DEV Community: Mahdi Hasan Shuvo

What Is Browser Fingerprinting? How Sites Identify Your Browser Without Cookies

Mahdi Hasan Shuvo — Wed, 21 Oct 2026 09:06:16 +0000

Delete your cookies and a website can still recognise your browser when you come back. Not by magic, and not by your IP address alone — by reading dozens of small, ordinary details your browser happily reports to every page you visit, and combining them into a pattern that is very likely to be yours.

That pattern is a browser fingerprint. This guide explains what goes into one, why sites collect it, why the consistency of the signals matters more than any single value, and how you can see your own fingerprint today.

A fingerprint is a combination, not a single setting

No single browser property identifies you. Your screen resolution is shared by millions of people. Your timezone is shared by a whole region. Fingerprinting works because the combination is rare.

The Electronic Frontier Foundation demonstrated this in 2010 with its Panopticlick study (now continued as Cover Your Tracks): from hundreds of thousands of visitors, the combination of browser-reported details was unique for the large majority of them. The more unusual your setup — rare fonts, an uncommon screen size, a niche GPU — the more you stand out.

The signals a page can read

A website does not need special permission to read most of these. They are exposed by normal web APIs that legitimate features depend on:

Device and browser identity

User-Agent and Client Hints — browser name and version, operating system, device model class.
Screen properties — resolution, available window area, colour depth, device pixel ratio.
Hardware hints — CPU core count (hardwareConcurrency) and device memory class.

Graphics stack

Canvas fingerprinting — the page draws an invisible image and reads back the exact pixels. Different GPUs, drivers and font-rendering stacks produce slightly different results, so the pixel hash acts as a device signal.
WebGL fingerprinting — renderer and vendor strings (for example, the exact GPU model reported by ANGLE/Direct3D or Metal), plus supported extensions and rendering parameters.

System configuration

Installed fonts — historically enumerable directly; today usually inferred by measuring rendered text. A font list says a lot about your OS, language packs and installed software.
Timezone and locale — the JavaScript timezone, language list, date/number formatting. These should match where your connection appears to come from.
Audio context — subtle differences in how the audio stack processes a test signal (AudioContext fingerprinting).

Network and behaviour-adjacent signals

IP address and connection type — not part of the browser fingerprint itself, but sites correlate the two. A fingerprint that says "Berlin desktop" arriving from an IP in another country, with a mismatched timezone, is exactly the kind of contradiction risk systems look for.
WebRTC — can expose local/network addresses in some configurations if not handled carefully.

Why websites collect fingerprints

Fingerprinting has legitimate uses, and it is worth being honest about that:

Fraud and account security — a bank noticing your account suddenly logging in from a fingerprint it has never seen is protecting you, not just tracking you.
Bot and abuse detection — automated traffic often has fingerprints that are internally impossible (more on that below).
Analytics and advertising — the use most people object to: recognising visitors across sites and sessions without cookies, and therefore without a cookie banner to decline.

You do not have to like the third use to understand the technology. And understanding it matters, because most "anti-fingerprinting" advice fails for one predictable reason.

The consistency problem: why random values make you more visible

The instinctive response to fingerprinting is "change everything" — randomise the canvas, spoof the GPU, fake the timezone. This usually backfires, because real devices are internally consistent, and risk systems check for exactly that:

A User-Agent claiming Windows paired with fonts that only ship on macOS.
A WebGL renderer naming a mobile GPU inside a "desktop" profile with 32 CPU cores.
A proxy exit in one country, a timezone in a second, and browser languages from a third.
A canvas hash that changes on every page load — something no real device does.

A real phone or laptop is one coherent device: its GPU, screen, fonts, OS, language and timezone all belong together and stay stable over time. A profile whose signals contradict each other is not "private" — it is implausible, and implausibility is itself a strong detection signal.

