Browser Fingerprinting

Browser fingerprinting is a technique used to identify or re-identify a browser by collecting and combining characteristics exposed by the browser, operating system, device, graphics hardware, language settings, screen, network stack, and supported web features.

Unlike ordinary cookie-based tracking, fingerprinting does not always require a website to store a traditional identifier on the device. A site can observe a collection of signals, combine them into a profile, and compare that profile with previous visits.

A single characteristic is rarely enough to identify a browser reliably. Thousands or millions of users may share the same language, browser version, screen resolution, or operating system. The privacy risk appears when many small characteristics are combined.

Browser fingerprinting can support legitimate security functions such as fraud prevention, abuse detection, bot management, and account protection. It can also be used for invasive tracking, cross-site profiling, identity correlation, and attempts to recognize users after they clear cookies.

For privacy-sensitive users, understanding browser fingerprinting is important because hiding an IP address does not automatically prevent a browser from exposing other distinguishing information.

Quick definition

Browser fingerprinting is the process of collecting observable browser and device characteristics and combining them into an identifier or probability-based profile.

A fingerprint may include information such as:

Browser family and version.
Operating system or platform.
Language and locale.
Time zone.
Screen and viewport dimensions.
Device pixel ratio.
Color depth.
Available fonts or font-rendering behavior.
Canvas-rendering output.
WebGL capabilities and rendering details.
Audio-processing behavior.
Supported media formats.
Hardware concurrency.
Approximate device memory.
Touch and pointer capabilities.
Browser settings.
Supported Web APIs.
HTTP request headers.
Network and protocol characteristics.

The resulting fingerprint may be unique, nearly unique, or shared by a group of users. It can also change when the browser, operating system, hardware, settings, or available features change.

A fingerprint is therefore not always a permanent serial number. It is often a probabilistic identifier whose usefulness depends on how distinctive and stable the observed characteristics are.

Why browser fingerprinting exists

Websites need information about a visitor’s environment to function correctly.

A website may need to know:

Which language to display.
Whether the screen is small or large.
Whether touch input is available.
Which image, audio, or video formats are supported.
Whether a browser supports a required feature.
How to render text and graphics.
Whether accessibility preferences are active.
Whether an application is running on a mobile or desktop device.

These capabilities improve usability and compatibility.

The same information can also be combined for identification. A value that is harmless by itself may become privacy-sensitive when joined with many other values.

For example, none of the following necessarily identifies a user alone:

English language.
A specific time zone.
A particular browser version.
A 1920 × 1080 display.
Eight logical processor threads.
A specific graphics renderer.

The complete combination may be much less common.

Browser fingerprinting exists partly because the web exposes enough variation for websites to distinguish one environment from another.

How browser fingerprinting works

A fingerprinting system generally follows several stages:

A website collects observable characteristics.
The characteristics are normalized into a consistent format.
The values are combined or transformed into a fingerprint.
The fingerprint is stored with a server-side record.
A later visit is measured again.
The new measurement is compared with previous fingerprints.
The system estimates whether the visits came from the same browser or device.

Some systems calculate a hash from the observed values. Others use probabilistic matching, classification models, similarity scores, or risk-scoring systems.

A simple conceptual fingerprint might be based on:

Browser version
+ operating system
+ language
+ time zone
+ screen characteristics
+ graphics output
+ font measurements
+ hardware information
+ API behavior
= browser profile

Real systems can be considerably more complex. They may tolerate small changes, assign different importance to different signals, or combine browser characteristics with account, network, timing, and behavioral information.

Fingerprinting is usually probabilistic

Browser fingerprints are not always exact.

A browser may change because:

It was updated.
The operating system was updated.
The screen configuration changed.
A monitor was connected or removed.
Fonts were installed.
Language settings changed.
Browser privacy protections modified exposed values.
Graphics drivers changed.
An extension altered page behavior.
The user entered private browsing mode.
The browser randomized selected values.

A fingerprinting system may still recognize the browser by comparing the remaining signals.

This makes modern fingerprinting less like checking one fixed identifier and more like comparing patterns.

A system may conclude:

The fingerprints are probably the same.
The fingerprints are probably different.
The evidence is uncertain.
The device is familiar but has changed.
The browser appears related to an existing account.
The visit should receive additional verification.

The result can include false positives and false negatives. A fingerprint should not be treated as perfect proof of identity.

Uniqueness and entropy

Fingerprint discussions often use the concept of entropy.

In this context, entropy represents how much distinguishing information a characteristic contributes.

A value shared by nearly every visitor contributes little identifying information. A rare value contributes more.

For example:

A common browser version may provide little distinction.
An unusual combination of browser, platform, fonts, graphics output, screen dimensions, and language settings may provide much more distinction.

Fingerprint uniqueness is relative to the population being observed.

A browser might appear unique within a small website’s audience but not within the entire internet. It might also blend into a large group today and become more distinctive after an update or configuration change.

This is why statements such as “your browser is unique” should be interpreted carefully. The result depends on:

The website’s sample population.
The signals tested.
The accuracy of the test.
The time of measurement.
The browser’s privacy protections.
The number and diversity of other visitors.

Uniqueness is not an absolute property independent of context.

Passive fingerprinting

Passive fingerprinting collects information that is naturally available during communication between the browser and the server.

