Last updated: March 20, 2026

Browser fingerprinting is a tracking technique that identifies you based on your browser’s unique configuration, not cookies or IP address. Your browser reveals thousands of identifying characteristics: fonts installed, screen resolution, audio playback capabilities, GPU rendering differences, browser plugins, timezone, language settings, and yes, even how your mouse moves. Combined, these characteristics create a unique fingerprint that persists across private browsing, cookie deletion, and IP changes. Websites use fingerprinting to track you, advertisers use it to build profiles, and malicious actors use it for fraud prevention and account linking. Defending against it requires understanding which fingerprints are visible, how they’re collected, and which tools actually prevent identification.

Prerequisites

Before you begin, make sure you have the following ready:

Step 1 - How Browser Fingerprinting Works

Your browser is a complex piece of software with hundreds of configurable properties. Most of these properties are exposed to JavaScript running on websites, usually without your knowledge or consent.

The Data Collected

Canvas Fingerprinting: Canvas is a browser API for drawing graphics. Each browser renders graphics slightly differently due to:

A website draws the same text or pattern on a canvas on every computer, then hashes the resulting pixel data. Your GPU+font combination produces a unique pattern. Even if you have the same CPU as another user, different GPU = different hash.

// Simple canvas fingerprint example
const canvas = document.createElement('canvas');
const ctx = canvas.getContext('2d');
ctx.textBaseline = 'top';
ctx.font = '14px Arial';
ctx.fillText('Browser Fingerprint', 2, 2);
const hash = canvas.toDataURL(); // Unique output per browser

WebGL Fingerprinting: WebGL is a 3D graphics API. Similar to canvas, websites can:

WebGL reveals:

const canvas = document.createElement('canvas');
const gl = canvas.getContext('webgl');

// Directly identifies GPU vendor and capabilities
const debugInfo = gl.getExtension('WEBGL_debug_renderer_info');
const vendor = gl.getParameter(debugInfo.UNMASKED_VENDOR_WEBGL); // "Apple Inc."
const renderer = gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL); // "Apple M2"

These values are unique per GPU, and most browsers don’t randomize them.

Audio Context Fingerprinting: Web Audio API allows analyzing audio capabilities and rendering. Websites can:

const audioContext = new (window.AudioContext || window.webkitAudioContext)();
const oscillator = audioContext.createOscillator();
oscillator.frequency.value = 10000;
// Subtle differences in oscillator output reveal audio driver

Font Enumeration: Fonts installed on your system leak identifying information. A website can:

function detectFont(fontName) {
  const canvas = document.createElement('canvas');
  const ctx = canvas.getContext('2d');
  ctx.font = `12px Arial`;
  const widthDefault = ctx.measureText('abcdefghijklmnopqrstuvwxyz').width;

  ctx.font = `12px ${fontName}`;
  const widthTest = ctx.measureText('abcdefghijklmnopqrstuvwxyz').width;

  return widthDefault !== widthTest; // Font is installed
}

This was so common that browsers now restrict font enumeration, but circumvention techniques still exist.

Screen Dimensions and Color Depth:

// Trivial to detect
console.log(`${window.screen.width}x${window.screen.height}x${window.screen.colorDepth}`);
// Output: "1920x1080x32"
// Only ~500 common combinations exist, but exact dimensions are identifying

Timezone and Locale:

// Reveals timezone independent of IP
const timezone = Intl.DateTimeFormat().resolvedOptions().timeZone; // "America/New_York"
const language = navigator.language; // "en-US"

Browser Plugins:

// Enumerates all installed plugins
Array.from(navigator.plugins).map(p => p.name);
// Output - ["Google Chrome PDF Plugin", "Chrome PDF Viewer", "Native Client Plugin", ...]

User Agent:

// Heavily fingerprinting even with randomization
navigator.userAgent; // "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)..."

Performance Metrics: High-resolution timers reveal subtle timing differences that are fingerprinting:

performance.now(); // Can measure CPU performance and cache behavior
// Timing differences under 1 millisecond can identify CPU model

HTTP Headers: Even before JavaScript, servers see:

WebRTC Leaks: WebRTC (real-time communication) APIs can leak your local IP address:

const pc = new RTCPeerConnection({iceServers: []});
pc.createDataChannel('');
pc.createOffer().then(offer => pc.setLocalDescription(offer));
pc.onicecandidate = (ice) => {
  if (!ice || !ice.candidate) return;
  const ipRegex = /([0-9]{1,3}(\.[0-9]{1,3}){3})/;
  const ipAddress = ipRegex.exec(ice.candidate.candidate)[1]; // Your actual local IP!
};

Your local IP, combined with other fingerprints, can identify you even through VPN.