That is why serious multi-profile tooling — including NullBrowser, the product behind this site — is built around coherent device records rather than random spoofing: each profile starts from a real device configuration (GPU, screen, font set, locale) and keeps every signal consistent with it, with its own separate cookies, storage and proxy. It is also why we are direct about limits: NullBrowser's current builds run a development engine and are detectable by design, and we publish that plainly in our FAQ instead of promising invisibility. No browser tool can honestly guarantee “undetectability,” and any that does is telling you something about its marketing, not its engineering.

How to see your own fingerprint

You can check what your current browser exposes in a few minutes:

EFF Cover Your Tracks (coveryourtracks.eff.org) — shows your fingerprint's uniqueness against their dataset and explains each signal.
BrowserLeaks (browserleaks.com) — separate testers for WebGL, canvas, fonts, WebRTC and more.
AmIUnique (amiunique.org) — a research project showing how your fingerprint compares to others.

Run the same test twice, a day apart, in your normal browser. Real devices return the same result. Then try a private window or a different browser and watch how many signals move together — that contrast is the whole lesson of this article in miniature.

How to reduce fingerprinting exposure (realistically)

Use a mainstream browser, kept updated. Being one of millions with the same version and defaults is real protection; exotic setups stand out.
Be careful with extensions. Every extension that changes page behaviour or rendering can add distinguishing signals.
Prefer browsers with built-in fingerprinting resistance for everyday browsing if tracking is your concern — for example, Firefox's Enhanced Tracking Protection or Tor Browser, which is designed to make all its users look alike.
For legitimate multi-account work (agencies managing client accounts, QA teams reproducing a customer's device and locale, social teams running one profile per brand), use isolated profiles with coherent device identities and separate proxies per profile, and work within the terms of the sites involved. The mechanics are covered in our guide to how antidetect browsers work and the documentation.

The short version

A browser fingerprint is the combination of ordinary signals — graphics, fonts, screen, timezone, language — that together make a browser recognisable without cookies. You cannot realistically turn those signals off; the web platform needs most of them to work. What you can control is whether your signals are stable and coherent, like a real device, or contradictory and random, like a costume. Sites are very good at spotting costumes.

NullBrowser is a desktop app by Dvexo that runs isolated browser profiles — each one a coherent device with its own fingerprint and proxy — with a proxy manager, an automation studio, a local API and SDKs. See how it works or check the free plan.

Bangladesh Railway Ticket Auto-Booking Bot

Mahdi Hasan Shuvo — Tue, 19 May 2026 06:25:41 +0000

🚆 Bangladesh Railway Ticket Auto-Booking Bot

⚡ Lightning-Fast | 🧠 Smart Captcha | 🎯 Seat-Precise | 🔐 Secure OTP

An extraordinary high-performance automation engine that books
Bangladesh Railway (eticket.railway.gov.bd / Shohoz) train tickets the
instant they go on sale — faster than any human can blink.

💡 "Stop fighting the clock. Stop refreshing pages at 8 AM. Let
the bot win the seat war for you."

✨ Why This Bot Is Different

Most ticket bots break the moment Cloudflare Turnstile expires their token, or they crash when the server rate-limits them. This one doesn't.

🔥 Built for the real world — every error message, every Cloudflare challenge, every "ticket not available" race condition has been hunted down and fixed.

🎯 Feature	🚀 What It Means For You
Multi-threaded Turnstile Pool	3 background solvers keep 6 fresh tokens ready 24/7 — never wait, never expire
Per-Seat Fresh Tokens	Every reservation request gets its own unexpired token — zero `Invalid action token` errors
Smart Seat Preference Engine	Prioritize your favorite seat numbers, then fall back to any available seat
Parallel Seat Reservation	Reserves multiple seats in parallel using a thread pool — wins races against human clickers
Scheduled Run Time	Set it once, walk away — the bot wakes up at the exact second tickets open
Auto OTP Resend	If you miss the SMS, the bot re-requests OTP up to 3 times automatically
Auto PDF Ticket Download	After payment, your ticket PDF is downloaded and saved with a smart filename
Rate-Limit Auto-Recovery	Detects "wait X minutes Y seconds" responses and politely waits — no IP bans
bKash / Card / Nagad Ready	Whatever payment method your account uses, the bot opens the right gateway

🎬 Live Demo — See It In Action

🚀 Step 1 — Bot Boots & Locks Onto The Trip

The instant you launch, the bot identifies your train, route, boarding point, and counts available seats in real time.