It may use:

HTTP request headers.
User-Agent information.
Client Hints.
Accepted languages.
Supported compression methods.
Protocol negotiation.
TLS and network-stack characteristics.
IP-related network information.
Request ordering or connection behavior.

Passive fingerprinting does not necessarily require a page to run JavaScript or perform visible tests.

Because the information is observed during ordinary requests, passive fingerprinting can be difficult for users to notice.

Not every network characteristic is strictly part of the browser itself. However, browser, device, operating-system, and network fingerprints are frequently discussed together because they can be combined into a broader identification profile.

Active fingerprinting

Active fingerprinting causes the browser to execute code or respond to tests designed to reveal characteristics.

JavaScript, CSS, graphics APIs, audio APIs, media queries, timing measurements, and feature-detection methods may be used.

Active fingerprinting may test:

Canvas rendering.
WebGL rendering.
Audio processing.
Font dimensions.
Screen and viewport values.
Hardware concurrency.
Device memory.
Touch support.
Available browser APIs.
Media capabilities.
Error behavior.
Mathematical or rendering differences.
Permission-related states.
Browser configuration.

Active techniques can provide more detailed information than ordinary request headers, but they may also be affected by script blocking, browser defenses, permission restrictions, and compatibility settings.

Stateful tracking vs fingerprinting

Traditional web tracking often uses a stored identifier.

Examples include:

Cookies.
Local storage.
IndexedDB.
Cached identifiers.
Account identifiers.
Tracking parameters.

These methods are stateful because the browser stores or returns some state associated with the visitor.

Browser fingerprinting is often described as stateless tracking because the site can attempt to recognize the browser from observable characteristics rather than relying entirely on a stored identifier.

The distinction is not absolute.

A fingerprinting company may still store the resulting profile on its own servers. A website may combine fingerprints with cookies, local storage, login information, advertising identifiers, or tracking parameters.

In practice, fingerprinting is often one layer in a larger tracking system.

Browser fingerprinting vs cookies

Cookies and fingerprints can both help recognize returning visitors, but they work differently.

Cookies

Cookies usually involve a value stored in the browser and returned to a website.

They can be:

Deleted.
Blocked.
Partitioned.
Expired.
Restricted to one site.
Cleared when a session ends.

Cookies also have legitimate uses, including:

Maintaining login sessions.
Remembering preferences.
Preserving shopping carts.
Protecting accounts.
Managing consent choices.

Fingerprints

Fingerprints are derived from characteristics observed by the website.

They may:

Survive cookie deletion.
Work when third-party cookies are blocked.
Change gradually rather than disappear immediately.
Be difficult for users to inspect.
Be combined with server-side history.
Operate without an obvious stored identifier.

Clearing cookies can reduce tracking state, but it does not necessarily change the browser’s observable characteristics.

First-party fingerprinting

First-party fingerprinting occurs when the website being visited collects or uses fingerprinting information.

A website may use it for:

Fraud prevention.
Login risk assessment.
Account recovery.
Bot detection.
Rate limiting.
Abuse prevention.
Recognizing trusted devices.
Analytics.
Personalization.
Advertising measurement.

The privacy impact depends on:

Which information is collected.
Whether the collection is necessary.
How long the data is retained.
Whether it is shared.
Whether it is linked to an account.
Whether the user is informed.
Whether the system is used for security or tracking.
Whether users can exercise meaningful control.

First-party collection is not automatically harmless. It can still create detailed profiles or be shared with other organizations.

Third-party fingerprinting

Third-party fingerprinting occurs when an embedded service collects information across websites.

Examples of embedded third-party components may include:

Advertising scripts.
Analytics libraries.
Fraud-detection services.
Social widgets.
Content-delivery scripts.
Customer-support tools.
Embedded media players.
Tracking pixels.
Tag-management systems.

If the same third party appears on many websites, it may attempt to recognize the same browser across those sites.

This creates a cross-site tracking risk even when users block or delete ordinary third-party cookies.

Modern browsers increasingly restrict third-party tracking, partition storage, block known trackers, and limit fingerprinting surfaces. The effectiveness and scope of these protections vary by browser and configuration.

Browser fingerprints and accounts

A fingerprint becomes more privacy-sensitive when it is connected to an account.

Before login, a website may know only that a similar browser visited previously.

After login, the site may be able to associate that fingerprint with:

A name.
An email address.
A phone number.
A payment record.
A customer account.
A workplace identity.
A social profile.
A transaction history.

The fingerprint may then be used to recognize the browser during later sessions, including sessions where the user is not logged in.

This is one reason identity separation is difficult. A privacy session can become linked to a personal identity if the same browser profile is used to access identifying accounts.

Browser fingerprints and IP addresses

An IP address and a browser fingerprint are different signals.

An IP address identifies a network connection or address shared by a device, router, organization, mobile carrier, proxy, VPN, or Tor exit relay.

A browser fingerprint describes observable characteristics of the browser and device environment.

A tracking system may combine both.

Changing the IP address may not change:

Screen dimensions.
Browser version.
Graphics behavior.
Fonts.
Language.
Time zone.
Hardware values.
Canvas output.
Other browser characteristics.

Similarly, changing the browser configuration may not change the IP address.

Privacy requires understanding both network-level and browser-level identification.

