Browser Fingerprinting: What It Is and How to Reduce It

For years, “clear your cookies” was the standard advice for avoiding online tracking. But websites and advertising networks have another technique that does not need to store anything on your device: browser fingerprinting. By collecting dozens of small, harmless-looking details about your browser and hardware, they can often recognise the same device across visits and across websites. Here is how it works, who uses it, and what really helps.

What is a browser fingerprint?

A fingerprint is a combination of characteristics that, taken together, is likely to be unique to your device. No single detail identifies you – millions of people use Chrome on Windows – but the combination of browser version, screen size, installed fonts, graphics card, time zone, language and rendering quirks can narrow it down to one in many thousands or even millions. Because these details rarely change, the fingerprint can stay stable for weeks or months.

See what your own browser reveals with our browser fingerprint test – it runs entirely in your browser and nothing is sent to us.

The main fingerprinting techniques

Passive signals

Some information is sent with every request, without any scripts: your IP address, the user agent string, accepted languages and other HTTP headers.

Active signals (JavaScript)

• Canvas fingerprinting: the site draws text and shapes on a hidden canvas and reads back the pixels. Tiny differences in graphics hardware, drivers, fonts and anti-aliasing change the result.
• WebGL fingerprinting: similar, using 3D rendering, plus the graphics card vendor and renderer strings.
• Audio fingerprinting: generating and processing a sound with the Web Audio API produces device-specific floating-point differences.
• Font detection: measuring how text renders reveals which fonts are installed.
• Screen and hardware: resolution, pixel ratio, colour depth, number of CPU cores and device memory (see our screen resolution tool).
• Settings and features: time zone, preferred languages, whether cookies or Do Not Track are enabled, and which browser features are supported.

Who uses fingerprinting – and why

• Fraud prevention and security. Banks, payment providers and login systems compare your device’s fingerprint with previous visits. A login from an unfamiliar device can trigger extra verification. This is the most common and least controversial use.
• Bot detection. Automated scripts often have inconsistent or unusual fingerprints, which helps sites block scrapers and fake sign-ups.
• Advertising and tracking. Some trackers use fingerprints to follow users across sites even after cookies are cleared. Privacy regulations such as the GDPR and ePrivacy rules treat this like cookies – it generally requires consent in the EU and UK.

What doesn’t help as much as you think

• Private or incognito mode – stops cookies and history being saved, but the hardware and browser details are the same.
• A VPN – changes your IP address but not your browser. Your fingerprint is unchanged.
• Changing lots of settings by hand – a rare combination of tweaks can make you more unique, not less.
• Many privacy extensions – each extension can alter the page in detectable ways, adding to your uniqueness.

What actually helps

1. Choose a browser with built-in protection

• Brave randomises canvas, WebGL and audio results per site and per session (“farbling”), so fingerprints cannot be linked across sites.
• Firefox blocks known fingerprinting scripts in its Enhanced Tracking Protection (Strict mode), and has a stronger privacy.resistFingerprinting option that makes all users look alike – at the cost of some website breakage.
• Safari presents a simplified system configuration to trackers, making many Macs and iPhones look the same.
• Tor Browser offers the strongest protection by making every user look identical: same window size steps, same fonts, same time zone.

2. Blend in rather than stand out

There are two strategies: randomisation (your fingerprint changes constantly, so it is useless for tracking) and uniformity (you look like everyone else). Both work; mixing ad-hoc changes does not. Use a browser’s built-in protections instead of DIY tweaks.

3. Keep things up to date

Modern browsers are steadily reducing what they expose – for example, Chromium browsers now send a reduced user agent and hide local IP addresses in WebRTC by default. Staying current gives you these improvements automatically.

4. Block third-party trackers

Fingerprinting for advertising usually runs in third-party scripts. A content blocker such as uBlock Origin, or your browser’s tracking protection, prevents many of these scripts from loading in the first place.

5. Separate your identities

Use different browsers or browser profiles for different activities – for example one for banking and personal accounts, another for general browsing. Fingerprints and cookies stay within each profile.

How to test your progress

1. Open our fingerprint test and note the canvas, WebGL and audio hashes.
2. Reload the page. If the hashes change, your browser is randomising them.
3. Open the test in a different browser or profile and compare.

Summary

Browser fingerprinting identifies devices from many small details rather than stored cookies. It is widely used for fraud prevention and sometimes for tracking. A VPN or private window will not hide it. The most effective defences are a browser with built-in anti-fingerprinting, blocking third-party trackers, keeping your browser up to date and avoiding unusual customisations.