What Is Browser Fingerprinting? How Sites Identify Your Browser Without Cookies

Delete your cookies and a website can still recognise your browser when you come back. Not by magic, and not by your IP address alone — by reading dozens of small, ordinary details your browser happily reports to every page you visit, and combining them into a pattern that is very likely to be yours.

That pattern is a browser fingerprint. This guide explains what goes into one, why sites collect it, why the consistency of the signals matters more than any single value, and how you can see your own fingerprint today.

A fingerprint is a combination, not a single setting

No single browser property identifies you. Your screen resolution is shared by millions of people. Your timezone is shared by a whole region. Fingerprinting works because the combination is rare.

The Electronic Frontier Foundation demonstrated this in 2010 with its Panopticlick study (now continued as Cover Your Tracks): from hundreds of thousands of visitors, the combination of browser-reported details was unique for the large majority of them. The more unusual your setup — rare fonts, an uncommon screen size, a niche GPU — the more you stand out.

The signals a page can read

A website does not need special permission to read most of these. They are exposed by normal web APIs that legitimate features depend on:

Device and browser identity

• User-Agent and Client Hints — browser name and version, operating system, device model class.
• Screen properties — resolution, available window area, colour depth, device pixel ratio.
• Hardware hints — CPU core count (hardwareConcurrency) and device memory class.

Graphics stack

• Canvas fingerprinting — the page draws an invisible image and reads back the exact pixels. Different GPUs, drivers and font-rendering stacks produce slightly different results, so the pixel hash acts as a device signal.
• WebGL fingerprinting — renderer and vendor strings (for example, the exact GPU model reported by ANGLE/Direct3D or Metal), plus supported extensions and rendering parameters.

System configuration

• Installed fonts — historically enumerable directly; today usually inferred by measuring rendered text. A font list says a lot about your OS, language packs and installed software.
• Timezone and locale — the JavaScript timezone, language list, date/number formatting. These should match where your connection appears to come from.
• Audio context — subtle differences in how the audio stack processes a test signal (AudioContext fingerprinting).

Network and behaviour-adjacent signals

• IP address and connection type — not part of the browser fingerprint itself, but sites correlate the two. A fingerprint that says "Berlin desktop" arriving from an IP in another country, with a mismatched timezone, is exactly the kind of contradiction risk systems look for.
• WebRTC — can expose local/network addresses in some configurations if not handled carefully.

Why websites collect fingerprints

Fingerprinting has legitimate uses, and it is worth being honest about that:

• Fraud and account security — a bank noticing your account suddenly logging in from a fingerprint it has never seen is protecting you, not just tracking you.
• Bot and abuse detection — automated traffic often has fingerprints that are internally impossible (more on that below).
• Analytics and advertising — the use most people object to: recognising visitors across sites and sessions without cookies, and therefore without a cookie banner to decline.

You do not have to like the third use to understand the technology. And understanding it matters, because most "anti-fingerprinting" advice fails for one predictable reason.

The consistency problem: why random values make you more visible

The instinctive response to fingerprinting is "change everything" — randomise the canvas, spoof the GPU, fake the timezone. This usually backfires, because real devices are internally consistent, and risk systems check for exactly that:

• A User-Agent claiming Windows paired with fonts that only ship on macOS.
• A WebGL renderer naming a mobile GPU inside a "desktop" profile with 32 CPU cores.
• A proxy exit in one country, a timezone in a second, and browser languages from a third.
• A canvas hash that changes on every page load — something no real device does.

A real phone or laptop is one coherent device: its GPU, screen, fonts, OS, language and timezone all belong together and stay stable over time. A profile whose signals contradict each other is not "private" — it is implausible, and implausibility is itself a strong detection signal.

That is why serious multi-profile tooling — including NullBrowser, the product behind this site — is built around coherent device records rather than random spoofing: each profile starts from a real device configuration (GPU, screen, font set, locale) and keeps every signal consistent with it, with its own separate cookies, storage and proxy. It is also why we are direct about limits: NullBrowser's current builds run a development engine and are detectable by design, and we publish that plainly in our FAQ instead of promising invisibility. No browser tool can honestly guarantee “undetectability,” and any that does is telling you something about its marketing, not its engineering.

How to see your own fingerprint

You can check what your current browser exposes in a few minutes:

1. EFF Cover Your Tracks (coveryourtracks.eff.org) — shows your fingerprint's uniqueness against their dataset and explains each signal.
2. BrowserLeaks (browserleaks.com) — separate testers for WebGL, canvas, fonts, WebRTC and more.
3. AmIUnique (amiunique.org) — a research project showing how your fingerprint compares to others.

Run the same test twice, a day apart, in your normal browser. Real devices return the same result. Then try a private window or a different browser and watch how many signals move together — that contrast is the whole lesson of this article in miniature.

How to reduce fingerprinting exposure (realistically)

• Use a mainstream browser, kept updated. Being one of millions with the same version and defaults is real protection; exotic setups stand out.
• Be careful with extensions. Every extension that changes page behaviour or rendering can add distinguishing signals.
• Prefer browsers with built-in fingerprinting resistance for everyday browsing if tracking is your concern — for example, Firefox's Enhanced Tracking Protection or Tor Browser, which is designed to make all its users look alike.
• For legitimate multi-account work (agencies managing client accounts, QA teams reproducing a customer's device and locale, social teams running one profile per brand), use isolated profiles with coherent device identities and separate proxies per profile, and work within the terms of the sites involved. The mechanics are covered in our guide to how antidetect browsers work and the documentation.

The short version

A browser fingerprint is the combination of ordinary signals — graphics, fonts, screen, timezone, language — that together make a browser recognisable without cookies. You cannot realistically turn those signals off; the web platform needs most of them to work. What you can control is whether your signals are stable and coherent, like a real device, or contradictory and random, like a costume. Sites are very good at spotting costumes.

---

NullBrowser is a desktop app by Dvexo that runs isolated browser profiles — each one a coherent device with its own fingerprint and proxy — with a proxy manager, an automation studio, a local API and SDKs. See how it works or check the free plan.