Check What Your Browser Fingerprint Reveals

Check What Your Browser Fingerprint Exposes

Run the inspector above and you see the same signals a tracker sees: information about your device, browser, and settings that combine into a unique identifier.¹ Unlike cookies, fingerprinting is harder to block because it does not rely on stored data; it reads characteristics of your browser and hardware fresh, every time you visit a site.²

How a fingerprint forms from many small signals

A browser fingerprint forms when a site combines many small signals into one profile. No single value such as screen resolution or timezone proves who you are. The power of the technique lies in accumulation: each signal adds a layer of specificity that narrows the pool of matching browsers until only one or two candidates remain.

How entropy compounds across signals

Yet the combination of User-Agent, language, installed fonts, canvas hash, WebGL renderer, audio hash, hardware concurrency, and timezone can narrow the browser population dramatically.² WebGL exposes graphics capabilities through a browser JavaScript API that can use hardware graphics acceleration.³ Consequently, fingerprinting works even when each individual signal looks harmless. Building on this, the fingerprint becomes more stable when the high-entropy signals remain unchanged across sessions, which is why canvas, WebGL, and audio matter so much.¹ A tracker that reads all three can re-identify the same browser weeks later with high confidence, even when cookies are absent and the IP address has changed.

Reading these signals together in CapyToolkit shows how quickly a browser becomes distinctive. The Browser Fingerprint Inspector lists each value with its entropy contribution, so you can see which signals push your profile toward uniqueness. Canvas, WebGL, and AudioContext usually dominate that list, which is why the same three signals appear in almost every re-identification study and why protecting them reduces your overall fingerprint the most.

How fingerprinting differs from cookies and local storage

Fingerprinting feels similar to cookie tracking because both can recognize you later, but the mechanism is different. Cookies and localStorage values live on your device as stored records, so clearing site data can remove them. A fingerprint is calculated again on each visit from live browser properties, which means the same browser can reappear even after a private session ends.

Why deletion tools do not always help

For that reason, clearing cookies, deleting cache files, or closing a private window may stop storage-based tracking while leaving fingerprinting intact. The fingerprint does not live in a file that you can delete or a cache that you can wipe; it emerges from the live interaction between the browser's rendering engine and your hardware every time a page loads.⁴ You should compare the fingerprint before and after each privacy change if you want to know whether the change actually reduced the signals a site can read. Browser-level protections like Brave Shields or Firefox resistFingerprinting produce a measurable difference, whereas deleting site data alone does not.

What a fingerprint reveals and what it does not

Fingerprinting can tell a site that the same browser has appeared before, but it does not automatically reveal your name, email, or physical identity. The identifier is usually a browser-device combination, not a person. If two people share the same device and browser, they can share the same fingerprint. If you switch browsers or upgrade a GPU driver, the fingerprint can change. This distinction matters for privacy: fingerprinting supports recognition and linking, but it becomes personal data when a site connects it to an account or other identifying information. A fingerprint alone cannot tell a tracker your name, yet once that hash is tied to a login event or a form submission, the anonymous identifier becomes a named profile that persists across every future visit.

Reducing your exposure without giving up every convenience

Reducing your exposure starts with choosing which signals you are willing to change and understanding the trade-off each modification introduces. Brave with Shields active provides broad protection while preserving normal browsing for most websites you visit daily.⁵ Firefox with privacy.resistFingerprinting gives you stronger uniformity across the entire browser, but it can break timezone-dependent, screen-size-dependent, and location-sensitive features that some sites rely on.⁶

Matching protection to your browsing needs

Tor Browser gives you the strongest anonymity model, yet it is slower and less compatible with many web apps because all traffic routes through the Tor network relays, adding latency at each hop and limiting support for real-time features like video calls and WebSocket connections that expect low-latency peer connections.⁷ For everyday use, the best approach combines one privacy-focused browser for sensitive sessions with a separate normal browser for tasks where compatibility matters more, so you never have to choose between functionality and protection on a single tab.

Test each browser in CapyToolkit to see which signals it exposes and whether the protection level matches the sensitivity of what you do online, then lock in the configuration that gives you the best balance for your daily routine. This two-browser strategy lets you keep normal site functionality in one window while maintaining genuine privacy resistance in the other, and it avoids the temptation to disable protections on your privacy browser when a single site does not load correctly.

How ad tech and fraud prevention systems use fingerprints

Fingerprinting serves two primary commercial purposes that are often conflated: cross-site advertising attribution and fraud prevention. Ad networks collect fingerprints across all sites where their tracking pixels load, then use them to recognize a browser returning to a retargeting campaign even after cookies are cleared or blocked. A user who visited a shoe retailer with a VPN active and no cookies can still receive targeted shoe ads on unrelated sites, because the ad network matched the canvas hash and WebGL renderer string to the earlier session.

Fraud prevention applies fingerprinting for a different purpose. Financial services and e-commerce platforms collect a fingerprint at checkout and compare it against databases of known-fraudulent hardware profiles, session patterns, and geographic anomalies. This use case is narrower in scope than advertising: the fingerprint identifies a specific device session rather than building a behavioral profile over time. Both uses collect the same signals, which is why the legal distinction between them matters for consent requirements.

Advertising fingerprinting creates a long-term behavioral record linked to browsing history across unrelated sites, while the user derives no direct benefit from this processing. Fraud prevention fingerprinting applies session-scoped matching to protect a specific transaction, and the user benefits directly from that protection. Privacy law increasingly requires operators to document which purpose applies before collecting any fingerprint signal because the lawful basis for each differs.

Entropy and uniqueness: what the research numbers mean

Fingerprinting research measures uniqueness in terms of entropy, a mathematical measure of how much a signal narrows the candidate population. A signal with 1 bit of entropy divides the population in half. A signal with 20 bits identifies one browser among approximately one million. The EFF's Panopticlick research found that a full browser fingerprint provided enough entropy to uniquely identify 83% of browsers in their sample population, even without any stored cookies.⁸

Uniqueness does not mean perfect identification of a person. Two users who share the same machine and browser configuration share the same fingerprint, and a hardware upgrade can change the fingerprint entirely. What uniqueness does mean is that a fingerprint hash can serve as a stable session token across time: if the same hash appears on Tuesday and Thursday, a tracker concludes the same browser returned.

CapyToolkit's Browser Fingerprint Inspector shows a per-signal breakdown alongside an overall entropy estimate. Checking which signals contribute the most entropy, typically canvas, WebGL, and AudioContext, shows where reducing your fingerprint will have the largest practical effect. Reducing the top three entropy contributors by switching to Brave or enabling Firefox RFP typically drops the overall entropy score by 40 to 60 percent, making your browser profile significantly less unique within the global population.

When to use this

Use this guide to understand which signals your browser exposes to trackers and why browser fingerprinting is a growing privacy concern that goes beyond cookies.

Examples

Your browser silently shares: User-Agent, screen resolution, installed fonts, timezone, language, WebGL renderer, canvas rendering, audio fingerprint, installed plugins, Do Not Track setting, and more.

A website combines dozens of signals like User-Agent "Mozilla/5.0...", screen "2560x1440", timezone "America/New_York", and WebGL renderer "ANGLE (NVIDIA...)". Together these create a fingerprint unique enough to identify you among millions.

Site A and Site B both embed the same ad network. The ad network reads your fingerprint on both sites and links your visits even though you never logged in or accepted cookies.

The ad network generates a stable fingerprint hash from your browser signals. On Site A it records hash "a3f8c1...". When you visit Site B, the same hash appears, linking your activity across both sites without cookies.