← All articles

How Browser Fingerprinting Actually Works

2026-08-05 · 8 min read

Browser fingerprinting builds an identifier from properties your browser reveals to every website: screen size, timezone, language, installed fonts, graphics renderer, and how your machine draws an image or processes audio. Combined, these are stable and often unique — and unlike cookies, you cannot clear them.

The core idea

Any single property is unremarkable. Plenty of people have a 1920×1080 screen. Plenty run Chrome on Windows. But the combination of thirty such properties narrows the field dramatically, and it stays the same across sessions, incognito windows and cookie clearing.

The main signals

Canvas

The site draws text and shapes to a hidden canvas element and reads back the pixels. Tiny differences in GPU, graphics driver, font rasterisation and anti-aliasing produce slightly different pixel output on different machines. Hash that output and you get a stable identifier.

WebGL

Similar idea with 3D. The browser also exposes the unmasked renderer string — often something like the exact GPU model and driver. That is a strong signal on its own.

Fonts

A page can measure whether a given font renders at an expected width, and so enumerate which fonts you have installed. Font lists differ noticeably between operating systems, locales and machines with design software installed.

Audio

The Web Audio API processes a generated waveform. Floating-point differences between audio stacks produce a stable per-device value.

Screen and hardware

Resolution, colour depth, available screen area, device pixel ratio, CPU core count, approximate device memory, touch support.

Environment

Timezone, language list, platform string, user agent, and whether the browser reports as automated.

Why coherence beats randomisation

This is the part most guides skip, and it is the part that decides whether a profile survives.

Randomising every value independently produces combinations that do not exist in the real world: an iPhone user agent with a Windows font list, a 4K screen on a device reporting 2 GB of memory, a Linux platform string with a macOS graphics renderer.

Detection systems do not need to identify you specifically. They only need to notice that your combination is impossible. An impossible fingerprint is a much louder signal than a common one.

Where the IP fits

The fingerprint says what device you are. The IP says where you are. They have to agree.

• Timezone should match the IP's region
• Language headers should be plausible for that region
• A residential IP paired with a datacentre-typical fingerprint is a contradiction

What fingerprinting cannot do

• It cannot read files, other tabs, or anything outside the browser sandbox.
• It cannot identify you by name. It identifies a device — until you log into something that knows who you are.
• It is not perfectly stable forever. Driver updates, OS upgrades and new fonts shift real fingerprints too, which is exactly why platforms treat it as one signal among many rather than as proof.

Checking your own

Several public tools display the signals a site can read from your browser and estimate how unusual your combination is. Run one now, then run it again in a fresh incognito window. The numbers will barely move — which is the whole point.