Device Fingerprinting: How Hardware and OS Signals Track You Beyond the Browser

The Fingerprint Is in the Hardware

Browser fingerprinting is the well-known threat. Far fewer people know that the fingerprinting attack surface extends well beyond the browser: into your operating system, GPU, audio stack, battery sensor, and the firmware running on your hardware itself.

Where browser fingerprinting resets when you close a tab, device fingerprinting persists across sessions, reinstalls, and factory resets. It survives VPN connections, private browsing, and Tor. Understanding every layer is the only way to know which privacy measures actually move the needle.

This article covers every device fingerprinting vector in use today, ranked by prevalence and trackable uniqueness.

How Device Fingerprinting Differs from Browser Fingerprinting

Browser fingerprinting operates within the web rendering context. It uses JavaScript APIs exposed by the browser: canvas rendering, WebGL, font lists, plugin enumerations. Resetting the browser or clearing data disrupts it.

Device fingerprinting operates below the browser. It uses signals that originate in the operating system and hardware:

• Hardware characteristics: GPU model, CPU instruction sets, screen resolution, battery sensor data
• OS-level signals: Installed fonts at the system level, kernel version, device driver versions
• Peripheral fingerprints: Webcam and microphone device IDs, connected USB device lists, Bluetooth MAC addresses
• Firmware-level data: BIOS/UEFI versions, hardware UUIDs, ACPI tables

These signals are not accessible to JavaScript in a properly sandboxed browser, but they are accessible to native applications, mobile apps, browser extensions, and in some cases, websites using clever side-channel techniques.

The Hardware Vectors

GPU Fingerprinting

Your GPU is one of the most uniquely identifying components in your system. WebGL exposes detailed GPU information including:

• GPU vendor and renderer strings
• Supported shader precision formats
• Video card model and driver version
• Unusual GPU configurations (e.g., laptop with external GPU)

GPU fingerprinting is persistent because most users do not change their GPU. The combination of GPU model + driver version + OS creates a highly unique signature.

How to reduce exposure:

• Use a browser with GPU spoofing (Firefox with privacy.resistFingerprinting, Brave Shields set to aggressive)
• Disable WebGL entirely in browser settings for maximum protection
• A virtual machine with a standardized GPU passthrough removes hardware-level fingerprinting but introduces VM fingerprints

CPU Instruction Sets and Hardware Features

Modern CPUs expose a wide range of hardware features through CPUID and other low-level instructions. Websites can detect:

• CPU vendor (Intel, AMD, ARM) and model
• Number of physical cores and logical processors
• SIMD instruction set support (SSE, AVX, NEON)
• Hardware security features (AES-NI, SGX, TrustZone)
• Thermal throttling states

CPU characteristics are relatively stable per device and are difficult to spoof without significant performance overhead.

What helps:

• Firefox’s privacy.resistFingerprinting masks some CPU signals
• Using a VM can present a generic CPU profile
• Mobile devices are harder to fingerprint this way due to narrower hardware diversity

Screen Resolution and Display Characteristics

Display fingerprinting goes beyond resolution. It includes:

• Native resolution vs. scaling factor
• Color depth and color profile
• Monitor refresh rate
• Multi-monitor setups and arrangement
• DPI settings
• HDR support

This data is accessible via the Screen Resolution API and CSS media queries. Even at identical resolutions, color profiles and display configurations vary by device.

What helps:

• Firefox’s privacy.resistFingerprinting spoofs resolution to a set of common values
• Brave randomizes some display signals
• Using a standard resolution (e.g., 1920x1080) and 100% scaling reduces uniqueness
• Avoid custom color profiles for general browsing

Audio Stack Fingerprinting

The Web Audio API exposes enough audio hardware and software configuration to create a fingerprint. AudioContext and its AnalyserNode expose:

• Audio sample rate
• Output latency characteristics
• Audio processing pipeline details
• Hardware audio codec information

This fingerprint is surprisingly unique. A 2020 study found the AudioContext fingerprint identifiable for over 90% of tested devices.

What helps:

• Firefox’s privacy.resistFingerprinting blocks the AudioContext API in some configurations
• Some privacy extensions (e.g., Canvas Blocker) do not cover audio fingerprints
• Disabling audio in your browser eliminates this vector but breaks audio-dependent sites

Battery Status API

The Battery Status API (now removed from most browsers but still accessible via extensions and some browser configurations) exposed:

• Battery charge level
• Time to full charge
• Time to discharge

Battery level is a surprisingly identifying signal. Research showed battery level could be combined with other signals to track users across sessions with high accuracy.

Current status: Most browsers have removed this API. If you use an older browser or a specialized one, consider disabling the Battery Status API.

Camera and Microphone Device IDs

Native applications and some browser contexts can enumerate connected media devices. The MediaDevices API allows enumeration of:

• Available cameras (with device labels)
• Microphones (with device labels)
• Device manufacturer and model information

Device labels (e.g., “FaceTime HD Camera”) are unique per device and persist across sessions.

What helps:

• Grant camera/microphone permissions only to trusted sites
• Use browser settings to reset device permissions periodically
• Firefox blocks device label enumeration by default in recent versions

Connected Devices (USB, Bluetooth)

Native applications can enumerate connected USB devices and Bluetooth devices. This includes:

• USB device make and model
• Bluetooth device names
• USB device serial numbers

This is primarily a concern with native applications, not browsers. Mobile apps frequently request access to device enumeration permissions.