Browser fingerprints and VPNs

A VPN changes the network path and normally causes websites to see the VPN server’s IP address instead of the user’s ordinary public IP address.

A VPN does not automatically change the browser fingerprint.

The website may still observe:

Browser characteristics.
Operating-system details.
Screen properties.
Time zone.
Language.
Canvas and WebGL behavior.
Supported features.
Login information.

A VPN can protect the connection between the device and the VPN provider and can change the visible network address. It should not be treated as a complete anti-fingerprinting tool.

Browser fingerprints and private browsing

Private or incognito browsing is useful for limiting local session state.

Depending on the browser, it may help:

Separate cookies from ordinary sessions.
Clear temporary browsing data after closing the private window.
Avoid saving local browsing history.
Reduce persistence of some site data.

Private browsing does not automatically hide:

The IP address.
Browser characteristics.
Screen information.
Device properties.
Network-level signals.
Account activity.
Fingerprinting measurements.

A private window can still have a recognizable fingerprint.

Private browsing should not be confused with anonymity.

Common fingerprinting signals

Browser fingerprinting can use many signals. Availability varies by browser, platform, permissions, and privacy configuration.

User-Agent information

The User-Agent historically provided information about:

Browser family.
Browser version.
Rendering engine.
Operating-system family.
Device class.

Browsers have reduced or standardized some User-Agent information to limit unnecessary exposure.

Modern sites may also use User-Agent Client Hints, which can expose selected browser or platform information through request headers or JavaScript.

Reducing one signal does not eliminate fingerprinting. Sites can combine many other characteristics.

Language and locale

A browser may expose:

Preferred language.
Ordered language list.
Locale conventions.
Date formatting.
Number formatting.
Calendar behavior.
Text direction.

A common language contributes little uniqueness by itself. An unusual ordered combination of languages and locale settings may be more distinctive.

Language also creates a behavioral signal. Content choices, spelling patterns, writing style, and browsing times can reveal additional information beyond the technical browser fingerprint.

Time zone

Websites may detect or infer the browser’s time zone.

Time zone alone is not usually unique, but it can narrow the possible region or behavioral profile.

A time zone can become more useful when combined with:

Language.
IP geolocation.
Activity schedule.
Locale.
date formatting.
Account information.

Manually choosing an unusual time zone can sometimes make a browser more distinctive rather than less distinctive.

Screen and viewport measurements

A website may observe:

Screen width and height.
Available screen area.
Browser viewport size.
Device pixel ratio.
Color depth.
Orientation.
Fullscreen state.
Multiple-display behavior.

Viewport size can change when the browser window is resized, sidebars are opened, browser zoom changes, or display scaling is adjusted.

A rare window size or display configuration can contribute to fingerprint uniqueness.

Fonts and text measurement

Browsers do not need to provide a simple complete list of installed fonts for font fingerprinting to occur.

A site can attempt to detect fonts by measuring how text is rendered.

Different fonts produce different widths, heights, fallback behavior, and glyph shapes. These measurements can reveal which fonts are available or how the operating system renders text.

Font information can be useful because installed fonts may reflect:

Operating system.
Language packs.
Professional software.
Office suites.
Design applications.
User customization.

Browsers may restrict or standardize font access to reduce this surface.

Canvas fingerprinting

The HTML canvas element allows websites to draw graphics and text.

A fingerprinting script may:

Draw a specific combination of text, shapes, colors, and effects.
Ask the browser to return information about the rendered result.
Compare the result with outputs from other devices.

Small differences can arise from:

Operating-system graphics libraries.
Fonts.
Graphics hardware.
Drivers.
Browser engine.
Anti-aliasing.
Color processing.
Rendering configuration.

Some browsers restrict, standardize, or randomize canvas output in privacy-sensitive contexts.

Blocking canvas access completely can break legitimate applications such as graphics editors, charts, games, image processing, and document tools.

WebGL fingerprinting

WebGL allows websites to use hardware-accelerated graphics.

A site may observe:

Supported WebGL versions.
Extensions.
Shader behavior.
Rendering output.
Texture limits.
Graphics capabilities.
Vendor or renderer information when available.
Precision and implementation differences.

These values can reveal information about the graphics stack and device.

WebGL is important for legitimate uses such as:

3D graphics.
Mapping.
Scientific visualization.
Games.
Design tools.
Video effects.

Privacy defenses therefore try to balance functionality with reduced exposure rather than simply eliminating every graphics feature.

Audio fingerprinting

Web audio features allow websites to generate, process, and analyze audio.

An audio fingerprinting test may process a known signal and measure the result.

Small differences can be influenced by:

Browser implementation.
Operating system.
Audio stack.
Hardware.
Floating-point behavior.
Processing configuration.

Audio fingerprinting does not necessarily record sound from the microphone. It may generate and process a signal internally.

Microphone access is a separate permission-sensitive capability.

Hardware concurrency

The browser may expose an approximation of the number of logical processor threads available to it.

This can help applications optimize:

Parallel calculations.
Rendering.
Games.
Data processing.
Background workers.

The value can also contribute to a fingerprint.

Some browsers may reduce, cap, or standardize the value for privacy and compatibility reasons.

Device memory

Some environments expose an approximate device-memory category rather than an exact measurement.

This can help websites choose appropriate resource sizes or application behavior.

Approximate memory information may still contribute to fingerprinting when combined with other characteristics.

