Browser Fingerprint & Privacy Leak Inspector

Fingerprinting without cookies

Cookies require explicit storage: a tracker must write a file to your browser and read it back later. You can delete cookies, block third-party cookies, or browse in private mode. Browser fingerprinting requires none of these conditions. It works by querying APIs that every browser exposes by design, including your screen dimensions, installed fonts, GPU renderer, audio pipeline behaviour, and dozens of other signals that your browser reports to any website at any time without warning.¹

Each individual signal is weak. Knowing your screen resolution alone tells a tracker almost nothing because millions of users share 1920x1080. But combine it with your GPU renderer, your audio fingerprint, your installed fonts, your timezone, and your language list, and the intersection becomes very small. At 20 or more bits of entropy, a fingerprint is specific enough to re-identify a single browser across sites, sessions, and private windows without ever touching your storage.² That is why clearing your cookies alone does not stop tracking when your browser fingerprint stays the same.

Canvas & WebGL explained

Canvas and WebGL fingerprinting are two of the most widely used tracking techniques because they tap into rendering pipelines that vary subtly between otherwise identical browsers. By drawing a fixed image and hashing the pixels, or by reading the GPU renderer string directly from the graphics driver, a tracker can derive a stable identifier that survives cookie clears and private browsing sessions.

How the canvas hash is built

The canvas fingerprint draws a specific test image (text at two font sizes, a filled rectangle, and an emoji) onto an offscreen canvas and then hashes the raw pixel output. Different operating systems, GPU drivers, and font renderers produce slightly different pixel values for the same drawing commands. The result is a short hex hash that stays stable across page loads on the same machine but differs across most other configurations, which is what makes it useful for tracking without cookies.³

WebGL fingerprinting reads the unmasked GPU vendor and renderer strings via the WEBGL_debug_renderer_info extension. This reports the actual GPU model name, for example ANGLE (NVIDIA GeForce RTX 4070 Direct3D11 vs_5_0 ps_5_0), directly from the graphics driver. Because GPU models are specific and the driver version is often included, this string narrows the fingerprint to a very small population even before combining it with other signals.⁴

What the entropy score means

Shannon entropy, measured in bits, describes how much information a set of signals carries. One bit of entropy halves the candidate pool: a signal worth 1 bit means half of all browsers share your value, so you are narrowed to half the population. Ten bits means 1 in 1,024 share your exact combination. Twenty bits is 1 in roughly 1 million. At 22 bits the candidate pool is smaller than most cities.

The score here is an approximation based on weighted signal contributions. Canvas hash, audio fingerprint, and WebGL renderer each carry the most weight because they vary the most between devices. Signals that return unknown or blocked contribute nothing, so a browser that suppresses these signals actively lowers its entropy score.² Browsers that resist fingerprinting by reporting generic values end up blending into a larger crowd of identical users.

A concrete score makes the scale easier to read. A combined entropy reading of 24 bits sits above the 22-bit mark where the candidate pool shrinks below the population of most cities. That score alone can re-identify a single device without a cookie in sight. Dropping below 20 bits usually takes more than one fix, since a tracker recombines every remaining signal until a comparable pool re-emerges.

How to reduce your fingerprint

Reducing a browser fingerprint is less about hiding any single signal and more about blending into a large group of identical users. Privacy tools that randomise or standardise the high-weight signals while leaving the browser otherwise functional tend to be far more effective than piecemeal tweaks that leave the distinctive combinations intact.

Joining a large crowd

The most effective approach is to join a large crowd rather than hide individual signals. Brave with shields enabled randomizes values from browser and OS feature APIs, including canvas and Web Audio outputs, so the hash can change by site and session.⁵⁶ Firefox with privacy.resistFingerprinting set to true in about:config reports generic spoofed information for data commonly used for fingerprinting, such as CPU cores, timer precision, and the local timezone.⁷

Blocking a single signal in isolation, such as spoofing just the user agent string, rarely reduces trackability in practice. Trackers cross-reference all available signals and weight them by stability. A spoofed user agent combined with an unchanged canvas hash still produces a distinctive fingerprint. Effective reduction means suppressing the high-weight signals (canvas, WebGL, audio, and fonts) simultaneously rather than one at a time.

Hardware-level signals like screen resolution and hardware concurrency are harder to spoof without breaking site layout or performance. Using a standard monitor resolution such as 1920x1080 and a common CPU core count reduces but does not eliminate the contribution of those signals. Pairing a common configuration with a privacy-hardened browser is the most reliable way to shrink your fingerprint without breaking the sites you visit.

Which signals trackers weight most heavily

Trackers do not treat every signal equally. Some signals vary wildly between devices and carry a lot of entropy; others are shared by millions of users and do little to narrow the candidate pool. Understanding the hierarchy helps you decide which signals to suppress first in order to get the largest reduction in uniqueness.

The highest-weight signals

Not all fingerprinting signals carry equal weight. Privacy guidance treats active fingerprinting as code that observes browser, device, and context characteristics, then recommends limiting APIs to the entropy they truly need.¹ Canvas hash and WebGL renderer sit at the top because they vary by GPU model, driver version, and operating system simultaneously, producing values that narrow the candidate pool before combining with other signals.³⁴ Audio fingerprint ranks next: research shows Web Audio vectors can add entropy to existing fingerprinting mechanisms, even when individual audio outputs vary across repeated attempts.⁸

Installed fonts occupy a different tier. The presence or absence of specific fonts correlates with the software installed on a system: a machine with Adobe Creative Cloud has different fonts than a stock Windows install, and those differences appear consistently in font-probing results. W3C notes that installed font lists can fingerprint a user because the default set varies by user agent, platform, and locale.⁹ Timezone and language list sit lower on the hierarchy but rarely appear alone; trackers combine them with the high-weight signals to resolve ambiguity when two users share the same GPU or font set.

Screen resolution and hardware concurrency carry the lowest weight of the commonly collected signals. Millions of users share 1920x1080 or 2560x1440 displays, so resolution alone distinguishes almost no one. Similarly, 8-core and 12-core CPUs are extremely common. The rows marked TRACKABLE in the inspector flag the highest-weight signals; suppressing those first gives you the greatest entropy reduction with the least impact on normal site functionality. Addressing lower-weight signals without fixing the high-weight ones leaves the fingerprint nearly as distinctive as before, because trackers discard redundant low-entropy signals once the high-entropy ones are sufficient to make a unique identification.