What is browser fingerprinting, and how do you test yours?
Clear your cookies, open a private window, and a site can still recognize you. The reason is that your browser answers dozens of innocent questions in a combination that almost nobody else matches.
In this guide
Browser fingerprinting is a tracking technique that identifies a browser by combining many properties it exposes for ordinary reasons, such as canvas and WebGL rendering, installed fonts, screen size, time zone, language and hardware details, into one identifier. It needs no cookies and survives private mode. Most unmodified desktop browsers are unique or nearly so; Tor Browser, Brave, Firefox and Safari's fingerprinting protections reduce it.
What browser fingerprinting is
Cookies identify you by storing a label on your device and reading it back. Fingerprinting identifies you by looking at the device itself. A script on the page asks the browser a long list of questions it is designed to answer, such as what size the screen is, which fonts are installed, what time zone the clock is in, how a particular shape renders, and combines the answers into a single identifier. Nothing is written to your device, so there is nothing to clear, and the same answers come back in a private window, after a reboot, and on another site running the same script.
The technique is used for fraud prevention and bot detection (a login from a known device looks safer than one from a never-seen fingerprint), for enforcing bans on people who make new accounts, and by advertising and analytics companies as a cookie replacement. Since February 2025 Google's advertising platforms have permitted advertisers to use it, a change the UK's data protection regulator called irresponsible; in the EU and UK, fingerprinting for tracking requires the same consent cookies do, which almost no fingerprinting script asks for.
The signals a fingerprint collects
Dozens of properties contribute. These are the ones that carry the most identifying information, roughly in order:
| Signal | How it is read | Why it varies between people |
|---|---|---|
| Canvas | The script draws text and shapes on a hidden canvas and reads the pixels back | Font rendering, anti-aliasing, GPU and driver differences produce slightly different pixels on different machines; about 8 bits of information on its own |
| WebGL | Renders a 3D scene and reports the GPU vendor and renderer strings | Exposes the exact graphics card and driver |
| Fonts | Measures text widths to detect which fonts are installed | Every installed application adds fonts; office suites, design tools and language packs leave distinctive sets |
| Audio | Processes a short signal through the Web Audio API and reads the output | Floating-point differences between audio stacks |
| Screen and window | screen.width, pixel ratio, color depth, available height (which reveals taskbar size) | Monitor, scaling and OS chrome combinations |
| User agent and Client Hints | The user agent string and the structured hints that replace it | Browser, version, OS; mostly frozen now, so it contributes less than it did |
| Time zone and languages | Intl APIs and navigator.languages | Geography and language settings, useful for checking consistency with your IP |
| Hardware | CPU core count, device memory, touch support, battery and sensor APIs where available | Distinguishes device classes and models |
| Extensions and settings | Side effects of ad blockers, do-not-track, cookie settings, WebRTC behavior | Privacy tooling itself becomes a signal |
| IP address | Read by the server from the connection, not by the script | Ties the fingerprint to a network and location; a WebRTC leak can add your real address behind a VPN |
The browser fingerprint test runs these checks in your browser, shows each value, and estimates how many bits of identifying information each one contributes. Nothing is sent to our server; the hash is computed locally so you can compare two browsers or two settings.
How unique are you?
Identification is a counting problem. There are about 8.2 billion people, and 33 bits of information (2 to the power of 33 is about 8.6 billion) is enough to single out any one of them. Each property contributes some bits, and they add up fast. The large studies:
- Panopticlick (EFF, 2010): of 470,161 browsers tested, 83.6% had a unique fingerprint, rising to 94.2% when Flash or Java was installed. Browsers carried at least 18.1 bits of identifying information before canvas fingerprinting was even known.
- AmIUnique (2016): 118,934 fingerprints, 89.4% unique; canvas alone contributed about 8.3 bits.
- Hiding in the Crowd (2018): the largest study, 2,067,942 fingerprints collected on a mainstream French website rather than a privacy-tool audience. Only 33.6% were unique overall, 35.7% on desktop and 18.5% on mobile.
The gap between 89% and 34% is the honest picture. People who visit fingerprinting test sites run unusual setups and are easy to pick out; the general population is more uniform, and phones in particular are hard to tell apart because they ship with fixed fonts, fixed screens and no plugins. Even so, a third of a mainstream audience being uniquely identifiable from a single page load, with no cookies and no consent, is why browsers have started to intervene. A fingerprint does not need to be globally unique to be useful: combined with an IP address, one shared by one browser in ten thousand is plenty.
Our test estimates uniqueness from the entropy of each component, based on the published studies, rather than comparing you with other visitors; we keep no database of fingerprints.
Fingerprinting vs cookies
| Cookies | Fingerprinting | |
|---|---|---|
| Stored on your device | Yes | No |
| Cleared by clearing site data | Yes | No |
| Blocked by private mode | Yes, at the end of the session | No |
| Works across sites | Third-party cookies, now blocked by Safari and Firefox by default | Yes, wherever the same script runs |
| Visible to you | Yes, in browser settings | No |
| Stability | Perfect until deleted | Changes when you update the browser, add fonts or change screens |
| Consent requirement (EU, UK) | Yes | Yes, but rarely requested |
Fingerprinting's one weakness is stability: a browser update or a new monitor changes some signals. Trackers handle this by matching approximately and linking the old fingerprint to the new one when most properties still agree, which is why changing one property is not a defense.