The API is not implemented identically across all browsers.

Touch, pointer, and input capabilities

Websites may detect whether a device supports:

Touch input.
Fine or coarse pointers.
Hover capability.
Multiple touch points.
Specific input patterns.

These values help responsive websites adapt to phones, tablets, laptops, styluses, and desktop computers.

They can also narrow the device profile.

Media capabilities

A browser may expose which audio and video formats, codecs, resolutions, or playback configurations it supports.

Media capabilities can differ according to:

Browser.
Operating system.
Licensed codecs.
Hardware acceleration.
Device class.
Installed components.

A distinctive media-support combination may contribute to a fingerprint.

API and feature support

Browsers differ in which web features they support.

A site can test:

Whether an API exists.
Whether a method behaves in a particular way.
Which properties are available.
Which permission states are returned.
How errors are formatted.
How edge cases are handled.

Even when version strings are standardized, feature detection can reveal browser family, version range, operating-system behavior, or configuration.

Browser extensions

Most browsers do not intentionally provide websites with a complete list of installed extensions.

Extensions may still influence the fingerprint by:

Blocking specific requests.
Modifying page content.
Injecting elements.
Changing headers.
Altering JavaScript behavior.
Blocking fonts or scripts.
Adding unusual APIs or detectable artifacts.
Changing canvas or network behavior.

A rare extension combination can make a browser more distinctive.

This is particularly important in Tor Browser, where adding extensions can separate the user from the larger Tor Browser population.

Permissions and device access

Websites may request access to features such as:

Camera.
Microphone.
Location.
Notifications.
Clipboard.
Bluetooth.
USB.
Motion sensors.

Modern browsers generally place sensitive capabilities behind permissions or other restrictions.

Permission states and device characteristics can sometimes contribute to identification, but exact exposure depends on the browser and whether permission has been granted.

Users should approve only permissions that are necessary and expected.

Behavioral fingerprinting

Technical browser fingerprinting can be combined with behavioral signals.

Examples include:

Mouse movement.
Scrolling patterns.
Typing rhythm.
Touch gestures.
Navigation sequences.
Reading time.
Activity schedule.
Interaction speed.
Repeated spelling or language patterns.

Behavioral identification is not identical to browser fingerprinting, but the two can be combined.

A browser configuration may change while behavior remains similar.

Fingerprinting for fraud prevention

Not every use of fingerprinting is designed for advertising.

Organizations may use device and browser signals to detect:

Automated account creation.
Credential stuffing.
Payment fraud.
Account takeover.
Repeated abuse.
Suspicious login changes.
Bonus or promotion abuse.
Bots.
High-risk transactions.
Attempts to evade rate limits.

A bank might ask for additional authentication when a login comes from an unfamiliar browser profile.

A website might block thousands of automated requests that appear to come from the same environment.

These can be legitimate security uses.

However, security systems should not treat fingerprints as infallible identity evidence. Shared devices, browser updates, accessibility tools, privacy protections, enterprise environments, and common hardware can produce incorrect matches.

Fingerprinting for tracking and advertising

Fingerprinting can also be used to:

Recognize visitors without ordinary cookies.
Link visits over time.
Correlate activity across websites.
Rebuild identifiers after storage is cleared.
Measure advertising exposure.
Build interest profiles.
Associate anonymous activity with known accounts.
Supplement other tracking systems.

This type of use is privacy-sensitive because users may not be able to see, delete, or reset the identifier easily.

The legal and regulatory treatment of fingerprinting varies by jurisdiction, purpose, implementation, disclosure, and the type of data involved.

Organizations should obtain appropriate legal and privacy guidance rather than assuming that fingerprinting is exempt from data-protection rules.

Why fingerprinting is a privacy risk

Fingerprinting can reduce a user’s ability to control tracking.

A user may clear cookies because they want a new session. A fingerprinting system may attempt to reconnect that session with previous activity.

Potential privacy consequences include:

Cross-site profiling.
Re-identification.
Linking pseudonymous sessions.
Associating browsing activity with an account.
Recognizing privacy-protective users.
Creating persistent risk profiles.
Tracking after storage is cleared.
Correlating activity across network changes.
Reducing practical anonymity.

The greatest risk appears when fingerprints are combined with account information, network signals, location, transaction history, data brokers, or behavioral profiles.

Fingerprinting and anonymous browsing

Anonymous browsing requires more than hiding the IP address.

A user may connect through Tor, a VPN, a proxy, or another network and still expose a distinctive browser configuration.

If the same fingerprint appears during both anonymous and personally identifying sessions, a tracking system may attempt to correlate them.

This does not mean that every matching fingerprint proves the sessions belong to the same person. However, it can provide a useful correlation signal.

Safer anonymity requires:

Network privacy.
Browser-fingerprint resistance.
Identity separation.
Account separation.
Metadata awareness.
Consistent operational security.
Avoidance of unnecessary customization.

Browser fingerprinting and Tor Browser

Tor Browser is specifically designed to resist tracking and browser fingerprinting.

Its strategy is not simply to hide every characteristic. A major objective is to make Tor Browser users appear more similar to one another.

Tor Browser includes defenses such as:

Standardized browser characteristics.
User-Agent normalization.
Letterboxing for window dimensions.
Restrictions on identifying information.
Isolation between website contexts.
Carefully selected default extensions.
Session-limited browsing state.
Privacy-focused API behavior.
Security levels that can restrict active web content.

