Browser fingerprinting is a collection of techniques that combine browser, operating-system, hardware, and network signals to recognize or classify a browser. Unlike a cookie, the resulting identifier can be recomputed from observable properties instead of read from a stored ID.

Fingerprinting is probabilistic: a result may be common, rare, stable, or unstable depending on the population, time window, browser defenses, and signals collected. No single sample proves identity or uniqueness.

The Shift from Cookies to Fingerprinting

For decades, websites relied on HTTP cookies to track users across sessions. When you visited a site, a unique cookie ID was saved to your storage. When you loaded a new page, your browser sent that cookie back, letting the server know you were the same visitor.

However, as browser privacy settings improved, search engines added tracking protection, and users began routinely clearing their cookies, advertisers needed a tracking method that didn't rely on local storage.

Enter Browser Fingerprinting. Instead of writing a tracking ID to your disk, websites *read* your device configuration to construct your tracking ID dynamically.

How a Browser Fingerprint Is Structured

Every time your browser loads a page, it exposes properties needed for content negotiation and web features. A fingerprinting system may combine those values directly or hash them into a shorter identifier. Hashing makes data compact; it does not make the observations unique or prove who produced them.

Here are the primary components that feed into this signature:

1. User Agent and HTTP Headers

The User-Agent header can contain browser and platform details, although modern browsers may reduce or freeze parts of it. Header values and ordering can add signals, but many visitors share the same pattern.

2. Screen and Display Configurations

Websites can read screen and viewport dimensions, color depth, device pixel ratio (DPR), and orientation. Window size and scaling may narrow a population, while browser protections can round or standardize values.

3. Rendering Engine & Hardware Acceleration (Canvas & WebGL)

By drawing hidden shapes and text on an HTML5 <canvas> or WebGL canvas, scripts analyze how your graphics card (GPU) renders imagery. Subtle differences in anti-aliasing, rasterization algorithms, and graphics card driver versions cause devices to render pixels slightly differently.

4. Font Enumeration

Fingerprinters can test font availability by comparing text dimensions. Custom fonts may make a result less common, while fallback substitution and browser restrictions can make the test incomplete.

5. Timezones, Locale & Locales

The JavaScript Intl API can expose a configured timezone, locale, language preferences, calendar, and numbering system. A timezone/IP mismatch can be one risk signal, but it does not by itself prove location, VPN use, or fraud.

Hashing and Entropy: The Math Behind the Track

In information theory, entropy measures uncertainty in a distribution, expressed in bits. Estimating fingerprint entropy therefore requires a defined population and representative measurements; this page cannot derive it from one visitor.

Entropy (H) = - Σ (P(x) * log2(P(x)))

Where P(x) is the probability of a configuration in the measured population. A configuration observed once per million samples has about 20 bits of self-information in that dataset. It does not follow that the browser is isolated from every device on the internet.

Actionable Mitigation Strategies

Traditional adblockers and incognito mode do not stop browser fingerprinting because your underlying hardware remains identical. To resist fingerprinting, you must reduce your entropy:

Use a browser designed for an anonymity set: Tor Browser standardizes and restricts many surfaces so users resemble one another. Differences can still exist, and behavior or account activity can still identify a person.
Use built-in fingerprinting defenses: Brave applies site- and session-scoped randomization called farbling to selected APIs. It raises the cost of stable cross-site measurement; it does not make linking sessions impossible. See Brave's explanation of farbling.
Use Firefox ResistFingerprinting (RFP): Entering about:config and enabling privacy.resistFingerprinting configures Firefox to act similarly to Tor Browser, capping display sizes, spoofing timezones, and restricting font checks.

Use BrowserProbe's homepage to inspect which signals this browser exposes. The report deliberately does not claim to measure global uniqueness from a single visit.

What Is Browser Fingerprinting? A Technical Deep Dive (2026)