Browser Fingerprinting: How Websites Identify You Without Cookies or IP Addresses

The Tracker You Cannot Delete

You cleared your cookies. You use a VPN. You disabled JavaScript on a few sites. You feel anonymous, but a website you have never visited before already knows it is you.

Browser fingerprinting is a passive tracking technique that collects dozens of data points exposed by your browser and device configuration. No cookies, no logins, no IP address required. The combination of these signals is often unique enough to identify you reliably across browsing sessions, devices, and even when you switch networks.

This article explains how fingerprinting works, why it is effective, and what practical steps you can take to reduce your fingerprint surface.

What Is Browser Fingerprinting?

Browser fingerprinting is the process of collecting a set of attributes exposed by your web browser to create a unique “fingerprint.” If the combination of these attributes is distinctive enough, the fingerprint can identify you across websites without ever storing data on your device.

The technique was popularized by research from Electronic Frontier Foundation with their Panopticlick project (now Cover Your Tracks), which demonstrated that over 84% of browser visits could be uniquely identified based on their fingerprint alone.

Unlike cookies, fingerprinting:

• Leaves no trace on your device
• Survives cleared browser data and private browsing modes
• Works across different websites and domains
• Requires no user interaction or login

The Data Points That Make Up Your Fingerprint

Modern browsers expose a surprising amount of information. Here are the primary categories fingerprinting scripts collect.

User Agent String

Your browser’s User-Agent header reveals your browser name and version, operating system, and sometimes the device type. Example:

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36

This string alone narrows the field considerably. Add the OS version and it becomes more precise.

Screen Resolution and Color Depth

Your monitor’s resolution (e.g., 1920 x 1080), color depth (24-bit), and display scaling factor are all exposed via the Canvas API and CSS media queries. A 4K display user looks different from a laptop user.

Canvas Fingerprinting

The HTML5 Canvas element allows JavaScript to draw graphics. Due to minute differences in how graphics hardware, drivers, and browsers render text and shapes, the pixel output varies by system. Fingerprinting scripts draw specific text and shapes, extract the pixel data as a hash, and use it as a unique identifier.

Research published in the Proceedings of the ACM Conference on Computer and Communications Security showed canvas fingerprinting successfully identifies browsers with high entropy: meaning it adds significant uniqueness to a fingerprint.

WebGL and GPU Information

WebGL exposes:

• GPU vendor and renderer (e.g., “Intel Iris Xe Graphics”)
• Supported WebGL extensions list
• Maximum texture size
• Vertex and fragment shader precision formats

These details vary by graphics card model and driver version, adding another distinctive layer.

Installed Fonts

JavaScript can enumerate which fonts are available on your system by measuring how text renders. If a specific font is present, text dimensions will differ compared to a fallback font. Font lists vary significantly between users, especially those with productivity software or design tools installed.

Timezone and Language Settings

Your system timezone (e.g., “America/New_York”), primary language, and accepted language list are all exposed via JavaScript APIs and HTTP headers. These are common attributes, but they narrow the candidate pool when combined with other signals.

WebRTC and Network Information

Even with a VPN, WebRTC can expose your local IP address. While VPNs often block this, WebRTC fingerprinting can still reveal:

• ICE candidate details
• Network latency characteristics
• MDNS candidate addresses (Firefox)

Audio Fingerprinting

The Web Audio API can be used to fingerprint your audio stack. Processing a sound through audio nodes (oscillators, compressors, gain nodes) produces minute differences based on hardware and driver implementations. These differences are measurable and reproducible.

Hardware Sensors (Mobile)

On mobile devices, accelerometer, gyroscope, and magnetometer data exposed via the DeviceMotion and DeviceOrientation APIs add further distinguishing information. Not all devices report the same sensor readings or calibration values.

Browser Extensions and Plugins

Certain JavaScript probes can detect the presence of specific browser extensions by checking for extension-specific objects, DOM elements, or URL patterns. uBlock Origin, privacy-focused browsers, and ad blockers each leave faint traces.

HTTP Header Fingerprints

HTTP headers sent by your browser include Accept, Accept-Language, Accept-Encoding, and others. The exact combination and order varies by browser and version.

Why Fingerprinting Is Effective

The power of fingerprinting comes from combining many low-entropy signals into a high-entropy overall identifier.

