DEV Community

FireKey Team
FireKey Team

Posted on

Browser Fingerprinting for Developers: The Signals You're Not Tracking

#privacy #browsers #webdev #security

Most developers are familiar with cookies and session tokens. Fewer account for the browser fingerprint layer — a set of signals that are hardware-bound, session-persistent, and unaffected by the usual counter-measures.

The Core Signals

Canvas API 

const canvas = document.createElement('canvas');
const ctx = canvas.getContext('2d');
ctx.fillText('fp test ❤ 🔥', 2, 15);
const hash = btoa(canvas.toDataURL());
Enter fullscreen mode Exit fullscreen mode

The resulting pixel data varies based on GPU model, driver version, and OS-level rendering. Same device = same hash, every time.

WebGL 

const gl = document.createElement('canvas').getContext('webgl');
const renderer = gl.getParameter(gl.RENDERER);
// "ANGLE (NVIDIA GeForce RTX 3080 Direct3D11 vs_5_0 ps_5_0)"
Enter fullscreen mode Exit fullscreen mode

Exposes GPU model and driver string directly. Hardware-unique and immutable.

AudioContext 

const ctx = new AudioContext();
const analyser = ctx.createAnalyser();
// Process a sine wave through the audio stack
// Floating-point output varies by hardware
Enter fullscreen mode Exit fullscreen mode

Small variations in hardware audio processing = unique float signature.

Font Enumeration

Platforms probe font availability via CSS timing or JavaScript. Installed fonts reveal locale, software stack, and sometimes profession.

Why Standard Counter-Measures Fail

  • VPNs: Change IP address only. Zero effect on Canvas/WebGL/Audio.
  • Private browsing: Clears cookies and history. Hardware signals unchanged.
  • Cookie deletion: Affects session cookies. Canvas hash is not a cookie.
  • Browser reinstall: Clears browser cache. GPU-based signals remain.

The Consistency Requirement

Even with spoofed fingerprints, environment mismatches create detection signals:

Proxy exit: Dallas, TX (USA)
Browser timezone: Asia/Shanghai        ← mismatch
navigator.language: zh-CN              ← mismatch  
Installed fonts: Source Han Sans (CJK) ← mismatch
Enter fullscreen mode Exit fullscreen mode

All environment signals must be internally consistent with the declared location.

What Actually Isolates

For developers building multi-account systems or privacy tools:

  1. Per-profile fingerprint isolation — unique Canvas/WebGL/AudioContext per profile, stable within session (not re-randomized per page load)
  2. Environment matching — timezone + language + fonts = proxy geographic location
  3. Behavioral separation — different session patterns, timing, navigation flows

Testing Your Implementation 

browserleaks.com — comprehensive fingerprint audit
coveryourtracks.eff.org — EFF fingerprint test
Enter fullscreen mode Exit fullscreen mode

If two profiles return matching Canvas hashes, they're linkable at hardware level regardless of IP configuration.

Building something in this space? Drop questions in the comments — happy to go deeper on any of these signals.

Top comments (0)