What Is Browser Fingerprinting and How Does It Track You?

Browser fingerprinting identifies you without storing anything on your device. Most people picture online tracking as a cookie: a little file a website drops on your computer to remember you. Clear your cookies, the thinking goes, and you start fresh. Fingerprinting breaks that assumption completely, because it looks at the unique way your particular browser and device behave rather than at anything they left behind.

The unsettling part is that every ingredient is mundane on its own. Your screen size, your time zone, the fonts you have installed, the way your graphics card draws a line — none of it is secret, and none of it identifies you by itself. But stack forty of these details together and the combination becomes startlingly rare. Often it is unique among millions of visitors.

Where the signal comes from

A fingerprint is assembled from attributes your browser hands over freely, either to render pages correctly or because a script simply asked. None of them is a password, a name or an account; each is an ordinary property of the browser and the machine beneath it. Together they fall into a few families.

Declared strings

Your user agent, languages and platform announce your browser, version and operating system. This is the easiest family to read, and the easiest for a site to log.

Hardware hints

Screen resolution, colour depth, CPU core count and available memory describe the machine. None of these values is unusual on its own; together they start to narrow the field.

Rendering quirks

This is the powerful part. Ask the browser to draw text or 3D graphics off-screen, and the exact pixels that come back differ slightly between devices.

Installed software

The set of fonts your system carries is surprisingly individual, shaped by your OS, your apps and your language.

The rendering tricks that do the heavy lifting

The most durable signals come from asking your browser to render something and then measuring the result precisely. None of them asks permission, because on the surface they are just ordinary features that legitimate sites use every day.

Canvas fingerprinting tells the browser to draw text and shapes onto a hidden canvas, then reads back the pixels. Because your GPU, graphics driver and anti-aliasing settings all influence the output, two devices rarely produce identical pixels. The image is invisible to you; only its hash is kept.

WebGL fingerprinting goes further, rendering a 3D scene and reading both the pixels and the reported graphics hardware — often the exact GPU vendor and model.

Audio fingerprinting applies the same idea to sound, processing a signal through the Web Audio engine and measuring tiny numerical differences in how your system handles it.

Put the three together and the point is not any one measurement but the fact that they are taken at all. Nothing is installed and nothing is stored; the browser is simply asked to do ordinary work, and the output is noted.

Why the combination is so identifying

Individually, these details are common. Plenty of people share your screen size or your browser version. The magic — or the menace — is in the multiplication. Each attribute narrows the crowd, and independent attributes multiply together.

The measure researchers use is entropy, counted in bits. Every bit of entropy halves the population that matches you. At around 20 bits, you are one in a million; at 33 bits, you are effectively unique on Earth. A rich fingerprint routinely gathers more than that. You can see the running estimate for your own browser on the fingerprint test.

Twenty bits is twenty halvings of the group you sit in. Thirty-three is enough to shrink it to one. The arithmetic arrives there quickly, and no single attribute on the list looks worth counting on its own — which is exactly why the total is so easy to underestimate.

Cookies versus fingerprints

It is worth being clear about how this differs from the tracking you already know.

The difference in the last two rows is the one that matters. We explore the trade-off in depth in cookies versus fingerprinting.

Why there is nothing to delete

Because a fingerprint is computed fresh each visit from things that are inherently yours, there is nothing to delete. Clearing your cookies or opening a private window does not change the reading, because the reading was never stored in the first place. There is no file to refuse, no list to empty, and no setting that switches the computation off.

That is exactly why it has become the tracking method of choice when cookies are blocked or cleared. A cookie can be refused, or removed, or left to expire, and the tracking stops with it. The fingerprint is simply taken again, from the same browser that has not changed between the two visits, and that second reading matches the first.

Can you stop it?

Not entirely, but you can blunt it. The counter-intuitive truth is that trying to be unusual often backfires, and the strategies that genuinely help are about blending into a crowd rather than stepping out of one.

• Trying to be unusual — exotic fonts, rare extensions, spoofed values — often makes you more identifiable, not less.
• Using a mainstream browser in its default configuration blends you into the largest group.
• Choosing a browser like Tor deliberately makes many users look identical, which is the point.

We have a full, practical walkthrough in how to reduce your browser fingerprint. The honest summary is that awareness comes first: the estimate in the list below is worth more than any abstract description of the risk.

A short checklist

Understanding the problem starts with seeing your own setup plainly.

1. Run the fingerprint test and read the running estimate.
2. Note which attributes stand out, rather than which are merely present.
3. Resist the urge to alter the unusual ones, since that is often what makes you rare.

That is the whole of it. No explanation conveys the problem as clearly as the estimate for your own browser, and you have just seen it.