Browser Fingerprinting Explained

A browser fingerprint is a combination of observable characteristics used to distinguish or group browser installations. The signals can include request headers, screen properties, language, time zone, graphics behavior and supported features. Fingerprinting differs from a cookie because it can derive an identifier from observations rather than reading one value previously stored by the site.

How fingerprinting differs from cookies

A cookie is state: a site asks the browser to store a value and return it on matching later requests. Users and browsers can inspect, partition, expire or delete cookies. A fingerprint is an inference from attributes available during a visit. It may work when cookies are blocked, but it is probabilistic and can change when software, hardware, configuration or network conditions change.

The two techniques can be combined. A known cookie may help label a fingerprint, while a fingerprint may attempt to reconnect visits after state changes. That does not make every fingerprint unique or every match correct.

Common signals

User-Agent and Client Hints

The User-Agent header contains tokens accumulated over decades of compatibility behavior. It can expose browser engine, version and operating-system information, though modern browsers may freeze or reduce portions. Client Hints offer structured fields and can gate more detailed values behind server opt-in.

Neither string is a trustworthy identity claim. Automation and privacy tools can override it; compatibility tokens can resemble other browsers; proxies can modify headers. The User Agent Checker distinguishes the HTTP value received by the site from JavaScript-exposed browser data where possible.

Screen, language and time zone

Screen width, height, available area, viewport, device pixel ratio and color depth form a set of related but different measurements. A maximized desktop window can expose a recognizable combination, while a resized window changes the viewport. The Screen Resolution Checker keeps these values separate.

Preferred languages and time zone help sites format content. In combination, an uncommon locale, time zone and platform may narrow a population. They can also be inconsistent for ordinary reasons: someone can use an English browser while traveling, or keep a remote machine configured to another zone.

WebGL information

WebGL exposes a graphics programming interface and capability limits. Renderer and vendor strings can indicate a graphics stack, but browsers may mask them, translate calls through a compatibility layer, or return generic values. Multiple devices can share the same renderer, and one device can change renderer after a driver update or switch between integrated and discrete GPUs.

The WebGL & GPU Checker displays local browser values only. A reduced or software-rendered result is normal in hardened browsers, virtual machines and remote sessions; it is not proof that anything is broken.

Canvas rendering

A script can draw text and shapes to an HTML canvas, read back the pixels and hash them. Font availability, text rasterization, anti-aliasing, graphics drivers and browser behavior can introduce differences. A hash is a compact comparison value for that exact test; it does not reveal the pixels by itself and does not identify a named person.

Hash stability is easy to overinterpret. Matching across two runs shows that the chosen drawing produced the same bytes in those conditions. Many users can share that result. Conversely, randomization, font loading, display changes or software updates can make one browser produce a new hash. The Canvas Fingerprint Test runs only after an explicit action and does not upload its hash.

Uniqueness needs a population

A fingerprint cannot be called unique without defining a comparison population, collection method and time window. A rare combination among one service’s visitors may be common globally, and sampling bias matters. Entropy estimates also depend on whether signals are independent; screen dimensions and device class are correlated, so simply adding their apparent information overstates confidence.

Fingerprint matching is not exact identity. Systems often score similarity and tolerate changes, which introduces false matches and missed matches. Accounts, network addresses and behavior can add other signals, but every inference has its own limitations.

Privacy normalization and resistance

Browsers can reduce fingerprinting by exposing fewer values, grouping users into common configurations, partitioning state by site, limiting APIs, or adding controlled variation. Generic values can create a larger anonymity set when many users share them. A one-off unusual tweak can have the opposite effect by making a configuration rarer.

Blocking JavaScript removes many active probes but also breaks sites and does not remove HTTP headers or network observations. Private-browsing mode primarily separates local state; it is not a promise that all observable attributes change. VPNs alter the visible network address, not necessarily browser signals.

Interpreting the WhatWebSees tools

The Browser Checker, screen, WebGL and canvas pages separate observations and explain their boundaries. The Privacy Signals Checker reports preferences such as GPC and DNT, which are communications to sites rather than technical anonymity switches.

No individual result should be presented as “your unique fingerprint.” The practical lesson is that ordinary browser features expose multiple pieces of context, and combinations may support recognition. Meaningful privacy claims require knowing what is collected, where it is sent, how long it persists and how it is linked—not merely whether an API returns a value.