This creates an important concept known as an anonymity set.

A user is harder to distinguish when their browser resembles many other users. A heavily customized browser may stand out even if some of its settings appear more private.

Letterboxing

Tor Browser uses letterboxing to reduce the identifying value of browser-window dimensions.

Instead of exposing every possible viewport size directly, content is placed inside standardized dimension steps. Empty margins may appear around the page.

This helps reduce the number of distinct window-size combinations visible to websites.

Letterboxing is not intended to hide the existence of Tor Browser. It is intended to help Tor Browser users resemble other Tor Browser users.

Users should not disable fingerprinting protections simply because the margins look unusual.

Tor Browser extensions

Installing additional extensions in Tor Browser is strongly discouraged.

An added extension may:

Change page behavior.
Add new detectable features.
Block a unique combination of resources.
Modify requests.
expose new information.
Create security vulnerabilities.
Make the browser fingerprint more distinctive.

A privacy extension that is useful in an ordinary browser may reduce anonymity when added to Tor Browser.

Tor Browser should generally be used with its default configuration and included extensions.

Tor Browser security levels

Tor Browser provides multiple security levels.

Higher levels disable or restrict certain web features that can increase attack surface.

This can reduce exposure to:

Some scripts.
Some media features.
Some fonts.
Some active content.
Some browser attacks.

Higher security levels may also break website functionality.

Security level and fingerprint resistance are related but not identical. A higher security level does not replace identity separation, link verification, or safe behavior.

Users should choose the level appropriate to their threat model.

Using Tor with another browser

Routing an ordinary browser through the Tor network does not provide the same protections as Tor Browser.

A regular browser may expose:

A distinctive configuration.
Ordinary browser history.
Persistent cookies.
Identifying extensions.
Local-account integration.
Platform-specific details.
Unsafe proxy behavior.
DNS or application leaks.
A unique fingerprint.

For Tor-based browsing, users should use Tor Browser rather than manually connecting an ordinary browser to a Tor proxy.

Network routing alone is not enough.

Whonix and browser fingerprinting

Whonix separates Tor routing from user applications through Whonix-Gateway and Whonix-Workstation.

This architecture helps reduce direct network leaks. It does not automatically solve browser fingerprinting.

Tor Browser remains the recommended browser inside Whonix-Workstation for web activity because it includes browser-level fingerprinting defenses.

Whonix helps protect the network path.

Tor Browser helps reduce browser uniqueness.

User behavior helps protect identity separation.

All three layers matter.

Qubes OS and browser fingerprinting

Qubes OS can separate browsing activities into different compartments.

For example, a user might maintain:

A personal browser qube.
A work browser qube.
A banking qube.
An untrusted browsing qube.
A Qubes-Whonix qube for Tor activity.

Compartmentalization can reduce data exposure between activities, but it does not automatically erase fingerprint similarity.

Two qubes using the same unusual browser configuration may still appear related. A user can also link compartments by logging into the same account or repeating identifying behavior.

Qubes OS is valuable for isolation. Browser-fingerprint resistance still depends on the browser and how it is configured.

Tails and browser fingerprinting

Tails routes network activity through Tor and includes Tor Browser.

Tor Browser provides the primary browser-fingerprinting protections inside Tails.

Tails can reduce persistent local traces and provide a standardized Tor-oriented environment, but users can still weaken privacy through:

Browser customization.
Added extensions.
Personal account logins.
Identifying downloads.
Reused usernames.
Behavioral patterns.
Unsafe file handling.

Tails, Whonix, and Qubes OS solve important system-level problems. They do not remove the need to use Tor Browser correctly.

Can fingerprinting identify a person?

A browser fingerprint usually identifies or estimates a browser or device profile, not a legal identity by itself.

The profile may become connected to a person when combined with:

Account login.
Email address.
Phone number.
Payment information.
Customer record.
IP history.
Location.
Social profile.
Workplace account.
Data from another company.

Fingerprinting is therefore better understood as a correlation mechanism.

It can help connect sessions. Other information may then connect those sessions to an individual.

Is every fingerprint unique?

No.

Many browsers share the same or similar fingerprint.

Uniqueness depends on:

Browser population.
Device diversity.
Tested signals.
Privacy protections.
Geographic region.
Time.
Sample size.
Measurement accuracy.

A fingerprint does not need to be perfectly unique to be useful.

It may narrow a visitor to a small group, contribute to a risk score, or strengthen another identifier.

Is fingerprinting permanent?

No fingerprint is guaranteed to remain stable forever.

Fingerprints can change after:

Browser updates.
Operating-system updates.
Hardware changes.
Driver changes.
Display changes.
Language changes.
Privacy-setting changes.
Extension installation.
Font changes.
Browser-data resets.

Fingerprinting systems may use fuzzy or probabilistic matching to recognize related profiles despite these changes.

Does disabling JavaScript stop fingerprinting?

Disabling JavaScript can block many active fingerprinting techniques.

It does not eliminate:

Passive HTTP fingerprinting.
Network-level fingerprinting.
TLS characteristics.
IP-based correlation.
Account identification.
CSS-based feature detection.
Server-observable request behavior.

