Browser Fingerprint: What A Site Can Read Without Asking

What a fingerprint is, and why it survives a new IP

Your browser answers questions it is never asked out loud. What fonts are installed. How many CPU threads the machine reports. Which time zone the clock is set to. What the graphics chip is called. None of these needs permission, because individually none of them is private — millions of people have twelve threads, and the time zone is not a secret.

The identification comes from the combination. Twelve threads is unremarkable. Twelve threads plus Europe/Warsaw plus a specific GPU string plus a particular font set plus a 3440×1440 display is, in practice, you. A site does not have to know your name to recognise you tomorrow; it only has to recognise the same combination.

Which is the part that catches people out when they start using proxies. Changing your exit address changes exactly one value out of the forty a page can read. Everything above — the hardware, the fonts, the clock, the language preferences — is identical to what it was on your previous address. If a site was already tracking the combination, a new IP looks like the same visitor on a new connection, which is in some ways a more interesting event than a new visitor.

How this page reads yours

Press the button and the page collects the signals the way a tracker would, lists every value in full, and hashes the set into one string. The list is the point: a hash on its own tells you nothing you can act on, while seeing that your GPU renderer is a long specific model name tells you exactly which value is doing the identifying.

Each signal is marked with how much it narrows you down. Rare means close to identifying on its own. Shared means most visitors send the same value. This ranking is the useful output of the page — it is the difference between "I have a fingerprint" and "the two values giving me away are these".

Everything happens in your tab. There is no request to us when you press the button, and you can confirm that in the network panel of your developer tools. That is not only a privacy nicety: a page arguing that these values identify you, which then collected them, would be making its own case rather badly.

The claim we will not make

Plenty of fingerprint pages tell you that you are unique among some number of visitors. To say that, a site has to keep a database of everyone else's fingerprints and compare yours against it — which is precisely the behaviour the page is warning you about, and the number is only ever a count of that site's own traffic anyway. We do not have that database and are not going to build one, so this page tells you which of your signals are rare and leaves the arithmetic alone.

Where this is actually used

Fingerprinting has a reputation as something shady, which obscures how ordinary it has become. Four uses cover most of it, and only one of them is advertising.

• Fraud detection. Banks and payment processors fingerprint every session, because a login from a familiar device at an unfamiliar address is a different risk from a login from a device nobody has seen before. This is also why a new browser profile often triggers verification that a new IP alone does not.
• Bot detection. The commercial services sitting in front of large sites check for internal contradictions rather than for rarity — a headless browser that forgot to fake its GPU, a user agent that disagrees with the font set. Consistency is what they measure.
• Account linking. Platforms that limit you to one account use the fingerprint to notice that your five accounts share a machine. Changing the IP for each and leaving everything else identical is the specific mistake this catches.
• Advertising. The original use, and now the least of them, because third-party cookies covered it more cheaply for years and regulation has made the practice awkward to defend.

The practical consequence is that the people reading your fingerprint are mostly looking for contradictions, not for rare values. A consistent, ordinary-looking machine attracts no attention even if its exact combination is unique — and a machine that has clearly been tampered with attracts attention even though every individual value looks common.

What to do about the values that stand out

The instinct is to go after the exotic ones — spoof the canvas, hide the GPU, block the audio context. This usually makes things worse. A browser reporting no canvas, no WebGL and no audio stack is not anonymous; it is one of a very small number of visitors who have gone to that trouble, and the blocking is itself the signal.

The failures that actually get accounts flagged are consistency failures, and they are boring:

• The time zone disagrees with the exit address. A German residential proxy and a browser clock set to Asia/Kolkata. This is the single most common one and it takes one line of JavaScript to catch.
• The language list disagrees too. Accept-Language headers and navigator.languages are both readable and should tell the same story as the address.
• The screen is impossible. A window reporting a size no shipping display has, usually because an anti-detect tool rounded it.
• A desktop claiming touch support, or a phone claiming none. Contradictions within the fingerprint are easier to detect than any single odd value.

The practical approach is the dull one: change as little as possible, make what you do change agree with everything else, and use an address in the country your browser already claims to be in. If you are running several accounts, give each a browser profile that is internally consistent and leave it alone — the consistency over time is what makes it look real.

Checking your work

Re-run this page after every change and watch which values move. A setting that was supposed to change your fingerprint and did not is worth knowing about before you rely on it. The WebRTC leak test covers the one signal this page cannot see — the address your browser volunteers over WebRTC, which has its own way of contradicting your proxy.