Fingerprinting in Practice - How This Becomes Your Profile

A website like Everify or MaxMind combines hundreds of signals:

  1. Canvas fingerprint (GPU+font)
  2. WebGL fingerprint (GPU driver)
  3. Audio context fingerprint (audio driver)
  4. Screen resolution (1920x1080 narrows to ~30% of internet users)
  5. Timezone (EDT narrows further)
  6. Plugins (Google Chrome PDF is narrow)
  7. Fonts (Arial + Helvetica + DejaVu = Windows common)
  8. Browser version (Chrome 124 released March 2024)
  9. OS indicators from User-Agent

With 8-10 signals combined, your fingerprint is unique among millions. With 15+ signals, uniqueness approaches 99.9%.

If you visit site-a.com and site-b.com, trackers can correlate:

Even without cookies, trackers identify you as the same person across different sites.

Step 2 - Measuring Your Fingerprint Uniqueness

Online Fingerprinting Tests

Panopticlick (Electronic Frontier Foundation): Visit https://panopticlick.eff.org/

BrowserLeaks: Visit https://browserleaks.com/

FingerprintJS: https://fingerprint.com/

Running these tools is eye-opening. Most users find they’re unique among millions.

Step 3 - How to Prevent and Mitigate Fingerprinting

Browser-Level Defenses

  1. Tor Browser Tor Browser is purpose-built to prevent fingerprinting.

What Tor does:

Your fingerprint is identical to ~1 million other Tor users. You’re not uniquely identified; you’re one of millions.

Trade-off - Some sites don’t work well on Tor (sites that heavily rely on JavaScript, high-resolution graphics).

  1. Firefox with Privacy Hardening

Firefox doesn’t prevent fingerprinting by default, but hardening helps.

Settings to enable:

// about:config settings for fingerprinting resistance
privacy.resistFingerprinting = true  // Enables fingerprinting defenses
privacy.trackingprotection.enabled = true  // Block tracking
privacy.fingerprintingProtection = true  // Enable Canvas randomization
privacy.fingerprintingProtection.overrides = "+CANVAS"  // Canvas randomization

What this does:

Limitations:

  1. Chrome/Chromium Options

Chrome offers less fingerprinting protection than Firefox.

What Google does:

Reality - Chrome is worse for privacy than Firefox or Tor. Google profits from tracking, so their privacy features are minimal.

Browser Extensions

Extensions attempt to block fingerprinting:

Canvas Fingerprint Blocker:

Effectiveness - ~80%. Some sophisticated trackers detect the extension’s randomization.

NoScript/uBlock Origin:

Effectiveness - 100% (but breaks web)

Privacy Badger:

Effectiveness - ~30% (not fingerprint-specific)

HTTPS Everywhere + Script Blocking: Combine HTTPS with JavaScript blocking to prevent fingerprinting. But this breaks most modern websites.

System-Level Defenses

  1. Virtual Machine Running browser in VM with fake hardware:
    • Fake GPU (VirtualBox GPU often identified as “NVIDIA Corporation”)
    • Consistent screen resolution (VM resolution)
    • No real plugins
    • Can reset VM state regularly

Limitations:

  1. Dedicated Hardware Use identical device to thousands of others:
    • iPhone users mostly identical (same GPU, same screen, same browser)
    • Windows users with baseline laptop more similar

Reality - Still identifiable within similar device cohort. iPhone 15 users are ~40 million people, not a perfect anonymity set.

  1. Randomized Settings Regularly change:
    • Screen resolution (change zoom level)
    • Language
    • Timezone
    • Etc.

Limitations:

Advanced - Creating Resistance

Custom Browser Compilation

Build Tor Browser or ungoogled-chromium yourself with additional hardening:

Build custom Tor Browser with additional canvas randomization
./mach build
... compile with fingerprinting defenses enabled

This requires significant technical knowledge but provides maximum control.