Disabling JavaScript can also break many websites and may make a browser configuration unusual in some populations.

In Tor Browser, users should use the built-in Security Level rather than creating an arbitrary collection of custom settings.

Does blocking cookies stop fingerprinting?

No.

Blocking or clearing cookies can reduce stored tracking state but does not automatically change the browser’s observable characteristics.

Cookie protections and fingerprinting protections address related but different tracking methods.

Both are useful.

Does changing the User-Agent stop fingerprinting?

Changing only the User-Agent is not enough.

A claimed browser identity may conflict with:

Supported APIs.
Rendering behavior.
WebGL output.
CSS features.
JavaScript behavior.
Client Hints.
Network characteristics.
Operating-system conventions.

Inconsistent spoofing can make a browser more distinctive or reveal that it has been modified.

Anti-fingerprinting works best when the browser manages a coherent set of standardized characteristics.

Can anti-fingerprinting extensions help?

Some privacy extensions can block trackers, scripts, or known fingerprinting resources.

They may be useful in an ordinary browser, depending on the user’s needs and the extension’s quality.

Extensions can also:

Increase browser uniqueness.
Add vulnerabilities.
Read sensitive page data.
Break websites.
Modify behavior in detectable ways.
Become abandoned.
Collect their own data.

Users should install only necessary extensions from trusted sources and keep them updated.

Additional extensions should not be installed in Tor Browser.

Practical ways to reduce fingerprinting

No ordinary browser configuration can guarantee that fingerprinting is impossible.

The following practices can reduce exposure.

Use an updated browser

Browser updates include security patches, privacy improvements, API changes, and anti-tracking protections.

Outdated browsers may expose known vulnerabilities and uncommon version information.

Enable built-in tracking protection

Modern browsers include protections that may:

Block known trackers.
Restrict third-party storage.
Limit fingerprinting scripts.
Partition site data.
Reduce exposed information.
Randomize selected outputs.
Standardize selected characteristics.

Protection names and behavior vary by browser.

Minimize extensions

Install only extensions that are necessary and trustworthy.

A smaller extension set reduces:

Attack surface.
Detectable customization.
Permission exposure.
Unusual blocking patterns.
Maintenance risk.

Avoid excessive customization

Highly unusual combinations of fonts, themes, browser settings, window sizes, language lists, extensions, and privacy modifications may make a browser easier to distinguish.

More customization does not always mean more privacy.

Limit site permissions

Do not grant camera, microphone, location, notification, USB, Bluetooth, clipboard, or other permissions unless they are necessary and expected.

Review permissions periodically.

Separate identities

Use separate browser profiles, operating-system accounts, qubes, or devices for activities that should not be linked.

Separation helps reduce shared cookies, history, and account state.

It does not guarantee different fingerprints, so behavioral and account separation remain important.

Avoid mixing anonymous and personal sessions

Do not log into personal accounts during a session intended to remain anonymous or pseudonymous.

One identifying login can connect the session to a real-world identity.

Use Tor Browser when anonymity matters

Tor Browser is designed to provide network privacy and browser-fingerprinting resistance as an integrated system.

Use its default settings and avoid additional extensions.

Treat VPNs correctly

A VPN changes the network path and visible IP address. It does not automatically standardize the browser.

Use a VPN for the protections it actually provides, not as a complete fingerprinting defense.

Understand private browsing limits

Private browsing can limit local history and session persistence, but it does not automatically prevent fingerprinting.

Block unnecessary third-party content

Reducing third-party scripts can reduce exposure to cross-site trackers.

Aggressive blocking may break websites and can create a distinctive configuration, so users should choose a balanced approach appropriate to their threat model.

Should users test their fingerprint?

Fingerprint-testing websites can demonstrate how browsers expose information.

Their results should be interpreted carefully.

A test may report that a browser is unique because:

Its visitor sample is small.
The sample is not representative.
Privacy-conscious users are overrepresented.
The test examines a specific set of characteristics.
The result reflects only one moment.
Browser defenses intentionally return standardized or randomized values.

Testing can be educational, but it does not prove that every tracker can identify the user.

Users should also remember that a fingerprint test must collect fingerprinting information in order to produce its result. Only use reputable educational tools and avoid repeated testing without a clear reason.

Common myths

“Clearing cookies gives me a completely new identity”

Clearing cookies removes some stored identifiers. It does not necessarily change the browser fingerprint, IP address, account behavior, or device characteristics.

“A VPN prevents browser fingerprinting”

A VPN changes the network path and visible IP address. Browser characteristics remain available unless the browser reduces them.

“Private browsing makes me anonymous”

Private browsing mainly limits local session state. It is not an anonymity system.

“The most hardened browser is always the least identifiable”

An unusually customized browser may become more distinctive. Privacy depends partly on blending into an appropriate user population.

“Fingerprinting always identifies one exact person”

A fingerprint often identifies or scores a browser profile. Linking it to a person usually requires additional information.

“Disabling one API stops all fingerprinting”

Fingerprinting can use many signals. Blocking canvas alone, for example, does not eliminate passive headers, screen data, language, timing, network characteristics, or other APIs.

“All fingerprinting is malicious”

Fingerprinting can support fraud prevention and account protection. The privacy impact depends on purpose, scope, retention, transparency, sharing, and user control.

