trigger an extra verification. And at the more worrying extreme, the same mechanism enables targeted tracking: actors with access to that data can re-identify a specific person by cross-referencing sessions that, on the surface, had no cookie in common.

In the healthcare and insurance sector, some platforms use the same mechanism to detect accounts shared among multiple users: if five different profiles always log in from the same canvas and the same WebGL, it’s most likely a single person with five accounts, not five different people. It’s the defensive flip side of the same technique advertising uses for surveillance.

Common mistakes and best practices

The most common mistake is believing incognito mode protects against this. Incognito mode clears cookies and history when you close the window, but it doesn’t touch your GPU or your installed fonts: browser fingerprinting is identical inside and outside a private tab.

The second mistake, more counterintuitive, is installing lots of extensions for protection. Every extension you add is, in itself, one more signal: the exact list of active extensions makes your browser more unique, not less. Three or four well-chosen privacy extensions do more than fifteen installed just in case.

Third mistake: changing only the User-Agent with an extension. That modifies a fragile network signal and leaves the hardware signals, the ones that actually matter, untouched. It’s the modern version of putting on makeup but leaving your fingerprint on the glass.

⚠️ Heads up: No standalone anti-fingerprinting extension eliminates the risk if the rest of the browser is still unmodified Chrome. Real protection comes from the whole browser (Brave, Tor, Mullvad), not a loose patch.

Comparison with alternatives

There’s no browser that eliminates fingerprinting entirely: there are different strategies, with different costs. Before choosing one, it helps to see the four approaches side by side.

The row that tends to surprise people most is Brave: adding noise isn’t the same as disappearing. A site can still notice you’re using Brave, because the noise itself is a detectable pattern, but it can no longer recognize you from one session to the next through that channel. It’s protection against persistent tracking, not against browser identification itself.

Going deeper: how much information it takes to identify you

The right way to think about this is in bits of entropy, the same concept that measures how much surprise a piece of data provides. If a signal groups you with one in every two people, it contributes 1 bit. If it groups you with one in every 1,024, it contributes 10 bits (log base 2 of 1,024). Add up enough low-entropy signals and the total is enough to identify you among millions: you don’t need one perfect signal, combining several imperfect ones is enough.

This explains why canvas and WebGL are so valuable to a tracker: they don’t identify you on their own, but each contributes many bits because they depend on a specific combination of GPU, driver, operating system, and even the exact version of installed graphics libraries. Two people with the same laptop from the same year can have different fingerprints if one updated their video driver and the other didn’t.

This isn’t a new problem. The EFF launched a project in 2010 called Panopticlick, now evolved into Cover Your Tracks, specifically to measure how identifiable the average browser was before the term fingerprinting became everyday usage. The conclusion of that original research was that the combination of signals, taken together, identified the vast majority of the browsers analyzed with a precision that no individual signal could achieve on its own.

Noise-based defense and uniformity-based defense attack the problem from opposite angles, and it’s worth seeing it as a design decision, not as two variants of the same thing:

flowchart LR
    A["Real device fingerprint"] --> B{"Defense strategy"}
    B -->|"Noise (farbling)"| C["Brave: each load gives a different value"]
    B -->|"Uniformity"| D["Tor and Mullvad: everyone reports the same value"]
    B -->|"No defense"| E["Chrome and Edge: real, stable value"]

Noise breaks stability, because the tracker can no longer recognize you across sessions, but the browser is still distinguishable from another Brave browser through other means. Uniformity goes further: if every Tor Browser user reports the same canvas, the same WebGL, and the same font list, there’s nothing to tell apart, regardless of whether the real hardware underneath is a server or a low-end phone.

Your next step: go to coveryourtracks.eff.org now, run the test, and note which specific signal marks you as unique so you can decide what to configure first.

Frequently Asked Questions

Does incognito mode protect me from hardware-based tracking?

No. Incognito mode clears local cookies and history, but your GPU, your installed fonts, and your audio hardware stay the same inside and outside that tab, so browser fingerprinting doesn’t change.

Does a VPN change my browser fingerprint?

It changes your IP and sometimes your reported time zone, but no VPN modifies the canvas, the WebGL, or the audio your real hardware generates, which are the signals that contribute the most entropy.

Which browser offers the best protection against device fingerprinting?

It depends on what you need. For strong anonymity, Tor Browser or Mullvad Browser, because they make all users uniform. For daily use with active protection, Brave, because it applies farbling by default with no extra configuration.

Do privacy extensions reduce or increase cookieless tracking?

It depends on how many you install. Two or three well-chosen privacy extensions help, but a long list of active extensions becomes, in itself, one more signal that sets you apart from everyone else.

How do I know if a site is using device fingerprinting on me?

There’s no direct way to confirm it from outside without developer tools: you can open the Network tab in the developer tools and look for calls to toDataURL(), getChannelData(), or the WebGL API shortly after the page loads, or use extensions like CanvasBlocker that alert you when a script tries to read the canvas.

References

• royfish.dev: the original English article that inspired this analysis, “Fingerprints are the new cookies”.
• Cover Your Tracks (EFF): free tool from the Electronic Frontier Foundation to measure how unique your browser is.
• AmIUnique: breaks down the entropy contributed by each individual signal in your browser.
• MDN Web Docs: technical definition of fingerprinting and related APIs.
• Brave Browser Wiki: official documentation of the fingerprinting protections and the farbling technique.
• Wikipedia: history and general background on device fingerprinting.

📱 Do you like this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.

Featured image: Foto de Immo Wegmann en Unsplash