What is browser fingerprinting — and why consistency beats randomness

Clearing your cookies used to be enough to start fresh on a website. It isn’t anymore. Modern websites can recognize a browser from the way it looks and behaves — its fingerprint — even in a private window, and often after you change your IP address.

This guide explains what a browser fingerprint is, which signals it is built from, how unique it really is according to the research, and why the most important property of a fingerprint is not that it is unique, but that it is consistent.

The short version

• A browser fingerprint is the combination of details a website can read about your browser and device, such as screen, graphics card, fonts, language and time zone.
• It needs no permission and stores nothing on your device, so deleting cookies and opening a private window don’t change it.
• Large studies found that between a third and almost 90% of browsers have a fingerprint no other browser in the sample shares.
• Randomizing values to hide is risky: random values contradict each other, and contradictions are easy to detect.
• A good fingerprint is consistent, stable and common: it looks like millions of ordinary devices.

What is browser fingerprinting?

Browser fingerprinting is a way of recognizing a browser by collecting many small facts about it and combining them into one identifier. Some facts arrive with every request in HTTP headers. Many more can be read with a few lines of JavaScript. On its own, each fact is shared by millions of people. Combined, they often describe exactly one browser.

Signal	What it reveals	Example
User agent and client hints	Browser, version and operating system	Chrome 141 on Windows 11
Screen	Resolution, pixel ratio and color depth	2560 × 1440 at 2×
Hardware	CPU cores and approximate memory	10 cores, 8 GB
Graphics (WebGL)	GPU model and driver	Apple M2 Pro
Canvas and audio	Tiny rendering differences caused by hardware, drivers and fonts	A stable hash such as 9f3a…e21c
Fonts	Which fonts are installed	214 detected
Language and time zone	Preferred languages and clock settings	en-US, America/Vancouver
Network	Your IP address, plus any extra addresses WebRTC exposes	198.51.100.24

None of these needs a permission prompt, and none of them is stored on your computer. That is why fingerprinting survives cookie deletion and private browsing: there is nothing to delete.

How fingerprinting works, step by step

1. Collect. A script reads dozens of values in a few milliseconds, usually while the page loads.
2. Combine. The values are hashed into a short identifier, for example F2F8-E777-B20B.
3. Match. The identifier is compared with ones seen before. Real systems don’t need an exact match: researchers showed with FP-Stalker that fingerprints can be linked even as they change with browser updates, and in their dataset browsers could be followed for 54 days on average.

How unique is your browser fingerprint?

Uniqueness is measured in bits of identifying information. Every bit halves the number of browsers that could be yours: one bit splits the crowd in two, ten bits narrow it to 1 in about 1,000, twenty bits to 1 in about a million. About 33 bits are enough to tell apart everyone on Earth, because 2³³ is roughly 8.6 billion.

Three large studies measured how often real fingerprints are unique:

Study	Fingerprints	Unique
Panopticlick, EFF (2010)	470,161	83.6% (94.2% with Flash or Java enabled)
AmIUnique (2016)	118,934	89.4% (81% of mobile fingerprints)
Hiding in the Crowd (2018)	2,067,942	33.6% (18.5% of mobile fingerprints)

The gap between the studies matters. The first two collected data on sites that people visited to test their privacy, which attracts unusual setups. The 2018 study used visitors to one of France’s most popular websites, a more ordinary crowd, and browsers had also dropped plugins like Flash that used to leak a lot. Phones were the hardest to tell apart, because millions of iPhones of the same model share almost everything.

Two caveats keep that lower number from being reassuring. A fingerprint that isn’t unique still narrows you down to a small group, and combined with your IP address it is often enough. And the same study found that non-unique fingerprints are fragile: change a few attributes and many of them become unique.

Our 30-second browser personality test estimates how rare your own combination of 18 signals is, so you can see where you stand.

Who uses browser fingerprinting?

• Fraud prevention and account security. Banks, payment providers and marketplaces use fingerprints to notice a login from a device they have never seen, or one account being opened from the same device over and over.
• Bot detection. Anti-bot services check whether a browser’s details are consistent with a real device, rather than an automated one pretending to be human.
• Advertising and tracking. Fingerprinting lets ad networks follow a browser from site to site without cookies. In February 2025 Google stopped prohibiting fingerprinting by advertisers using its ad products; the UK’s data protection regulator, the ICO, called the change “irresponsible”.
• Account linking. Platforms connect accounts that keep appearing from the same fingerprint. This is what affects teams who legitimately run many accounts, like an agency managing ads for twenty clients or a seller running separate stores in different regions: to the platform, they all look like one device.

In the EU and the UK, fingerprinting for tracking falls under the same ePrivacy rule as cookies. European regulators have said since 2014 that it is covered by Article 5(3) of the ePrivacy Directive, which generally requires consent unless the access is strictly necessary for a service the user asked for.

The naive fix: randomize everything

The obvious answer is to make every value random. Many simple privacy extensions do exactly that: a new random user agent here, some noise on the canvas there.