🟢 Seat class detected · Trip ID locked · Boarding point captured · 72
seats available

⚡ Step 2 — Parallel Seat Reservation (Faster Than Human Clicks)

The bot fires multiple reservation requests in parallel, claiming your preferred seats before anyone else can scroll.

🔥 3 seats locked in milliseconds: KA-20,
KA-21, KA-22 — then waits for your
OTP

✅ Step 3 — OTP Verified → Ticket Booking Confirmed!

After OTP verification, the bot finalizes the booking and opens the bKash payment gateway instantly.

🎉 "Ticket booking is confirmed!" —
Auto-redirects to bKash for payment

📄 Step 4 — PDF Ticket Auto-Downloaded

The moment payment clears, your official ticket PDF is downloaded and saved with a smart, organized filename.

📥 View Sample Ticket PDF

💻 Terminal Output Preview

╔════════════════════════════════════════════════════════════╗
║  Running from folder: AC_B-D-3                             ║
║  Captcha Balance: 12.94 | IP: 103.137.67.242               ║
║  Seat class: AC_B                                          ║
║  Version: 0.0.4                                            ║
║  Your Bot is ready to work ✅                              ║
║  Waiting... 14s remaining                                  ║
║                                                            ║
║  trip_id: 8566632  route: 57904643  boarding: 110759229    ║
║  Eligible: 23 | Preferred: 4 | Others: 19                  ║
║  [1] seat reserved - KHA-3                                 ║
║  [2] seat reserved - KHA-7                                 ║
║                                                            ║
║  Enter your OTP (press Enter to wait): 5957                ║
║  ✅ OTP received, stopping resend                          ║
║  💳 Opening bKash payment gateway...                       ║
║  📄 PDF downloaded: 16_Dec_2026_SUBORNO_AC_B_ticket.pdf    ║
╚════════════════════════════════════════════════════════════╝

🧠 How It Works (The Magic Inside)

flowchart LR
    A[⏰ Wait For Run Time] --> B[🔍 Search Trips]
    B --> C[🎫 Get Seat Layout]
    C --> D[🧠 Solve Turnstile Captcha]
    D --> E[⚡ Reserve Seats In Parallel]
    E --> F[📱 Trigger OTP]
    F --> G[✅ Verify OTP]
    G --> H[💳 Confirm Booking + Open Payment]
    H --> I[📄 Auto Download Ticket PDF]

Pre-arm phase — Bot launches early, builds a pool of fresh Cloudflare Turnstile tokens.
Countdown phase — Idles until your exact scheduled run_at time.
Strike phase — The instant tickets open, it queries seat-layout, filters by your preferences, and fires parallel reservation requests with fresh tokens.
Lock phase — Triggers passenger-details OTP, you enter the SMS code, bot verifies.
Pay phase — Confirms booking, opens your payment gateway, polls purchase history, and downloads the PDF the moment payment completes.

3️⃣ Configure `user_data.json`

{
  "token": "YOUR_RAILWAY_ACCESS_TOKEN",
  "d_ID": "YOUR_DEVICE_ID",
  "api_key": "YOUR_2CAPTCHA_API_KEY",
  "from_city": "Dhaka",
  "to_city": "Chattogram",
  "date_of_journey": "20-Dec-2026",
  "seat_class": "AC_B",
  "trip_number": "SUBORNO EXPRESS",
  "Seats_to_reserve": 2,
  "set_start": 1,
  "floor_name": "",
  "preferred_seat_numbers": ["KHA-3", "KHA-7"],
  "payment_method": 1,
  "run_at": "2026-12-15 08:00:00.000000",
  "info_user": [
    { "Name": "Your Name", "gender": "male", "passengerType": "Adult" }
  ]
}

4️⃣ Run It

python mian.py

The bot will sit quietly, top up its captcha pool, then strike at run_at time.

