Skip to content
Irregularpedia Logo Irregularpedia

Browser Fingerprinting

Browser Fingerprinting

Section titled “Browser Fingerprinting”

Cookies are easy to block. Fingerprinting is harder: instead of storing an identifier on your device, a site measures dozens of characteristics of your browser and hardware and combines them into a near-unique signature. Because the signature is recomputed each visit, clearing cookies and using “private” mode does nothing to stop it.

Fingerprinting is used for cross-site tracking, fraud detection, and — most relevant here — linking your “anonymous” sessions back to your real identity.

What fingerprinting measures

Section titled “What fingerprinting measures”

A fingerprint is the combination of many individually-unremarkable signals. Common ones:

TechniqueWhat it exploits
CanvasThe site draws hidden text/graphics to a <canvas> and reads back the pixels; tiny rendering differences between GPUs, drivers, and OSes make the output device-specific
WebGLSame idea using the 3D pipeline — exposes GPU vendor and renderer strings
Font enumerationWhich fonts are installed (and how they render) varies by OS and installed software
Screen & windowResolution, color depth, device pixel ratio, viewport size
Timing / hardwareperformance.now() resolution, CPU core count, available memory, audio-stack quirks
Headers & localeUser-Agent, Accept-Language, timezone, platform

The danger is entropy: each attribute narrows the crowd. A timezone alone is weak, but timezone + screen size + fonts + canvas hash is frequently unique among millions of browsers. Test your own at the EFF’s Cover Your Tracks or amiunique.org.

Mitigations that actually work

Section titled “Mitigations that actually work”

The only robust defense is uniformity — looking identical to a large crowd of other users — not uniqueness. Two browsers are engineered for this:

  • Tor Browser — the gold standard. It normalizes screen size (letterboxing), spoofs a single common User-Agent for all users, restricts fonts, and adds canvas/WebGL prompts so every Tor Browser user looks the same. Combined with the Tor network it also hides your IP.
  • Mullvad Browser — Tor Browser’s anti-finger­ printing engineering without the Tor network, for use with a trusted VPN. Same “make everyone look identical” philosophy.

What is theater

Section titled “What is theater”

Many popular “anti-tracking” measures do little against fingerprinting and can make things worse by making you stand out:

  • Spoofing the User-Agent or installing a grab-bag of privacy extensions — inconsistent, rare combinations are more identifiable, not less.
  • Randomizing values per-visit without a coherent strategy — a browser whose canvas hash changes every load is itself a distinctive signal.
  • Most VPNs and “private browsing” alone — these hide your IP or local history but leave the fingerprint fully intact. Useful, but not anti-fingerprinting.

Hardened general-purpose browsers (e.g. Brave’s fingerprint randomization, Firefox’s privacy.resistFingerprinting) are a reasonable middle ground for everyday use, but for genuine anonymity rely on the uniformity model above.

Putting it together

Section titled “Putting it together”

Fingerprinting is one layer of identity leakage. Pair browser uniformity with hiding the network path and scrubbing what you upload:

Section titled “Related”