“Tor alone prevents every fingerprinting risk”

Tor protects the network route. Tor Browser provides the browser-level defenses. Unsafe customization and identity mistakes can still create risks.

Fingerprinting resistance strategies

Browsers and standards developers use several general mitigation strategies.

Standardization

Browsers can return common values so that many users appear similar.

This is a major part of Tor Browser’s approach.

Reduction

Browsers can expose less detailed information.

For example, they may provide an approximate category instead of an exact hardware value.

Randomization

A browser can introduce controlled variation or noise into selected outputs.

Randomization must be implemented carefully. If each browser randomizes in a stable but unique way, the randomization itself can become an identifier.

Partitioning

A browser can separate storage, caches, or identifiers according to the top-level website.

This makes it harder for the same third party to recognize a user across unrelated sites.

Permission gating

Sensitive capabilities can require explicit user permission.

Permission prompts should be meaningful and should not appear so frequently that users approve them automatically.

Blocking

Browsers can block known fingerprinting scripts, domains, or behaviors.

List-based blocking may not detect new or first-party techniques.

Limiting precision

Reducing timer precision, screen detail, hardware detail, or other high-resolution information can make measurements less distinctive.

Privacy budgets and access limits

Web-platform designers have explored methods for limiting the total amount of identifying information a website can obtain.

Implementing such systems is difficult because web features interact and legitimate applications may require detailed information.

No single mitigation strategy solves every case.

Firefox fingerprinting protection

Firefox includes tracking protections that can block known fingerprinters and limit information exposed to suspected fingerprinting scripts.

Mozilla also develops broader fingerprinting-resistance mechanisms intended to reduce or standardize observable characteristics.

Protection can involve:

Blocking known tracking resources.
Limiting selected APIs.
Reducing system information.
Randomizing selected canvas behavior.
Partitioning storage.
Restricting third-party tracking.

Some advanced internal preferences are not intended as ordinary user-facing settings and may cause website compatibility problems.

Users should prefer supported privacy controls rather than copying random `about:config` recommendations without understanding their effects.

Browser compatibility and privacy

Fingerprinting defenses can create compatibility tradeoffs.

Websites may legitimately need device information for:

Responsive design.
Graphics performance.
Accessibility.
Media playback.
Language selection.
Hardware integration.
Fraud prevention.
Application optimization.

Reducing information too aggressively can:

Break websites.
Produce repeated permission prompts.
Reduce accessibility.
Lower graphics quality.
Disable useful applications.
Cause incorrect fraud alerts.

Privacy engineering requires balancing functionality with data minimization.

Websites should not collect every available characteristic simply because the browser exposes it.

Guidance for website owners

Website owners should treat fingerprinting information as privacy-sensitive.

A responsible approach includes:

Collect only what is necessary.
Define a specific purpose.
Avoid collecting high-entropy characteristics without need.
Do not use fingerprints as the sole authentication factor.
Minimize retention.
Limit internal access.
Avoid unnecessary third-party sharing.
Protect stored profiles.
Document how the information is used.
Review applicable privacy and consent requirements.
Test false-positive and false-negative rates.
Provide alternative verification paths.
Avoid penalizing users merely for enabling privacy protections.
Delete information when it is no longer needed.
Conduct privacy and security reviews.

Fraud prevention does not require unlimited data collection.

Fingerprints should not be passwords

A browser fingerprint is observable.

Unlike a password or private cryptographic key, many fingerprint characteristics are automatically revealed to websites.

For this reason, a fingerprint should not be treated as a secret credential.

It may support a risk score, but sensitive actions should use stronger controls such as:

Passwords.
Passkeys.
Hardware security keys.
Multi-factor authentication.
Transaction confirmation.
Device-bound cryptographic credentials.
Recovery procedures.

A fingerprint can indicate familiarity. It should not be the sole proof that a user is authorized.

False positives and accessibility

Fingerprinting and fraud systems can incorrectly classify legitimate users.

This may affect people who:

Use assistive technology.
Block scripts.
Use privacy browsers.
Share devices.
Use public computers.
Travel frequently.
Change networks.
Use enterprise-managed systems.
Update or repair hardware.
Use unusual language settings.
Depend on older devices.
Access services through Tor or a VPN.

Organizations should provide accessible alternatives when a risk system blocks or challenges a user.

Privacy-protective behavior should not automatically be treated as malicious behavior.

Fingerprinting and web development

Developers can reduce fingerprinting risk by asking:

Does this feature require exact information?
Can a less precise value work?
Can processing happen locally?
Can the information be discarded immediately?
Can access be limited to a user action?
Can the result be partitioned by site?
Could several low-risk values become identifying when combined?
Does a third-party library collect additional signals?
Is the feature documented in the privacy policy?
Has the implementation been reviewed for misuse?

Privacy should be considered during feature design, not only after deployment.

Browser fingerprinting and threat modeling

A threat model helps determine how important fingerprinting resistance is for a specific user.

Questions include:

Who may try to recognize the browser?
Is the concern advertising, fraud systems, an employer, a service provider, or a powerful observer?
Must different identities remain separate?
Is the user logging into accounts?
Is the network address hidden?
Is the same device used for personal and pseudonymous activity?
Would recognition cause inconvenience, profiling, or serious harm?
Can Tor Browser be used?
Are scripts necessary for the task?
What usability tradeoffs are acceptable?

