中文 · EN
fingerprintprivacy

Browser Fingerprinting: Tracking That's Harder to Shake Than Cookies

Cookies cleared, incognito on — why do sites still recognize you? Browser fingerprinting stitches dozens of hardware and software traits into a unique profile; here's how it works, its dimensions, and how to fight back.

Incognito mode blocks cookies. It doesn't block fingerprinting.

Sites score every visitor's browser profile — not by any single trait, but by piecing dozens of traits together. The uniqueness of the combination means "recognizing you" no longer depends on any storage. That's browser fingerprinting.

The principle: uniqueness through combination

No single trait is unique: hundreds of millions use Chrome, tens of millions have a 1920×1080 screen. But stack the traits together:

Chrome 132 + Windows 10 + GPU rendering result X + font list Y + timezone + language + screen + touch support...

The entropy of the combination shoots up. Research (AmIUnique and others) shows that with just a dozen or so traits, more than a third of browsers are unique across the entire web.

The most crucial property: the fingerprint lives on "you", not in any deletable storage. Clear your cookies, switch to an incognito window, even reboot the machine — the fingerprint remains.

Main collection dimensions

Canvas fingerprinting

Have the browser draw a piece of text and some shapes on a <canvas>, then read back the pixel data. Differences between machines in:

  • GPU and drivers
  • anti-aliasing algorithms
  • font rendering engines

make identical drawing instructions produce tiny pixel differences. Hash that difference and you have a stable fingerprint. Chrome also injects random noise with every version, which ironically turns "how the noise is handled" into a new fingerprinting trait itself.

WebGL fingerprinting

One step further: read the WebGL renderer string (which exposes the GPU model) plus render a 3D scene and hash the pixels. You also pick up the GPU vendor and max texture size along the way.

AudioContext fingerprinting

Call the browser's audio processing API (OfflineAudioContext), process a synthetic signal with fixed parameters, and read the output floats. Differences in floating-point math and audio implementations across machines yield a stable hash. No microphone needed, no sound produced.

Font enumeration

The page tests hundreds of fonts one by one: if the measured text width matches, the font exists. Having Source Han Sans + Sarasa Mono installed is itself a niche signal.

Dozens of other items

  • UA, platform, language list
  • timezone and timezone offset
  • screen resolution, color depth, touch points
  • hardware concurrency (navigator.hardwareConcurrency)
  • device memory (navigator.deviceMemory)
  • Do Not Track status and whether an ad blocker is on

IPchase's fingerprint check turns these dimensions into a visual report — 7 major fingerprint categories plus consistency analysis; one run shows how "unique" your browser really is.

Why fighting it is so hard

The asymmetry in the fingerprinting arms race:

  • Defenders must keep everything consistent; attackers need just one unique trait. You changed your Canvas hash but your font list stayed the same — still the same "you who changed your Canvas hash"
  • Spoofing is itself a trait. A too-rare font combination or a too-tidy fake fingerprint stands out even more
  • Cross-device linkage: phone and desktop fingerprints differ, but behavior patterns (typing cadence, browsing paths) can link them

Practical countermeasures

Ranked by value for effort:

  1. Use a mainstream browser from a major vendor: the more common, the better you blend in — the latest Chrome's default configuration is the "largest crowd"
  2. Don't install niche fonts: leave system fonts as they are
  3. Anti-fingerprint browsers (Multilogin, AdsPower and the like): inject a consistent fake fingerprint per environment, suited to multi-account operations. Note that while they solve the "consistency" problem, they also create new traits
  4. Firefox + resistFingerprinting: Mozilla's approach is to flatten all traits to the same values (coarser time granularity, uniform Canvas noise) so everyone looks alike. The downside is reduced web compatibility
  5. Tor Browser: the same idea, more aggressive, at the cost of speed

For ordinary users, 1 + 2 gives the best value.

Summary

  • A fingerprint = the uniqueness of a combination of environment traits; it doesn't rely on deletable storage
  • Core dimensions: Canvas, WebGL, AudioContext, fonts, hardware parameters
  • The core counter-strategy: hide in a large crowd, or flatten the differences
  • A browser environment with a high "disguise score" = few traits and high consistency

Want to see what your browser fingerprint looks like and how unique it is? Run IPchase's fingerprint check directly — nothing to install.

Check your own network: run a full disguise check on the homepage, or try the fingerprint test.

Keep reading

Three Right Ways to Batch-Look Up IP Geolocation

Server inventories, proxy pool audits, log analysis — the scenarios, methods, and result-reading techniques for resolving the ownership of dozens or hundreds of IPs at once.

Subnetting and CIDR Notation: A Practical Working Guide

From /24 to /30 — how to read, calculate, and carve up CIDR notation, with a manual verification method so subnetting stops being rote memorization at work.

Where Cross-Border Latency Comes From: Submarine Cables, Detours, and Congestion

Why does Singapore to the US start at 160ms physically? Breaking down the four sources of cross-border network latency — the speed of light and cable paths, routing detours, congestion queuing, device forwarding — plus how to use ping to pinpoint which segment is at fault.