🎨 Smart Configuration

🔑 Key	📝 Description	💎 Example
`from_city` / `to_city`	Origin and destination stations	`"Dhaka"` → `"Chattogram"`
`seat_class`	Class to book	`AC_B`, `SNIGDHA`, `S_CHAIR`, `SHOVAN`
`trip_number`	Train name keyword (partial match OK)	`"SUBORNO"`
`Seats_to_reserve`	Number of seats to lock	`1` to `4`
`preferred_seat_numbers`	Priority list — bot grabs these first	`["KHA-3", "KHA-7"]`
`set_start`	Skip seat numbers below this	`1`
`floor_name`	Filter coaches by floor	`"upper"` or `""`
`payment_method`	Payment gateway selector	`1` = bKash
`run_at`	Exact strike time (microsecond precision)	`"2026-12-15 08:00:00.000000"`

🚦 Status Codes Decoded

🔴 Error	🟢 What The Bot Does
`TURNSTILE_VERIFICATION_FAILED`	Silently swaps in a fresh token and retries
`Invalid or expired action token`	Auto-rotates token from the pool
`Sorry! this ticket is not available`	Moves to the next seat instantly
`Maximum 4 seats already reserved`	Stops gracefully (server hard limit)
`Server Error 403`	Backs off 2 seconds and retries
`Rate limited X minutes Y seconds`	Counts down precisely and resumes
`Invalid User Access Token`	Halts and asks you to refresh login

⚙️ Architecture Highlights

┌──────────────────────────────────────────────────────────┐
│  🧵 Thread 1-3:  Turnstile Solver Pool (always fresh)    │
│  🧵 Thread 4:    OTP Auto-Resender                       │
│  🧵 Thread 5+:   Parallel Seat Reservation Workers       │
│  🧵 Main:        Trip Search → Layout → Confirm → PDF    │
└──────────────────────────────────────────────────────────┘

TTL-bounded token pool — every token is timestamped; anything older than 100s is dropped before use.
Thread-safe shared state — all reservation lists protected by locks; no race condition can double-book.
Zero recursion — flat while True retry loops mean unlimited resilience without stack overflow.
Boundary-only error handling — internal helpers stay clean; only network edges catch exceptions.

🔒 Safety & Compliance

⚠️ For personal use only. This tool helps individuals reserve their own tickets faster — it does not bypass payment, security, or identity verification. You still pay through the official gateway. You still verify with your own phone's OTP. You still submit your real passenger details.

✅ Uses the official Bangladesh Railway / Shohoz API — no scraping, no DOM hacks.
✅ Captchas solved through legitimate 2Captcha service (you pay per solve).
✅ Respects server rate limits with intelligent backoff.
❌ Not affiliated with Bangladesh Railway or Shohoz.

📈 Roadmap

Multi-threaded Turnstile token pool
Per-seat fresh token rotation
Auto OTP resend
PDF auto-download
Telegram bot notifications
GUI desktop app (Electron / PyQt)
Mobile companion app
Multi-account orchestration
Smart fare-class fallback

💬 Support & Contact

📧 Need help, custom build, or premium edition?

💬 Telegram / WhatsApp: +8801616397082

💼 Available for freelance & paid projects — Let's
build something great together!

⭐ Show Some Love

If this bot saved you from the 8 AM ticket war, drop a ⭐ on the repo — it really helps!

Built with ❤️ for Bangladeshi train travelers who refuse to lose
the seat war.

Made in Bangladesh 🇧🇩

project :https://github.com/Mahdi-hasan-shuvo/bangladesh-railway-ticket-booking-bot