Browser Fingerprinting Explained

Browser fingerprinting is a way for a website to recognize your browser by collecting and combining details about it and your device, instead of storing anything on your computer. Because nothing is stored, clearing your cookies does not remove it.

This guide covers the definition, the signals a fingerprint uses, how to test your own browser, and what Firefox, Brave, Tor Browser and Safari do about it. Sources were checked on October 22, 2026.

The short answer

A fingerprint is built from many small details, such as your browser version, time zone, language, fonts and screen size. Any one detail is common, yet the whole set can point to a single browser.

You cannot reliably eliminate browser fingerprinting, but you can reduce the information websites can collect and make your browser harder to distinguish.

A browser that blocks or limits fingerprinting, plus a test on EFF's Cover Your Tracks tool, is a practical start.

Browser fingerprinting definition

MDN's glossary defines fingerprinting as picking out a particular browser, and through it a particular user, by gathering and combining features that set the browser and its operating system apart.

The W3C's guidance uses a broader wording. It describes fingerprinting as a site's ability to recognize a visitor, browser or device again from its settings or other observable traits.

What goes into a fingerprint

MDN lists examples of what a fingerprint might include. Any one of these is ordinary, and the combination is what identifies you.

EFF puts it as a set of traits that belong to one person's browser and hardware. It adds that seemingly insignificant data, like screen resolution and installed fonts, is stitched together by tracking scripts.

Passive and active fingerprinting

The W3C describes two kinds of fingerprinting, and defenses treat them differently.

For some groups of people, the W3C notes, the User-Agent string and IP address together often identify one browser on their own.

Browser fingerprinting examples

Signal	What it reveals	Type
User-Agent header	Browser, version and operating system	Passive
IP address	Network location	Passive
Time zone and language	Where you probably are	Active
Installed fonts	A set that differs between computers	Active
Screen size and resolution	Your display setup	Active
Codec support	What media your system can play	Active

The Type column follows the W3C's definitions, applied by us to each signal. A signal that needs code on your device is active, and one visible in the request itself is passive.

Why clearing cookies does not help

Why small details add up

This is an illustration, not a measurement. Suppose one setting is shared by one browser in ten. If three such details were independent, only about one browser in a thousand would match all three.

Real details are not independent, so real numbers differ. What matters is the combination: when several signals are distinguishing enough, they can narrow the crowd you blend into.

A signal almost everyone shares adds little, and signals that move together add less than independent ones. That is why the W3C talks about increasing the anonymity set.

A cookie is stored on your device, so you can delete it. EFF uses an analogy of a tracking tag that can be knocked off.

A fingerprint is computed from what a site can observe, so there is nothing for you to delete.

FingerprintJS, an open-source library, shows the idea in practice. It says its identifier stays the same in private mode and when browser data is purged, unlike cookies and local storage.

That is the project's own claim, tested on its own setup. Results depend on your browser, its settings and any privacy protections, so treat it as an illustration and not a guarantee.

Browser fingerprinting test

EFF's Cover Your Tracks is a tool for understanding how unique and identifiable your browser makes you online. It is also a research project on the techniques of online trackers.

Run it, note the result, change one setting or browser, and run it again under the same conditions, such as the same window and settings.

Treat a single result as a snapshot and not a verdict, because browsers and trackers keep changing.

A distinctive result does not prove you can be tracked, and a good result does not prove you cannot. A browser can resist tracking effectively even when a test still calls its fingerprint distinctive.

Browser fingerprinting on GitHub

FingerprintJS is public on GitHub under the MIT license. It reads attributes from the browser and turns them into a hashed visitor identifier.

The attributes are the raw signals, and the identifier is a number derived from them. The project page links to a demo you can try yourself.

Open the demo, note the identifier, then open it in a private window. The project says the identifier stays the same.

Treat your own result as a demonstration for your browser and settings, not a rule. The identifier can change when your settings, exposed attributes or privacy protections change.

How browsers fight fingerprinting

Firefox warns that its protection can break some sites. For example, scripts that detect emoji support may fail to detect it.

Why blocking is hard

The W3C is direct about the limits. It says that completely eliminating fingerprinting by a determined adversary, using only widely deployed technical means, is implausible, and that its mitigations are mitigations and not solutions.

Its guidance names three approaches. Reduce the data a site can read. Make browsers look more alike, which it calls increasing the anonymity set. Make fingerprinting detectable so that it can be spotted and blocked.

How to avoid browser fingerprinting

This section is our advice, built on the sources above.

EFF's guide names the Tor Browser as the most realistic protection it knew of, and suggests Privacy Badger or NoScript for daily use. That page is undated, so check each browser's own documentation for what it does today.

What a realistic plan looks like

This section is our advice, matched to how much effort you want to spend.

Fingerprinting attempts you may notice

You rarely see a fingerprinting attempt directly. Firefox's documentation describes the fingerprinter lists it blocks, and Brave and Tor Browser handle the problem in the background.