An ordinary user avoiding advertising trackers has a different threat model from a journalist protecting a source or a researcher maintaining a sensitive identity.

The appropriate defenses should reflect the actual risk.

A safer browsing checklist

Before beginning a privacy-sensitive session:

Use an updated browser.
Use supported privacy protections.
Remove unnecessary extensions.
Review site permissions.
Close unrelated accounts.
Separate personal and research activity.
Avoid unusual browser modifications.
Understand whether a VPN or Tor is required.
Use Tor Browser for Tor-based anonymity.
Keep Tor Browser close to its default configuration.
Do not add extensions to Tor Browser.
Avoid personal logins in anonymous sessions.
Be cautious with unknown scripts and downloads.
Remember that private browsing is not anonymity.
Remember that clearing cookies does not erase every identifier.
Review the threat model regularly.

Browser fingerprinting and OPSEC

Operational security, or OPSEC, considers how separate pieces of information can be combined.

A browser fingerprint is only one piece.

Other identifying signals may include:

Writing style.
Login times.
Account reuse.
Usernames.
Email addresses.
File metadata.
Payment activity.
Social connections.
Repeated browsing patterns.
Network information.
Personal disclosures.

A user can have a standardized browser fingerprint and still reveal identity through behavior.

A user can also maintain careful behavior but expose a highly distinctive technical configuration.

Effective OPSEC addresses both technical and behavioral correlation.

FAQ

What is browser fingerprinting?

Browser fingerprinting is the collection and combination of browser, device, operating-system, rendering, and configuration characteristics to recognize or distinguish a browser.

Can browser fingerprinting work without cookies?

Yes. A website can attempt to recognize a browser from observable characteristics even when ordinary cookies are blocked or deleted.

Is a browser fingerprint always unique?

No. Fingerprints can be shared, partially distinctive, unstable, or probabilistic. Their usefulness depends on the signals and comparison population.

Can clearing browsing data remove a fingerprint?

Clearing browsing data removes some stored state but does not necessarily change characteristics such as the browser version, screen, language, graphics behavior, or operating system.

Does private browsing prevent fingerprinting?

No. Private browsing can limit local history and cookie persistence, but websites can still observe browser and device characteristics.

Does a VPN prevent fingerprinting?

No. A VPN changes the network path and visible IP address but does not automatically change the browser’s observable characteristics.

Does Tor prevent browser fingerprinting?

The Tor network hides the user’s direct network address from destination websites. Tor Browser adds browser-level protections intended to make users appear more similar. Both components are important.

Why should Tor Browser not be customized?

Custom settings and extensions can make one Tor Browser installation look different from other Tor Browser users, reducing the protection of the shared anonymity set.

Is canvas fingerprinting the only type?

No. Canvas is one technique among many. Fingerprinting can also use headers, screen information, fonts, WebGL, audio processing, hardware values, APIs, network characteristics, and behavior.

Is browser fingerprinting legal?

The legal treatment depends on the jurisdiction, purpose, disclosure, consent requirements, data use, and whether the fingerprint is linked to an identifiable person. Organizations should obtain qualified legal guidance.

Can a fingerprint reveal my real name?

A fingerprint normally identifies a browser profile rather than a name. It may become linked to a person when combined with an account, email address, payment record, IP history, or other identifying data.

Should I disable JavaScript?

Disabling JavaScript blocks many active techniques but does not stop passive or network-level fingerprinting. It can also break websites. Tor Browser users should use its supported Security Level controls.

Are fingerprint-testing websites accurate?

They can demonstrate exposed characteristics, but uniqueness results depend on the site’s visitor sample, tested signals, and measurement method. Results are educational, not absolute proof.

Which browser is best against fingerprinting?

The answer depends on the threat model. Tor Browser is specifically designed for anonymity and fingerprinting resistance. Mainstream browsers also provide various anti-tracking and anti-fingerprinting protections for ordinary browsing.

Can browser profiles separate identities?

Profiles can separate cookies, history, and account state. They may still expose similar technical fingerprints, so profiles should be combined with account and behavioral separation.

Final thoughts

Browser fingerprinting shows why online privacy is more complicated than deleting cookies or hiding an IP address.

A browser must reveal some information to display pages, play media, support accessibility, process graphics, select languages, and interact with hardware. Each individual value may appear harmless. Together, those values can form a recognizable profile.

Fingerprinting is not always exact and not always malicious. It can help defend accounts, detect fraud, control abuse, and identify automated activity. It can also support persistent tracking, cross-site profiling, re-identification, and correlation between identities.

The key questions are not only whether fingerprinting occurs, but:

What information is collected?
Why is it collected?
How distinctive is it?
How long is it retained?
Who receives it?
Is it linked to an account?
Can the user exercise meaningful control?
Is the system proportionate to the risk?

For users, the most effective strategy is not to modify every visible browser value independently. Random customization can create a more distinctive configuration.

Use updated browsers, supported privacy protections, minimal extensions, careful permission choices, identity separation, and a realistic threat model.

When anonymity matters, use Tor Browser as designed. Its protection comes partly from making users resemble one another, not from turning every user into a uniquely customized privacy experiment.

Browser fingerprinting cannot always be eliminated.

But it can be understood, reduced, and prevented from becoming the only barrier between a user and unwanted identification.

References and further reading