What Is Browser Fingerprinting? – Definition and How It Works
Learn what browser fingerprinting is, which attributes it combines, why it needs no cookies, how it is used for fraud and bot detection, and its limits.
Browser fingerprinting identifies a device by combining attributes the browser reveals to any page it visits. It stores nothing on the device, which is precisely what makes it durable — and controversial.
1. What Is Browser Fingerprinting?
It is stateless identification built from observable browser characteristics.
- Key idea: many weakly identifying values combine into a strongly identifying one.
- Mechanism: a script reads screen, locale, hardware, font and rendering properties, then hashes the combination.
- Goal: recognise the same device again without storing anything on it.
The contrast with cookies is the whole point. A cookie is something the site gives you and can be deleted. A fingerprint is something the browser tells every site, and there is nothing to remove.
2. What Gets Read
| Signal | Contribution |
|---|---|
| Screen | Resolution, colour depth, pixel ratio |
| Timezone and language | Locale grouping, formatting behaviour |
| Hardware | CPU cores, device memory, touch support |
| WebGL | GPU vendor and renderer strings |
| Canvas | Hash of rendered pixel output |
| Audio | AudioContext processing output |
| Fonts | Which fonts are installed, measured indirectly |
| Browser | User agent, platform, available APIs |
| Network | Connection hints, WebRTC-exposed addresses |
Individually these are unremarkable — millions share any one of them. Together they frequently identify one device.
3. Why Canvas Carries So Much Weight
The script draws text or graphics to an invisible canvas and hashes the resulting pixels. The drawing instructions are identical for every visitor; the output is not, because GPU, driver, anti-aliasing, font rasterisation and OS compositing all perturb it slightly.
The result is a stable per-machine value derived from hardware behaviour, produced by an operation the user never sees. WebGL extends this by naming the graphics hardware outright — which is also why virtualised and containerised environments stand out, reporting software renderers no consumer machine would have.
4. Where It Is Used
- Fraud prevention. Linking activity to a device across cleared cookies and different accounts.
- Bot detection. Identifying automation environments and impossible attribute combinations.
- Account security. Prompting for verification when a login arrives from an unrecognised device.
- Rate limiting per device, which survives IP rotation in a way IP-based limits do not.
- Advertising and analytics tracking, the use case behind most privacy regulation and browser countermeasures.
5. Consistency Beats Uniqueness
For bot detection specifically, what matters is not whether your fingerprint is rare but whether it is coherent.
- User agent says Windows; WebGL reports a Linux driver.
- User agent says iPhone; the screen is 1920×1080 with no touch points.
- Platform says macOS; no macOS system fonts are present.
- Timezone is Tokyo; language list is en-US only; IP is in Germany.
Unusual configurations exist in the wild. Impossible ones do not. This is why changing a user agent in isolation makes detection easier — it introduces a contradiction that an untouched browser would never produce.
6. Limits
- It drifts. Browser updates, driver updates, a new display or an installed font all shift the value.
- Common devices collide. A stock iPhone on a default configuration is one of millions producing nearly identical values.
- Browsers fight back. Safari reports generalised values, Firefox blocks known fingerprinting scripts, Tor deliberately makes all users look identical.
- Randomisation is detectable. Noise per session prevents linking but creates its own anomaly — a device whose fingerprint changes every page load.
7. Real-World Examples
- A visitor recognised after clearing all site data, because nothing was stored to clear.
- A headless browser flagged on WebGL alone, reporting SwiftShader instead of a real GPU.
- Blocks that follow a scraper across thousands of proxies — the identifier was never the IP.
- A fraud ring linked by shared canvas hashes across dozens of separate accounts.
- An automation setup breaking after a Chrome update, when the target's expected fingerprint moved and the spoof did not.
8. Summary
Browser fingerprinting builds an identifier from screen, locale, hardware, font and rendering attributes that every browser exposes. Canvas and WebGL contribute the most entropy because they reflect real hardware and driver behaviour.
It works without storage, which makes it resistant to clearing cookies and to changing IP addresses — and useful for fraud prevention, bot detection and tracking alike. Its practical weakness is drift and collision; its practical strength, for detection, is that inconsistency is far more revealing than rarity. Presenting a genuinely ordinary environment defeats it more reliably than spoofing individual values, which usually creates the contradictions detectors look for.