Related guides

Fingerprinting is one of the three main web tracking methods. Our guide to how online tracking works compares it with cookies and pixels. On a phone, our guide to App Tracking Transparency covers the apps side.

Canvas and WebGL fingerprinting

Two techniques give a fingerprint much of its power. In canvas fingerprinting, a page draws hidden text and shapes and reads back the pixels. Small differences in fonts, graphics drivers and rendering software make the result differ between machines.

WebGL fingerprinting does something similar with 3D graphics. A page can ask which graphics renderer the browser is using, and test how it draws. Neither technique shows anything on screen, and neither needs a cookie.

A test you can reproduce

I wrote a short script that draws a canvas, reads the graphics renderer and collects ordinary browser settings.

I ran it in headless Chromium, twice with identical settings and once with a different language, time zone, screen and user agent. Each run started with a fresh browser profile and no stored data.

Run	Canvas hash	Whole fingerprint
A, default settings	f0273c4e3402	8752035de2e8
B, same settings again	f0273c4e3402	8752035de2e8
C, different language, time zone, screen and user agent	5458d3f57e6f	d4d3dec1a357

Runs A and B produced identical results even though both started clean, with no cookies and no history. The fingerprint came from the browser and the machine, not from stored data.

Run C changed the language, the time zone, the user agent and the pixel ratio, and the canvas hash changed with them.

The graphics renderer in my test was a software one, so my machine looked generic. On a real computer, the renderer string usually names the graphics hardware, which adds identifying detail.

This was a simple test on one machine, so treat it as an illustration and not a measurement of how unique anyone is.

How much does a fingerprint reveal?

Each attribute narrows the crowd. An attribute shared by half of all browsers adds one bit of information. One shared by one in a thousand adds ten bits. Bits add up across independent attributes.

Shared by	Information added
1 in 2 browsers	1.0 bits
1 in 10 browsers	3.3 bits
1 in 50 browsers	5.6 bits
1 in 1,000 browsers	10.0 bits

About 33 bits are enough to single out one person among 8 billion. That is my arithmetic, and attributes are not fully independent, so real figures differ.

The point is that a handful of mildly unusual settings can add up fast.

The Electronic Frontier Foundation's Cover Your Tracks project, formerly called Panopticlick, studies exactly this. It analyzes how unique your browser looks compared with other visitors, and it began as a 2010 research project on browser uniqueness.

Why the usual habits fall short

Private browsing windows start with no stored data, which is what my test did, and the fingerprint stayed the same.

So a private window does not change what the site can measure about your device. This is our reading of the test, and browsers differ in what extra protection they add.

A VPN changes your network address. That is one attribute among many, so the rest of the fingerprint still travels with you. Clearing cookies has no effect on a fingerprint, because none of it is stored on your device.

Two defensive strategies

Defenses fall into two camps. The first is to make many people look the same. If every browser in a group reports the same values, the fingerprint no longer separates them.

The second is to add noise, so that the values change from one visit to the next and cannot be matched.

Both have costs. Making browsers look alike can mean hiding useful details such as your exact screen size or fonts.

Adding noise can break sites that rely on canvas drawing, such as image editors and games, and some sites treat inconsistent results as a sign of fraud.

What to do today

These steps are our advice. None is perfect, and combining them helps more than any one.

Fingerprinting is not always sinister

Some sites use fingerprints to protect you. A bank can notice that a login comes from a device it has never seen and ask for extra proof.

That is also why blocking every signal can cause trouble, such as repeated security checks.

The line between fraud prevention and tracking is about purpose and consent. Our guides to online tracking and to app tracking transparency cover related controls.

Frequently asked questions

What is browser fingerprinting?

It is identifying a browser by collecting and combining details of the browser and the system underneath it, such as its version, fonts, time zone and screen size.

How does fingerprinting differ from cookies?

No. Cookies are stored on your device and can be deleted. A fingerprint is computed from observable details, so it is not stored on your device.

Can I block browser fingerprinting completely?

Not with certainty. The W3C calls full elimination implausible, but browsers can limit it.

Does private mode stop it?

Not by itself. FingerprintJS says its identifier stays the same in private mode, though results vary by browser and settings.

How do I test my browser?

Use EFF's Cover Your Tracks, change one thing, and test again.

Does private browsing stop fingerprinting?

Not by itself. In my test, a fresh profile with no stored data produced the same fingerprint twice.

Does a VPN hide my fingerprint?

It changes your network address, which is one attribute. Your browser and device details still travel with you.

How can I check my fingerprint?

Use the Electronic Frontier Foundation's Cover Your Tracks test, and treat the result as a snapshot.

A quick checklist

• Run Cover Your Tracks and note the result.
• Use a browser that documents fingerprinting protection.
• Avoid add-ons that fake your browser's identity.
• Test again after every change.
• Install browser updates when they appear.

Up nextiPhone privacy settings to changeFingerprinting works alongside the settings on your phone. See our guide to iPhone privacy settings to change.→