A cookie is a note a website leaves in your browser so it can recognize you next time. You can see it, block it and delete it. Fingerprinting gets the same result without leaving anything behind. The site asks your browser a series of ordinary questions, and the answers, taken together, are distinctive enough to recognize the browser when it comes back.
Nothing is stored on your device, so there is nothing to clear. Private browsing doesn't change the answers, and neither does a VPN. That is what makes fingerprinting attractive to trackers and awkward to defend against.
How a site recognizes a browser
Browsers describe themselves to websites for good reasons. A page needs to know the screen size to lay itself out, the language to pick a translation, the time zone to show the right hour, and what the graphics hardware can do before it starts a 3D scene. Each of these is available to any script on the page without a permission prompt.
A fingerprinting script collects a few dozen of these values, joins them, and reduces the result to a short identifier. If the same identifier turns up tomorrow, or on a different site running the same script, it is probably the same browser. Not all of this is hostile: banks and shops use the same technique to notice when a login comes from a device they have never seen.
The signals that matter
What the browser states outright
- User agent. A string naming the browser, its version and the operating system. It is sent with every request.
- Screen. Width, height, color depth, and the pixel ratio that separates a high-density display from a standard one.
- Time zone and languages. The zone your system clock is set to, and your preferred languages in order. An uncommon language list is a strong signal.
- Hardware hints. The number of processor cores, an approximate amount of memory on browsers that report it, and whether the device has a touch screen.
- Settings. Whether cookies are enabled and whether Do Not Track is switched on. Each setting you change from the default is one more bit of difference.
What the browser reveals by doing work
The more identifying signals come from asking the browser to produce something and measuring the result.
- Canvas. The script draws text and shapes on a hidden canvas and reads the pixels back. Differences in the graphics hardware, drivers, operating system and font rendering change the output slightly, so the same instructions give different pixels on different machines.
- WebGL. The 3D graphics interface can report the name of the graphics chip and driver, and rendered scenes vary the way canvas output does.
- Fonts. A page can measure how wide a piece of text renders in a long list of typefaces and work out which ones are installed. Fonts added by office suites, design tools or language packs make a list unusual.
- Audio. Generating a sound through the browser's audio processing, without playing it, and reading the resulting numbers gives small variations between systems.
The fingerprint check on this site shows fourteen of these values as your browser reports them: user agent, platform, languages, time zone, screen size and color depth, pixel ratio, processor cores, device memory, touch support, cookie and Do Not Track settings, the number of plugins, a short hash of a canvas drawing, and the WebGL renderer name. It marks the user agent, screen, canvas hash and WebGL renderer as the most identifying. It does not test fonts or audio. Everything is read by a script in the page and nothing is sent to the server.
Why the combination identifies you
No single value is a problem. Millions of people share your time zone. A great many share your screen size or your browser version. The trouble is that each answer divides the crowd again. Start with everyone in your time zone, keep only those with your language list, then your screen, then your exact browser and operating system version, then your graphics chip, then your canvas output. The group shrinks at each step, and after enough steps it can be a group of one.
Two limits are worth knowing. A fingerprint is a probability, not a serial number: two identical phones of the same model, freshly set up, can look alike. And fingerprints drift. A browser update changes the user agent, a new monitor changes the screen. Trackers handle this by matching fingerprints that are nearly the same, and by combining the fingerprint with other clues such as your IP address.
Why blocking can make you stand out
The instinctive response is to block or fake everything. This often backfires, because the goal is not to hide information. It is to look like many other people.
A browser that refuses to draw a canvas, reports an impossible screen size, or claims to be one browser while behaving like another is rarer than a browser that answers normally. A spoofing extension that randomizes one value while leaving the rest untouched creates a combination that no real device produces. A long list of privacy extensions can sometimes be detected through the changes they make to pages, and an unusual set is a signal of its own. Even Do Not Track works this way: turning it on adds one more answer that differs from the default.
Protection that works does one of two things. It makes every user of that browser give the same answers, so the crowd stays large. Or it gives different answers to each site and each session, so the identifier cannot be linked from one place to the next. Both have to be done by the browser itself, for all of its users, to be effective.
What realistically helps
- Use a mainstream browser with protection built in. Firefox, Brave and Safari each include defenses against fingerprinting, such as blocking known fingerprinting scripts or standardizing or randomizing some of the values above. Because every user of that browser gets the same treatment, turning these on does not single you out. Check the privacy settings and use the stricter level if sites you rely on still work.
- Keep it up to date and close to stock. The current version with default fonts and settings is the largest crowd available.
- Install fewer extensions. One well-known content blocker is useful, because a fingerprinting script that never loads collects nothing. A dozen obscure add-ons make you more distinctive, not less.
- Use Tor Browser when it matters. It is designed so that all of its users present the same fingerprint, and it hides your IP address as well. It is the strongest option and the least convenient one. Leave its settings and window size alone, since changing them undoes the uniformity.
- Separate activities. A second browser or a separate profile for things you don't want linked to your main browsing gives those activities a different fingerprint and a different set of cookies.
Do not chase a perfect score
Fingerprint tests are good at showing what is exposed. They are poor targets to optimize against. Being told your browser is unique among the visitors to a test site says as much about who visits test sites as it does about you, and tweaking settings until a number improves usually moves you further from the ordinary configuration that protects you.
Keep the rest of the picture in view too. A fingerprint only matters when a site has no easier way to recognize you. If you are logged in, it already knows who you are. If you give every site the same email address, that address links your accounts more reliably than any canvas hash, which is the case for using a disposable address where a signup doesn't deserve your real one.