What Does My Browser Give Away?
Every signal your browser hands over automatically, and how much each one narrows you down.
Why this is harder to escape than cookies
A cookie is a file. It has a name, an expiry, and a delete button, and clearing it genuinely works. A fingerprint is not stored anywhere — it is recomputed from what your browser is, every time you arrive. There is nothing on your machine to find and nothing to clear, which is why “I clear my cookies” is not an answer to it.
None of the values above required a permission prompt. Your screen size, GPU, installed fonts and timezone are readable by any script on any page, and were readable long before anyone thought to combine them. That combination is the technique: no single value identifies you, but each one divides the population, and a dozen divisions is usually enough to land on a group of one.
Where the identifying power actually comes from
The red dots in the list above mark the signals that do the work. In rough order:
- GPU renderer. The exact graphics chip and driver string. Precise, stable for the life of the machine, and unusual enough on desktop to be near-decisive. Several browsers now hide it behind a flag for exactly this reason.
- Installed fonts. Nobody installs fonts deliberately — they arrive with applications. So the set is really a list of the software you run, and it is remarkably distinctive.
- Canvas rendering. Draw the same shape and text on two machines and the pixels differ, because anti-aliasing and font hinting are implemented in the GPU driver. Hash the result and you have a stable per-device value from an API that exists to draw graphics.
- Timezone. Weak on its own — hundreds of millions of people share yours. Interesting because it comes from the operating system, so it is the value most likely to disagree with everything else.
The user agent, despite being the thing everyone talks about, is one of the weakestsignals in the list. Hundreds of millions of people run the same Chrome build on the same Windows version. It is only the version numbers that narrow anything down, and browsers have been steadily freezing and truncating those.
What people try, and what it does
| Approach | Effect on the signals above |
|---|---|
| Clearing cookies | None. Not one value on this page is stored in a cookie. |
| Private / incognito window | None, on most browsers. Compare the hash yourself — it usually matches. |
| Connecting to a VPN | None. Changes your IP address, which is not on this page. |
| User-agent spoofing extension | Usually worse. Creates a combination nobody else has, and the mismatch between the claimed and real platform is itself detectable. |
Brave, or Firefox with resistFingerprinting | Real reduction. Canvas is randomised or blocked, hardware values are rounded or withheld, fonts are limited to a standard set. |
| Tor Browser | The strongest available, and by a different strategy: every user is made to look identical rather than unusual. |
The pattern in that table is the whole lesson. Fingerprinting measures deviation from the crowd, so anything that makes you distinctive helps the tracker, however privacy-motivated it was. Blending in is the only strategy that scales, which is why the browsers that take this seriously converge on making their users interchangeable rather than exotic.
Why your hash may change on reload
If the value at the top of this page differs each time you refresh, that is not a bug. Brave and Firefox’s resist-fingerprinting mode both add per-session noise to canvas reads specifically so the resulting hash cannot be used as an identifier. A hash that changes is a hash that tracks nobody — which is the outcome you want, and the reason it is worth reloading once to check.
Where this fits with the rest
Fingerprinting is the device layer. The network layer is a separate question with separate answers: what your IP address reveals, whether your DNS queries are going where you think, and whether WebRTC is exposing an address your proxy settings never see. Those are the ones a VPN genuinely changes. If you want both layers assessed in one pass, the full privacy check covers them together.
What people ask about fingerprinting
How unique is my fingerprint?
This page will not tell you, because it cannot know. A figure like "you are unique among 280,000 tested browsers" requires a database of every visitor who has ever run the test, which means storing fingerprints — the exact thing this tool is built not to do. Sites that quote a ratio are comparing you against their own visitor pool, which is self-selected towards privacy-conscious people and is not the population that matters. What you can judge from the list above is which of your signals are unusual, which is the actionable part.
Does a VPN change my browser fingerprint?
No, and this is the most common misunderstanding about VPNs. A VPN operates on the network: it changes the IP address a site sees and encrypts traffic in transit. Every value on this page comes from your device and browser, not your connection, so all of it is identical before and after you connect. The one interaction worth knowing is the reverse — connecting through a distant server creates a visible contradiction between your IP location and your unchanged timezone.
Does private or incognito mode help?
Against fingerprinting, almost not at all. Private browsing discards cookies and history when you close the window; it does not alter your screen size, GPU, fonts, timezone or canvas rendering. Open this page in a private window and compare the hash — on most browsers it will be identical, because the signals it is built from have nothing to do with stored data.
Can I stop being fingerprinted?
You can reduce it, and the effective methods are counter-intuitive. Blending in beats standing out: Tor Browser makes every user look identical, which is far stronger than making yourself unusual. Firefox with resistFingerprinting and Brave with its randomisation both meaningfully reduce the signal. What does not work is manually changing your user agent or installing a spoofing extension — an unusual combination of values is more identifying than the ordinary one you replaced, and inconsistencies between spoofed and real values are themselves detectable.
Why is Do Not Track listed as identifying?
Because so few people enable it. A setting that a small minority turns on splits the population unevenly, and being in the small group is what makes you distinguishable. Combined with the fact that the header is advisory and almost universally ignored, enabling it costs you a little privacy and buys none. It is a neat illustration of the general problem: every deviation from the default is a bit of information.
Is fingerprinting legal?
It is regulated rather than banned. Under UK and EU rules, storing or accessing information on a device generally requires consent, and both the ICO and EU regulators have stated that fingerprinting falls within that — it is treated much like a cookie, regardless of the technical differences. Enforcement is uneven, and the technique is widespread in fraud detection and bot prevention as well as advertising. What is not in question is that it is invisible: nothing in the list above triggered a permission prompt.
The one place your VPN and your fingerprint contradict each other.
Nothing on this page changes when you connect to a VPN — it all comes from your device, not your network. What does change is your IP address, and that creates a mismatch worth knowing about: if your IP says Frankfurt while your timezone still says Asia/Karachi, a site can see both. It is not a leak and it does not undo the encryption, but it is a signal, and it is why JaguarVPN offers exit locations across enough regions to pick one near you rather than one that argues with your clock.
Last reviewed . Found something out of date? Tell us.