Defenses: what works and what backfires
Two strategies work. Blend in by reporting the same values as many other people, or randomize so your values differ on every site and session. Blocking the APIs outright mostly fails, because being the browser that refuses to answer is itself distinctive.
Tor Browser: blend in
Every Tor Browser user presents the same fingerprint as far as possible: same fonts bundled with the browser, same reported screen size (the window is letterboxed to fixed steps), canvas and WebGL readback blocked behind a prompt, same user agent, UTC time zone. It is the strongest defense available, and it works because of the crowd using it, not just the code.
Brave: randomize
Brave adds tiny random noise (it calls this farbling) to canvas, WebGL, audio, plugin lists, the user agent and device enumeration. The noise is seeded per site and per session, so a site sees a consistent value while you are on it, a different value on another site, and a different value again tomorrow. Trackers cannot link visits, and pages still work because the noise is invisible.
Firefox: two levels
Enhanced Tracking Protection in Strict mode, and every private window, blocks scripts from companies known to fingerprint and applies Firefox's fingerprinting protections, expanded in Firefox 145 to limit font enumeration, CPU core count, touch-point count and taskbar dimensions; Mozilla says the expansion cut the share of its users who look unique by almost half. The full privacy.resistFingerprinting setting, which shares code with Tor Browser, goes further by standardizing the time zone to UTC, the user agent, screen size and more; it breaks some sites and is meant for people who accept that.
Safari: on by default in private windows
Since Safari 17, Advanced Fingerprinting Protection adds noise to canvas, WebGL and audio readback and fixes screen and window metrics in Private Browsing. To extend it to every window: on iPhone, Settings, Apps, Safari, Advanced, Advanced Tracking and Fingerprinting Protection, choose All Browsing; on a Mac, Safari, Settings, Advanced, enable Use advanced tracking and fingerprinting protection.
Chrome and Edge
Neither ships anti-fingerprinting protection; Chrome's user agent reduction removed a few bits and that is all. Content-blocking extensions can stop known fingerprinting scripts from loading, which helps against advertisers but not against a site's own script.
Why some extensions backfire
Extensions that spoof a single value, such as a fake user agent, a fake time zone or a canvas blocker that returns a blank image, make you more identifiable. A Firefox user agent paired with Chrome's rendering quirks, or a blank canvas when 99% of browsers return pixels, is a rare combination. The same applies to hand-picking settings: the goal is to look like everyone else, and a unique mix of privacy tools is the opposite. Use a browser's built-in protection rather than a stack of extensions, keep the window at its default size, and avoid installing unusual fonts on a machine you care about.
A VPN does not affect your fingerprint at all; it changes the IP address a site sees and nothing else. Combined with a fingerprint, the new address simply becomes the next data point.
Questions
What are fingerprint trackers?
Scripts, usually embedded by advertising, analytics or anti-fraud companies, that read dozens of properties of your browser and device, hash them into an identifier and report it to a server, so your visits can be linked across sites without cookies. Browsers such as Firefox and Brave keep lists of companies known to do this and block their scripts; a site's own first-party script is harder to stop.
How do I find my browser fingerprint?
Run the browser fingerprint test on this site. It reads the same properties a tracker would, canvas, WebGL, fonts, audio, screen, time zone, languages and hardware, shows each value with an estimate of how identifying it is, and computes a hash in your browser without sending anything to our server. Run it in two browsers or before and after changing a setting to see what makes the difference.
Can browser fingerprinting be prevented?
Reduced, not eliminated. Tor Browser makes every user look alike; Brave randomizes the high-entropy values per site and session; Firefox in Strict mode and Safari with Advanced Fingerprinting Protection enabled for all browsing block or blur the main signals. Keep windows at default sizes and avoid piling on extensions that spoof single values, which make you rarer. No defense covers every signal, and the IP address is always visible.
Does incognito or private mode stop fingerprinting?
Not by itself. Private windows discard cookies and history when closed, but the browser answers fingerprinting scripts exactly as it does normally, so the identifier is the same in and out of private mode. The exceptions are Safari, whose Private Browsing turns on Advanced Fingerprinting Protection by default, and Firefox, whose private windows apply its fingerprinting protections that normal windows only get in Strict mode.
Is browser fingerprinting legal?
In the EU and UK, using fingerprinting to track people requires prior consent under the same ePrivacy rules that govern cookies, and the UK regulator has said it is not a fair means of tracking; fraud prevention and security uses have more latitude. In the US there is no federal rule, though state privacy laws increasingly treat device identifiers as personal data. Google's ad platforms have permitted it since February 2025.
Does a VPN hide my browser fingerprint?
No. A VPN replaces the IP address a website sees and leaves every other signal untouched: canvas, fonts, screen, GPU, time zone and languages are read from your browser, not from the network. A site that fingerprinted you last week recognizes the same browser from the new address. Use a VPN for the address and a browser with fingerprinting protection for the rest, and check that your time zone matches the VPN location.
Sources and further reading
- Eckersley, How Unique Is Your Web Browser? (EFF, 2010)
- Gómez-Boix, Laperdrix, Baudry, Hiding in the Crowd (2018)
- Laperdrix et al., Browser Fingerprinting: A Survey (2019)
- Brave: Fingerprinting defenses 2.0 (farbling)
- WebKit: Private Browsing 2.0
- Mozilla: Firefox expands fingerprint protections
- ICO: Our response to Google's policy change on fingerprinting