Browser fingerprinting is a technique that identifies a browser by collecting and combining characteristics such as its version, time zone, language, installed fonts, and screen resolution, often producing a combination unique enough to recognize it across sites. Unlike cookies, it stores nothing in the browser, so clearing cookies or switching to a VPN does not reset it.

Unlike a single signal such as User-Agent, a fingerprint combines many data points, which makes it far harder to spoof convincingly. An automated browser might get the User-Agent right but reveal itself through an unusual canvas-rendering signature or an inconsistent combination of screen size and device type. A proxy changes only the IP address, so on its own it doesn't change a browser's fingerprint.

Canvas fingerprinting, one common technique, draws a hidden image using the browser's graphics stack and hashes the pixel output, which varies subtly based on the device's GPU, drivers, and operating system even when every other setting looks identical.

Common Fingerprinting Techniques

Canvas is one of several techniques:

  • WebGL: reads the graphics vendor and renderer the browser reports.
  • Audio: processes a signal generated with the Web Audio API's OscillatorNode. The output varies from device to device.
  • Fonts: works out which fonts are installed, for example from how text is rendered and measured.
  • Passive signals: uses what every request already carries, such as the User-Agent header, without running any code on the device.

Browser Fingerprinting vs. Cookies

A cookie stores an identifier inside the browser, and the user can delete it. Fingerprinting is stateless. Nothing is stored on the device, and the identifier is worked out again from the browser's traits on each visit. That is why a fingerprint typically can't be cleared or reset. Passive fingerprinting runs no code on the device at all, so the browser has nothing it can observe.