Browser fingerprinting: test how trackable you really are (with code)

`Delete your cookies. Open a private window. Turn on a VPN.

You're still identifiable.

Not through anything stored on your machine — through the machine itself. Your browser leaks enough small details (screen size, fonts, GPU quirks, timezone, audio stack) that combined, they form a signature shared by almost nobody else on Earth. That signature is a browser fingerprint, and no cookie banner ever asks permission for it.

Let's build one, measure how unique yours is, and then talk about what actually helps — because most of the popular advice makes fingerprinting easier.

The math of being unique

Fingerprinting works on a simple principle: each attribute narrows the crowd.

• Your timezone eliminates most of the planet.
• Your screen resolution cuts what's left.
• Your installed fonts cut that.
• Your GPU model cuts that.

Information theory puts numbers on it: identifying one person among ~5 billion internet users needs only about 33 bits of information. A typical browser leaks far more. Research going back to the EFF's Panopticlick project found the large majority of browsers were uniquely identifiable from passive attributes alone — no cookies involved.

Reading the obvious signals

The cheap stuff comes straight off navigator and screen:

js
const basics = {
userAgent: navigator.userAgent,
language: navigator.language,
languages: navigator.languages.join(","),
platform: navigator.platform,
hardwareConcurrency: navigator.hardwareConcurrency, // CPU cores
deviceMemory: navigator.deviceMemory, // GB of RAM (Chrome)
timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
screen:${screen.width}x${screen.height}x${screen.colorDepth},
touchPoints: navigator.maxTouchPoints,
};


Individually boring. Together, already a decent signature. But the real entropy comes from making your hardware do something.

Canvas fingerprinting: your GPU has handwriting

Ask the browser to draw text and shapes on a hidden canvas, then read the pixels back. The result differs subtly between machines — font rendering, anti-aliasing, and GPU driver behavior all leave their mark:

`js
async function canvasFingerprint() {
const canvas = document.createElement("canvas");
canvas.width = 280; canvas.height = 60;
const ctx = canvas.getContext("2d");

ctx.textBaseline = "top";
ctx.font = "14px 'Arial'";
ctx.fillStyle = "#f60";
ctx.fillRect(125, 1, 62, 20);
ctx.fillStyle = "#069";
ctx.fillText("How unique are you? 🦄", 2, 15); // emoji rendering varies a LOT
ctx.strokeStyle = "rgba(102, 204, 0, 0.7)";
ctx.arc(50, 40, 15, 0, Math.PI * 2);
ctx.stroke();

// Hash the pixel data
const data = new TextEncoder().encode(canvas.toDataURL());
const digest = await crypto.subtle.digest("SHA-256", data);
return [...new Uint8Array(digest)]
.map(b => b.toString(16).padStart(2, "0"))
.join("");
}
`

Same code, different machines, different hashes. The emoji is doing heavy lifting there — emoji fonts differ across OS versions, adding bits of entropy for free.

WebGL: reading the GPU's name tag

Sometimes you don't even need side effects — the GPU introduces itself:

js
function gpuInfo() {
const gl = document.createElement("canvas").getContext("webgl");
if (!gl) return "no-webgl";
const ext = gl.getExtension("WEBGL_debug_renderer_info");
return ext
? gl.getParameter(ext.UNMASKED_RENDERER_WEBGL) // e.g. "NVIDIA GeForce RTX 4070"
: gl.getParameter(gl.RENDERER);
}


An exact GPU model + driver string is one of the highest-entropy single attributes available.

Combine and hash

A fingerprinting script gathers every signal, concatenates, and hashes:

`js
async function fingerprint() {
const parts = [
JSON.stringify(basics),
await canvasFingerprint(),
gpuInfo(),
].join("|");
const digest = await crypto.subtle.digest("SHA-256",
new TextEncoder().encode(parts));
return [...new Uint8Array(digest)]
.map(b => b.toString(16).padStart(2, "0")).join("");
}

fingerprint().then(console.log); // your ID. no cookies were harmed.
`

That hash survives cookie deletion, private browsing, and (unlike your IP) a VPN. Real-world trackers add font enumeration, audio-context fingerprinting, and dozens more signals — but the architecture is exactly this.

Who uses this, and is it legal?

Both sides, which is what makes it interesting:

• Anti-fraud and bot detection — banks and login systems fingerprint devices to spot account takeovers ("this login is from a device we've never seen"). Arguably legitimate.
• Cross-site tracking — ad-tech rebuilding your profile after you cleared cookies. This is the use case GDPR/ePrivacy treats like cookies: it requires consent in the EU, though enforcement lags far behind reality.

Browsers are fighting back unevenly: Tor Browser tries to make everyone look identical, Firefox ships fingerprint resistance, Safari blunts canvas readouts, and Brave randomizes them per-site. Chrome — built by an advertising company — does the least. Draw your own conclusions.

The paradox: most "privacy tricks" make you MORE unique

Here's the counterintuitive part. Installing seventeen privacy extensions, using a rare OS/browser combo, spoofing your user agent — each of those makes your configuration rarer, which makes your fingerprint more identifying. A spoofed user agent that contradicts your actual GPU string is itself a strong signal.

The defense that actually works is blending in: a mainstream, unmodified browser (or one that engineers uniformity, like Tor), default window size, and per-site randomization if your browser offers it. In fingerprinting, anonymity is conformity.

See your own fingerprint

The code above is a demo; if you want the fuller picture, I built a free test that runs the complete battery — canvas, WebGL, fonts, audio, and more — entirely in your browser, shows every attribute it could read, and estimates how identifying each one is. Nothing is stored or sent anywhere (check the network tab): Browser Fingerprint Test on GoForTool

Run it in your normal browser, then in private mode, then with your VPN on. Watch how little changes. That's the point — and it's why the cookie consent theater we all click through misses where tracking actually went.

What did your fingerprint test show — and does anyone actually run a setup that blends in? Curious what the Tor/Brave users here see. 👇`