Audio fingerprinting measures how your machine processes sound, not what it hears. Here is how the pipeline works and why it differs from device to device.
On this page
The signal, not the microphone
No microphone is involved.
Audio fingerprinting does not record anything, does not listen to your room, and does not touch your microphone. It asks your browser to generate a sound internally, then measures the numbers that come back, which differ from machine to machine in ways that stay stable over time. The result is another quiet identifier, gathered without a prompt.
Start with what is not happening. No audio is captured, no permission dialogue appears, and if your machine had no microphone at all the technique would work just as well. What gets measured is the arithmetic your system performs on a digital signal inside the browser, not anything you said or stored.
The oscillator pipeline
The mechanism uses the Web Audio API, a standard feature for playing and processing sound in the browser. A page can build a small processing chain and run a signal through it without any of it reaching your speakers.
oscillator— a source node produces a waveform at a chosen frequency, a low hum created purely in software.compressor— the signal passes through a dynamics compressor, the kind of processing used to even out loud and quiet parts of music. It applies a mathematical gain curve to the waveform.analyser— the analyser node samples the processed signal and returns its values as an array of floating-point numbers.hash— those values are combined and hashed into a short string. For the same browser on the same machine, it tends to come out the same.
The entire chain runs in well under a second and produces no audible result. You can generate your own value with the audio fingerprint test.
Why the output differs per machine
If the maths were exact and universal, every device would return identical numbers. It is not exact, and the differences come from several layers at once.
floating-point— calculations on decimal numbers are not precise, and different processors round the last digits differently. The Web Audio specification allows some latitude here, so browsers vary too.driver— the operating system’s sound driver and any processing it applies shift the values slightly before they are measured.sample rate— the configured sample rate and the audio hardware’s characteristics influence the running signal.engine build— different engine versions implement the processing graph with their own optimisations, which change the rounding.
Each of these is a tiny difference in the last decimal places. Combined, they are enough to tell two machines apart, and stable enough to recognise the same machine again on its next visit.
How it combines with canvas and the rest
The reason audio fingerprinting matters beyond its own signal is its role as a backup. Trackers rarely rely on one measurement. If canvas and WebGL are being randomised or blocked by a browser, audio is a second, independent source that may still be stable. A tracker that gets a clean answer here can re-link you even when its usual tools have been defeated.
The two work well together because the differences between them are complementary. Here is how their properties compare.
| Property | Canvas fingerprint | Audio fingerprint |
|---|---|---|
| What is measured | Rendered pixels | Processed samples |
| Permission needed | None | None |
| Storage on your device | None | None |
| Source of variation | GPU, driver, fonts | DSP, rounding, sample rate |
| Blocked by a VPN | No | No |
| Common defence | Randomise or block the read | Randomise or block the read |
Notice the last two rows. Neither technique is affected by hiding your IP address, because both describe your device rather than your connection.
On its own, an audio value is a useful but modest signal. Its value is that it is independent: it does not overlap much with what canvas, WebGL or your user agent reveal, so it adds discriminating power the others do not. In a full browser fingerprint it typically appears as one row among dozens, and it is the combination rather than any single row that makes you recognisable.
It is worth separating from the tools that genuinely reach your devices. Listing microphones and speakers is a different matter, and that one does involve your hardware: the media devices test shows what your browser can enumerate, though a site still cannot open a microphone without permission.
What a matching value does not prove
The honest advice mirrors what applies to other rendering signals. You cannot delete an audio fingerprint, because nothing is stored. A browser that adds noise to each reading, or refuses to run the processing graph at all, breaks the technique, but a browser that refuses everything quickly starts to look like no ordinary browser.
What an audio value does not do is name you. It recognises a machine, not a person, and only as one input among many. Two visits that return the same numbers suggest the same device; they do not tell a site who is sitting at it, and on their own they do not prove you are unusual. That conclusion comes from the combination, from audio plus canvas plus everything else agreeing at once.
So the practical move is to measure before you change anything. Run the audio fingerprint test and the browser fingerprint test together, and compare how much of your uniqueness comes from sound alone. If the audio row matters little, you have learned something worth knowing; if it matters a great deal, you know what a change is worth.