Headless Browser Fingerprinting (For Developers)

If you’re building services, test fingerprinting detection:

// In your application, test if browser is fingerprintable
async function testFingerprinting() {
  const tests = {
    canvas: () => {
      const canvas = document.createElement('canvas');
      const ctx = canvas.getContext('2d');
      ctx.textBaseline = 'top';
      ctx.font = '14px Arial';
      ctx.fillText('Test', 2, 2);
      return canvas.toDataURL();
    },
    webgl: () => {
      const canvas = document.createElement('canvas');
      const gl = canvas.getContext('webgl');
      if (!gl) return 'blocked';
      // ... WebGL tests
    },
    fonts: () => {
      // Font enumeration test
    }
  };

  const results = {};
  for (const [test, fn] of Object.entries(tests)) {
    try {
      results[test] = fn();
    } catch (e) {
      results[test] = 'blocked';
    }
  }
  return results;
}

This helps you understand what your users’ browsers reveal.

Step 4 - Practical Strategy: Balancing Privacy and Usability

For most users:

  1. Use Firefox with privacy.resistFingerprinting = true
  2. Install uBlock Origin (blocks trackers)
  3. Keep browser updated
  4. Avoid plugins (Flash, etc.)
  5. Clear cookies regularly

This provides ~70-80% protection without breaking sites.

For higher privacy (journalists, activists):

  1. Use Tor Browser for sensitive browsing
  2. Use separate Firefox profile for everyday use
  3. Keep both updated
  4. Accept that some sites won’t work perfectly on Tor

This provides ~95% protection (some trade-offs with usability).

For maximum anonymity:

  1. Use Tails OS (includes Tor Browser)
  2. Accept reduced usability
  3. Don’t log into identifying accounts
  4. Use in isolation (new session each time)

This provides ~99% protection.

Step 5 - What Sites Are Actually Using Fingerprinting?

According to research studies:

Step 6 - Limitations of Fingerprinting Defense

Even perfect fingerprinting defense (Tor Browser) has limitations:

Behavioral tracking - How you navigate is identifiable. If you have a distinctive browsing pattern (always visit sites A, B, C in sequence), you’re trackable.

Login defeat - If you log into your email account, all anonymity is defeated.

Side-channel leaks - Timing attacks, power analysis, other side-channel attacks could theoretically identify hardware.

Future techniques - As defenses improve, trackers will develop new fingerprinting vectors.

The best defense is behavioral - don’t voluntarily identify yourself (login to identifying accounts), and assume you’re somewhat identifiable if your browsing pattern is distinctive.

Step 7 - Test Your Defenses

After implementing defenses, test them:

  1. Run Panopticlick before and after
  2. Check BrowserLeaks for WebGL, WebRTC, DNS leaks
  3. Use browser developer tools to see what JavaScript can access
  4. Test actual site functionality (does everything work?)

Good results:

Troubleshooting

Configuration changes not taking effect

Restart the relevant service or application after making changes. Some settings require a full system reboot. Verify the configuration file path is correct and the syntax is valid.

Permission denied errors

Run the command with sudo for system-level operations, or check that your user account has the necessary permissions. On macOS, you may need to grant terminal access in System Settings > Privacy & Security.

Connection or network-related failures

Check your internet connection and firewall settings. If using a VPN, try disconnecting temporarily to isolate the issue. Verify that the target server or service is accessible from your network.

Frequently Asked Questions

How long does it take to prevent it?

For a straightforward setup, expect 30 minutes to 2 hours depending on your familiarity with the tools involved. Complex configurations with custom requirements may take longer. Having your credentials and environment ready before starting saves significant time.

What are the most common mistakes to avoid?

The most frequent issues are skipping prerequisite steps, using outdated package versions, and not reading error messages carefully. Follow the steps in order, verify each one works before moving on, and check the official documentation if something behaves unexpectedly.

Do I need prior experience to follow this guide?

Basic familiarity with the relevant tools and command line is helpful but not strictly required. Each step is explained with context. If you get stuck, the official documentation for each tool covers fundamentals that may fill in knowledge gaps.

Is this approach secure enough for production?

The patterns shown here follow standard practices, but production deployments need additional hardening. Add rate limiting, input validation, proper secret management, and monitoring before going live. Consider a security review if your application handles sensitive user data.

Where can I get help if I run into issues?

Start with the official documentation for each tool mentioned. Stack Overflow and GitHub Issues are good next steps for specific error messages. Community forums and Discord servers for the relevant tools often have active members who can help with setup problems.

Related Articles

Built by theluckystrike. More at zovo.one