On this page
Browser fingerprinting is a way for websites to recognise a browser from the values it reveals, without storing anything on your device. A script reads dozens of properties, such as your screen size, timezone, fonts and graphics card, and combines them into an identifier. Because the combination is often unique, the same browser can be recognised across visits, sites and accounts, even after you clear cookies.
You can see your own fingerprint with our free browser fingerprint test.
Why fingerprinting works
Each value on its own is common. Millions of people use Chrome on Windows with a 1920 × 1080 screen. But each extra value narrows the field. Add the timezone, the language list, the exact graphics driver, the fonts you have installed and the tiny rendering differences of your GPU, and very few browsers share the full set.
Unlike cookies, a fingerprint does not need to be stored, so it survives private browsing, cookie clearing and, in many cases, a VPN.
The main fingerprinting techniques
User agent and client hints
The user agent string names your browser, version and operating system. Chromium browsers also send client hints, structured values for platform, architecture and full version. These are the first values a site checks, and they must agree with each other.
Screen and hardware
Screen width and height, available screen area, device pixel ratio, colour depth, CPU core count (hardwareConcurrency) and rounded device memory. These describe the physical machine.
Canvas fingerprinting
The page draws text and shapes into an invisible canvas and reads back the pixels. Your GPU, graphics driver, operating system and fonts all affect anti-aliasing and blending, so the result differs slightly between machines. A hash of the image becomes a stable identifier.
WebGL fingerprinting
WebGL exposes the graphics card’s vendor and renderer, for example ANGLE (NVIDIA, GeForce GTX 1650, D3D11), plus dozens of parameters such as maximum texture size and supported extensions. Sites also render a 3D scene and hash the output, in the same way as canvas.
Audio fingerprinting
An OfflineAudioContext processes a test tone through filters and compressors. Floating-point differences in the audio stack produce a slightly different output on each system.
Fonts
The set of installed fonts depends on the operating system, its language packs and the software you have installed. Sites measure text in many fonts to see which exist.
Timezone and language
The timezone and language list say roughly where you are. Sites compare them with your IP address: a browser in Asia/Ho_Chi_Minh time with an IP in Germany is unusual.
WebRTC
WebRTC can reveal your public IP address and sometimes your local network address, even when you browse through a proxy. Check yours with the WebRTC leak test.
Consistency: what sites really check
Modern anti-fraud systems do not only collect values; they check whether the values make sense together. Common checks include:
| Check | Example of a mismatch |
|---|---|
User agent vs navigator.platform |
Windows user agent, MacIntel platform |
| User agent vs client hints | Chrome 120 in the user agent, a different version in client hints |
| OS vs fonts | macOS claimed, Windows-only fonts present |
| OS vs graphics | macOS claimed, a Direct3D renderer reported |
| Page vs worker | A web worker reports different values from the page |
| Timezone vs IP | Timezone in one country, IP address in another |
This is why random fingerprint changers often make things worse. A browser with random values is unique and inconsistent, which is the easiest kind to flag.
How to protect against fingerprinting
There are three approaches, each with a different goal.
- Blend in. Tor Browser and some privacy browsers make every user report the same values, so no one stands out. It works when everyone uses the same browser, but it limits what you can customise.
- Add noise. Some browsers add small random changes to canvas and audio output for each site or session. This breaks cross-site tracking but can look unusual.
- Separate identities. An antidetect browser gives each profile its own complete, consistent fingerprint. Each profile is stable over time, so it looks like one ordinary device, but different profiles cannot be linked to each other.
If you need to run several accounts that should not be connected, the third approach is the one that fits. NexLogin builds every profile from one coherent device and keeps those values the same in the page, iframes and workers.