> For the complete documentation index, see [llms.txt](https://docs.ipcheck.ing/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ipcheck.ing/knowledge-base/concepts/browser-fingerprinting.md). # Browser Fingerprinting Explained You cleared your cookies. You switched to private browsing. The site still seems to know you. How? Because a browser reveals a great deal about itself simply by doing its job — and the combination of those details can be distinctive enough to serve as a name. ## The idea in one paragraph Every browser answers questions that pages are allowed to ask. What is your screen size? Which time zone? Which language? Which fonts are installed? What graphics hardware is present? Individually these answers are unremarkable — millions of people share each one. But collect twenty of them together and the combination narrows sharply. That combination is a **fingerprint**, and unlike a cookie it is not stored on your device, so there is nothing for you to delete. The comparison is with identifying a person by description rather than by name. Brown hair is not identifying. Brown hair, left-handed, 183 cm, wears glasses, speaks Portuguese and Dutch, works nights — the description gets specific quickly. ## What gets measured The signals fall into a few families. **Canvas rendering.** The page asks the browser to draw text and shapes into an invisible image, then reads the pixels back. Because rendering depends on your operating system, graphics driver, fonts and anti-aliasing settings, the pixels differ subtly between machines. Two devices with the same model and same software produce the same result; different setups do not. This is one of the strongest single signals. **WebGL and GPU.** 3D rendering exposes even more: the graphics vendor and model, supported features, and how a test scene is drawn. Graphics hardware varies widely, so this is highly distinguishing. **Fonts.** Which typefaces are installed can be inferred by measuring how text is laid out. Font sets reflect your operating system, your language, and every design or office application you have ever installed — an unusually personal list. **Audio processing.** The browser can be asked to process a sound signal without playing it, and the numerical output varies slightly with the audio stack. Same principle as canvas, applied to sound. **Browser and system properties.** User agent string, platform, browser version, CPU core count, memory size, touch support, colour depth, screen and window dimensions, whether cookies are enabled, whether a PDF viewer is present. **Locale signals.** Language preferences, time zone, and how the browser formats dates, numbers and currencies. Time zone alone is a strong hint about geography — and a mismatch between your time zone and your IP address's location is a classic sign of VPN use. **Capability probes.** Which permissions are granted, which media devices exist, which speech voices are installed, how certain mathematical functions round at the last decimal place. Small details, but they add up. MyIP's own fingerprint tool exposes most of these as toggles, so you can watch the resulting value change as each category is added or removed. ## Stability versus uniqueness A fingerprint is only useful for tracking if it satisfies two conditions at once, and they pull against each other. **Uniqueness** means few other people share your combination. If a million visitors produce the same fingerprint, it identifies nobody. **Stability** means it stays the same over time. If your fingerprint changes on every visit, it cannot link today's visit to last week's. Most people are more unique than they expect, mainly because of unusual combinations rather than any single exotic value. A common laptop with a common browser is fairly anonymous. Add an uncommon screen size, a rarely-installed font set, and an unusual language configuration, and the combination may be shared with almost nobody. Stability is the weaker half in practice. Browsers update, you install a font, you plug in an external monitor, you travel across a time zone. Trackers handle this with fuzzy matching — treating a fingerprint that differs in one or two attributes as probably the same visitor. The uncomfortable corollary: **unusual privacy measures can make you more identifiable**, because they make you rarer. A browser announcing an exotic combination of blocked features stands out precisely because so few others look like it. ## What it is used for Not all of it is hostile, and it is worth separating the uses. * **Anti-fraud.** Banks and payment services use it to notice when an account is accessed from a device that has never been seen before. This is genuinely protective. * **Bot detection.** Automated tools often produce fingerprints that are impossible or inconsistent — a claimed mobile browser with desktop graphics hardware, for instance. * **Advertising and analytics.** Recognising a visitor across sites and sessions without storable identifiers. This is the use that motivates most privacy concern, and it survives cookie deletion by design. * **Bypassing your stated preferences.** The most objectionable use: rebuilding an identifier after you deliberately cleared one. ## What protection looks like Three broad strategies exist, each with a real cost. **Look like everyone else.** The Tor Browser's approach. It standardises as many signals as possible — same window size, same reported fonts, same user agent — so that all users of that browser present nearly the same fingerprint. This is the most effective defence available, because the crowd genuinely is uniform. The cost is significant: a fixed window size, blocked features, and pages that occasionally misbehave. **Return generic answers.** Firefox's Resist Fingerprinting mode works this way, reporting a standard time zone, a standard screen size, a standard set of fonts, and blocking or neutralising the strongest probes. Less disruptive than Tor Browser, still noticeable — sites may show the wrong time zone or an unexpected layout. **Add noise.** Brave calls this farbling: rather than blocking canvas, audio and WebGL, it perturbs the results slightly, differently for each site and each session. A tracker gets an answer that looks plausible but is not reusable. The cost is lower, since pages keep working, and it does not require you to look like anyone else. | Approach | Example | Strength | Cost | | ---------------- | --------------- | ---------------- | ---------------------------------------- | | Uniform crowd | Tor Browser | Highest | Fixed window, blocked features, breakage | | Generic answers | Firefox RFP | High | Wrong time zone, layout surprises | | Randomised noise | Brave farbling | Moderate to high | Low; occasional site quirks | | Nothing | Default browser | None | None | Some browsers also apply lighter measures by default — Safari, for instance, reduces the information it reports and can return different values on repeat measurement, which is why fingerprint tools sometimes show a changing value there. There is no configuration that removes fingerprinting entirely. Anything capable of rendering a modern web page necessarily reveals something about how it renders. The realistic aim is to be hard to *re-identify*, not invisible. ## Common misconceptions **"Private browsing hides my fingerprint."** It does not. Private windows clear storage and history. They report the same screen, fonts, hardware and time zone. **"A VPN protects me from fingerprinting."** A VPN changes your IP address. Every other signal is unchanged — and a fingerprint that stays identical while the IP jumps between countries is, if anything, more noticeable. **"Blocking JavaScript solves it."** It removes most probes, and breaks most of the modern web. Some signals also survive in HTTP headers. **"My fingerprint is permanent."** It drifts. Updates, new hardware, and changed settings all move it. Trackers compensate with fuzzy matching, so drift slows them down rather than stopping them. **"Two tools gave me different fingerprint values, so one is wrong."** Neither is. There is no standard fingerprint. Each tool chooses its own signals and its own way of combining them, so the values are not comparable across tools — only within one. {% hint style="info" %} **See it yourself on MyIP** The [Browser Fingerprint](/knowledge-base/lookup-privacy/browser-fingerprint.md) tool shows what your browser reveals — browser and engine, operating system, GPU, CPU cores, languages, time zone, display, touch points and more — and computes a fingerprint value from a set of signals you can switch on and off individually. The instructive experiment: note your value, then open the same page in a private window, or in a different browser, and compare. Watching which toggles actually move the value teaches more about fingerprinting than any description of it. {% endhint %} ## Related concepts * [What Is WebRTC?](/knowledge-base/concepts/what-is-webrtc.md) — another browser feature that reveals more than you expect * [GeoIP: How IP Geolocation Works](/knowledge-base/concepts/geoip-explained.md) — why a time zone mismatch is such a strong signal * [How DNS Works](/knowledge-base/concepts/how-dns-works.md) — what your lookups reveal, separately from your browser * [Security Checklist](/knowledge-base/lookup-privacy/security-checklist.md) — practical steps across your digital life --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.ipcheck.ing/knowledge-base/concepts/browser-fingerprinting.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.