The problem is that randomness creates contradictions, and contradictions are much easier to detect than any single value:

• A Windows user agent, but a graphics card that only exists in Macs.
• A clock set to São Paulo, but an IP address in Frankfurt.
• navigator.platform says one operating system while the client hints say another.
• The browser claims one version in its user agent and another in its client hints.
• The canvas output changes on every page load, which no real device does.

This isn’t just theory. In 2018 researchers built FP-Scanner, a test suite that looks for exactly these contradictions. It detected the fingerprint-altering tools they tested from the inconsistencies those tools introduced, and in some cases recovered the real browser and operating system they were trying to hide.

Real devices are boring. Their values fit together, and they stay the same from visit to visit. A fingerprint that is unique but impossible stands out far more than one that looks like millions of ordinary computers.

Randomization can work when it is done carefully. Brave’s “farbling” adds small random changes with a seed per site and per session, so a site sees the same values for the whole session and different sites can’t link them. That is very different from new noise on every page load.

How browsers protect you today

• Tor Browser takes the opposite approach to randomization: it makes all its users look as alike as possible, down to standard window sizes, so no one stands out.
• Brave randomizes selected values per site and per session, as described above. You can try it without installing anything in a temporary cloud browser on WebTraceCheck, our sister site.
• Firefox 145 (November 2025) expanded its fingerprinting protections; Mozilla says they cut the share of users seen as unique by almost half. They debuted in private windows and in Strict tracking protection.
• Safari 26 (September 2025) stops known fingerprinting scripts from reliably reading APIs that reveal device characteristics, such as screen size, CPU core count and 2D canvas.

Whatever you use, a few habits help. Keep your browser up to date and close to its default settings. Be wary of exotic fonts and long lists of extensions, which make you rarer. Avoid “random user agent” extensions, for the reasons above.

What a good fingerprint looks like

A believable browser identity has three properties:

1. Consistent: every signal agrees with every other one — operating system, user agent, client hints, GPU, fonts, screen, language, time zone and IP location.
2. Stable: the same values come back every time the profile is used, just like a real device.
3. Common: values are drawn from real-world hardware, so the profile blends in instead of standing out.

This is also what antidetect browsers promise to teams that manage many accounts: a separate, consistent profile for each one. If you are comparing them, our antidetect browser directory summarizes what users report about each, with links to every source.

Check your own browser

Curious what websites see about you right now? Our free browser fingerprint check reads the same signals detection systems use and shows which ones contradict each other, including WebRTC leaks and time zone mismatches. It runs entirely in your browser, and we don’t store the results.

For a quicker, more playful version, take the 30-second browser personality test: it tells you which of eight browser types you are and roughly how many browsers share your setup.

Frequently asked questions

Does incognito mode stop fingerprinting?

No. A private window doesn’t keep cookies or history, but your screen, graphics card, fonts, language and time zone stay exactly the same, so your fingerprint barely changes.

Does a VPN stop fingerprinting?

A VPN changes your IP address and nothing else. The rest of your fingerprint stays the same, and a time zone that doesn’t match your VPN’s location can itself stand out.

Is browser fingerprinting legal?

It depends on the purpose and the place. Fraud prevention and security are widely accepted uses. In the EU and the UK, fingerprinting for advertising or tracking is treated like cookies and generally needs your consent.

Can I change my browser fingerprint?

You can change parts of it, by switching browsers, devices or settings. But changing it at random tends to backfire. The goal is not a different fingerprint on every visit, but one that looks like a normal device.

Sources

• Peter Eckersley, How Unique Is Your Web Browser?, Privacy Enhancing Technologies Symposium, 2010.
• Pierre Laperdrix, Walter Rudametkin and Benoit Baudry, Beauty and the Beast: Diverting modern web browsers to build unique browser fingerprints, IEEE Symposium on Security and Privacy, 2016.
• Alejandro Gómez-Boix, Pierre Laperdrix and Benoit Baudry, Hiding in the Crowd: an Analysis of the Effectiveness of Browser Fingerprinting at Large Scale, The Web Conference, 2018.
• Antoine Vastel, Pierre Laperdrix, Walter Rudametkin and Romain Rouvoy, FP-Scanner: The Privacy Implications of Browser Fingerprint Inconsistencies, USENIX Security Symposium, 2018.
• Antoine Vastel, Pierre Laperdrix, Walter Rudametkin and Romain Rouvoy, FP-STALKER: Tracking Browser Fingerprint Evolutions, IEEE Symposium on Security and Privacy, 2018.
• Pierre Laperdrix, Nataliia Bielova, Benoit Baudry and Gildas Avoine, Browser Fingerprinting: A survey, ACM Transactions on the Web, 2020.
• European Data Protection Board, Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive, 2024.
• Information Commissioner’s Office, Our response to Google’s policy change on fingerprinting, 2024.
• Mozilla, Firefox expands fingerprint protections, 2025.
• WebKit, News from WWDC25: Web technology coming this fall in Safari 26 beta, 2025.
• Brave, Fingerprinting defenses 2.0.