Screen resolution alone is not unique. Many users have 1920 x 1080 displays. But add canvas fingerprint, WebGL renderer, installed fonts, timezone, and user agent, and the combination becomes statistically unique.

The math backs this up. EFF’s Cover Your Track research found:

Number of Fingerprint Attributes	Estimated Uniqueness
1	~5% of browsers
5	~25% of browsers
10	~50% of browsers
20+	~85-95% of browsers

This means with 20 attributes, a website can identify approximately 9 out of 10 visitors without cookies or logins.

Who Is Using Fingerprinting?

Fingerprinting is used across the web:

• Advertising networks use fingerprinting to track users across sites even when cookies are blocked, maintaining user profiles for targeted advertising.
• Analytics platforms use fingerprinting as a fallback when cookies are unavailable, preserving session tracking capabilities.
• Fraud detection systems use fingerprinting to identify bots, account creation attempts, and replay attacks.
• Subscription services use fingerprinting to detect users creating multiple free accounts to bypass usage limits.

Major fingerprinting providers include companies like FingerprintJS, which offers fingerprinting as a commercial service. Similar scripts are embedded on an estimated 10-15% of the top 10,000 websites.

Practical Defense Strategies

Completely eliminating fingerprinting is nearly impossible: your browser must reveal some attributes to function. The goal is to reduce fingerprint uniqueness to blend into a larger group.

Use a Privacy-Focused Browser

Tor Browser is the gold standard for fingerprinting resistance. It deliberately standardizes fingerprints across all users, making everyone look identical. This is achieved by:

• Reporting a uniform screen resolution (though this can break some sites)
• Blocking or standardizing Canvas, WebGL, and Audio API outputs
• Using a consistent User-Agent string for all users
• Resetting browser state between sites

The tradeoff: Tor Browser is slower for everyday use and some websites block Tor exit nodes.

Firefox with hardening settings offers a middle ground. Enable the following in about:config:

privacy.resistFingerprinting: true
webgl.disabled: true
media.navigator.enabled: false

privacy.resistFingerprinting in Firefox spoofs many attributes to generic values, reducing uniqueness at the cost of some site compatibility.

Brave Browser includes built-in fingerprint randomization. Instead of blocking fingerprinting APIs, Brave randomizes their outputs on each site visit, making cross-site tracking unreliable.

Use Extension-Based Defenses

• uBlock Origin blocks many known fingerprinting scripts
• CanvasBlocker spoofs canvas fingerprinting output
• Privacy Badger (EFF) learns to block trackers including fingerprinting scripts
• Decentraleyes localizes CDN resources to reduce tracking vectors

Reduce Installed Fonts and Extensions

The fewer fonts and extensions you have installed, the smaller your fingerprint surface. Use system fonts instead of installing custom font packages. Keep extensions minimal and well-known.

Avoid Unique Configurations

Your fingerprint is most distinctive when it diverges from common configurations. Using default browser settings, standard screen resolutions, and common OS versions helps you blend in rather than stand out.

Disable JavaScript (Selective)

JavaScript is the primary vector for active fingerprinting. Disabling it entirely breaks most modern websites, but browser extensions like NoScript (Firefox) or ScriptSafe allow selective blocking. Only allow JavaScript on trusted sites.

Use Multiple Browsers for Different Activities

Using one browser for sensitive activities and another for general browsing creates separation. Fingerprints are tied to specific browser instances, so separate browsers have separate fingerprints.

The Privacy-Usability Tradeoff

Every fingerprinting defense involves a tradeoff between privacy and convenience:

Method	Privacy Gain	Usability Cost
Tor Browser	Very High	High (slow, site breakage)
Firefox + hardening	High	Medium (some site issues)
Brave randomization	High	Low
Browser extensions	Medium	Low
Disable JavaScript	High	Very High

Most users will benefit most from Brave’s built-in randomization or Firefox with privacy.resistFingerprinting enabled, balancing reasonable privacy with everyday usability.

What You Can Still Manage

Awareness is growing, and browser vendors are actively improving built-in protections. Firefox’s resistFingerprinting mode, Brave’s randomization, and Tor Browser’s standardization all represent genuine progress.

The practical reality is that most users do not need to eliminate fingerprinting entirely: they need to blend in. Using a privacy-focused browser, keeping extensions minimal, and understanding what signals your browser exposes are the first steps toward a smaller, less distinctive fingerprint.