What helps:

• Review app permissions on mobile and desktop
• Avoid granting USB/Bluetooth enumeration permissions to untrusted apps
• On desktop, consider using a sandboxed environment for untrusted applications

Operating System-Level Fingerprinting

OS Version and Build Number

Your operating system’s version, build number, and update state are accessible via JavaScript (navigator.oscpu, navigator.platform, navigator.userAgent) and are sent in HTTP headers.

Commonly exposed signals:

• Windows version and build (e.g., Windows 11 23H2)
• macOS version and build (e.g., macOS 14.5)
• Linux distribution and kernel version
• Android/iOS version and device model

OS version is one of the more difficult signals to spoof because it requires running a different operating system.

What helps:

• Using Firefox with privacy.resistFingerprinting reports a generic OS fingerprint
• Tor Browser reports a generic Linux OS regardless of actual OS
• Virtual machines with standardized OS images eliminate OS-level uniqueness

System Fonts

Installed system fonts vary significantly by OS, installed software, and user configuration. Font fingerprinting detects:

• List of all installed system fonts
• Font rendering characteristics
• Font hinting and subpixel rendering settings

This is accessible via the Canvas API and CSS font enumeration. A unique font list is one of the strongest fingerprinting signals.

What helps:

• Firefox’s privacy.resistFingerprinting limits font enumeration to a standard list
• On macOS, avoid installing non-standard fonts for general browsing
• Clear installed fonts from system if privacy is critical

Kernel and System Configuration

Native applications and some browser exploits can detect:

• Kernel version and build configuration
• System uptime
• Loaded kernel modules / running processes
• ACPI table contents

This is primarily a concern for high-value targets and forensic analysis rather than web tracking. Most websites cannot access kernel-level data from a browser context.

Firmware and Hardware UUIDs

Hardware UUID

Motherboards, CPUs, and network cards each have a unique identifier assigned at the factory. These UUIDs can be read by:

• Native applications with appropriate permissions
• Firmware-level exploits
• Some mobile apps

What helps:

• On some hardware, you can reset the MAC address randomization
• Using network address randomization (available in iOS, Android, Windows 11, macOS)
• Firmware UUIDs are not accessible from standard web contexts but are accessible to privileged native software

BIOS/UEFI Fingerprints

The BIOS or UEFI firmware exposes specific version strings, hardware configuration, and ACPI tables. While not accessible from a browser, this data is readable by:

• Operating system utilities (dmidecode on Linux, wmic on Windows)
• Bootkits and firmware-level malware
• Pre-boot authentication environments

For most users, this vector is not relevant to web privacy. It matters for high-security threat models and forensic analysis.

Mobile-Specific Vectors

IMEI and Device Serial Numbers

Mobile devices carry persistent hardware identifiers that are accessible to applications:

• IMEI (International Mobile Equipment Identity): unique to the device hardware
• Device serial number: assigned by the manufacturer
• SIM card ICCID

Apps with appropriate permissions can read these identifiers. Google and Apple have restricted access in recent OS versions, but some apps still obtain them.

Cellular Network Information

Mobile browsers can access:

• Carrier name and country
• Mobile country code (MCC) and mobile network code (MNC)
• Connection type (4G, 5G, Wi-Fi calling status)

This data is less uniquely identifying than other vectors but, combined with others, adds to the fingerprint.

Accelerometer and Gyroscope Calibration Data

Mobile device sensors have calibration data that varies by device due to manufacturing tolerances. This data can be accessed via the DeviceMotion and DeviceOrientation APIs and is sufficiently unique to serve as a fingerprinting vector.

What helps:

• Disable motion sensors in browser settings when not needed
• iOS and Android have restricted access to sensor data in recent versions
• Using a privacy-focused mobile browser (e.g., Firefox Focus) limits sensor access

How Fingerprints Are Combined Across Layers

The real tracking power comes from combining signals across layers. A single signal (your GPU model) might identify 1 in 1000 users. Combine it with:

• Installed system fonts
• Screen resolution and color profile
• OS version and build
• Audio stack configuration
• Browser and browser version

And you have a fingerprint that is statistically unique among billions of devices.

This is why clearing cookies and using a VPN only partially disrupts tracking. The device fingerprint persists independently of session-level identifiers.

What Actually Reduces Device Fingerprinting

Method	Effectiveness	Usability Impact
Firefox resistFingerprinting	High	Moderate (breaks some sites)
Tor Browser	Very High	High (slow, some sites break)
Brave Shields (Aggressive)	High	Low
Virtual Machine with standardized image	Very High	High (performance overhead)
Disabling JavaScript	Very High	Breaks most modern websites
System font reduction	Moderate	Low
Mobile: Firefox Focus / Tor	High	Low
MAC address randomization	Low (network layer only)	None

Measuring Your Device Fingerprint

Use these tools to check your current device fingerprint:

• AmIUnique.org: Comprehensive browser and device fingerprint analysis
• Cover Your Tracks (EFF): Shows your fingerprint’s uniqueness and identifies active vectors
• PixelScan: Tests screen fingerprinting and canvas fingerprinting
• Audio Fingerprint Test: Specific test for the AudioContext fingerprint

Run tests before and after applying privacy configurations to measure actual improvement.

Raising the Cost of Identification

Device fingerprinting is pervasive because it operates below the layers most privacy tools target. VPNs, cookie deletion, and incognito mode do not stop it.

Browser-level protections that spoof or block hardware-level APIs, standardized environments like Tor Browser that make you look like everyone else, and OS-level hardening that limits what applications can enumerate all reduce it.

The goal is to raise the identification cost high enough that your device blends into a sufficiently large crowd that targeted tracking becomes impractical.

Start with Firefox + privacy.resistFingerprinting. Measure your baseline fingerprint. Then layer in additional protections based on your threat model and tolerance for usability tradeoffs.