What browser fingerprinting actually is, and why blocking it backfires

Delete your cookies, open a private window, and a site can still recognise you. Not through anything hidden: through the ordinary properties your browser hands to every page it loads.

The mechanism

Any page can read a long list of facts about your setup. Individually each is dull. Your screen is 1920x1080, and so are tens of millions. Your timezone is America/New_York, along with a hundred million others.

The identification comes from the combination. Screen resolution, plus timezone, plus your exact font list, plus your GPU's renderer string, plus your CPU core count, plus the precise floating-point output of an audio processing chain, plus how your GPU rasterises a specific string of text. Each narrows the population. Combine forty of them and you are frequently alone.

The most informative ones:

• Canvas. The page draws text and shapes to an off-screen canvas and hashes the pixels. Rendering depends on your GPU, driver version, font rasteriser and anti-aliasing settings, so the hash varies between machines and is stable on one.
• WebGL. The renderer string names your actual graphics hardware, often precisely. ANGLE (Intel, Intel(R) Iris(R) Xe Graphics ...) says a great deal about the machine.
• Fonts. Which typefaces are installed reflects your OS, your locale, and the software you have installed. It is highly identifying and cross-OS mistakes are obvious.
• AudioContext. Running an oscillator through a compressor produces floating-point output that varies with the audio stack.
• Client hints and the user agent. OS, browser version, architecture, and increasingly the platform, delivered as request headers.

None of this requires storage. There is nothing to clear.

Why blocking makes it worse

The intuitive defence is to block or randomise. It usually backfires, for two reasons.

Rarity is identity. The metric that matters is how many other people share your configuration. A browser reporting no canvas, no WebGL and three fonts is not anonymous, it is unusual, and unusual is a smaller crowd to hide in. Anti-fingerprinting extensions frequently make a browser more distinctive than the default they replaced.

Randomisation announces itself. Real hardware is deterministic. Read the canvas hash twice in one session on a real machine and you get the same value. If yours changes between two reads, you have not hidden the signal, you have published the fact that you are altering it. Detectors check exactly this, and a browser caught lying is more interesting than one that is merely unusual.

Contradiction is the loudest signal of all. A user agent claiming Windows with a macOS-only font list is not rare, it is impossible. Impossible is trivially detectable, and it is the failure mode of every fingerprint assembled from parts rather than sampled from one real machine.

What actually works, depending on your goal

If you want privacy as an individual: blend rather than block. Tor Browser makes everyone look identical, which is the only real defence, at a serious usability cost. Firefox's resist-fingerprinting mode is a milder version. Do not stack five anti-fingerprinting extensions.

If you legitimately operate multiple accounts as an agency or a business, you need each identity to look like a different, ordinary, consistent machine, not a hidden one. That means every signal drawn from a coherent real device, applied below the JavaScript layer so there is no override script to catch, and stable across restarts so run 40 looks like run 1.

That last property is the one people underrate. A profile that regenerates its fingerprint each launch is a new device visiting an old account every time, which is precisely the pattern risk engines are built to catch.

Test your own

• CreepJS at abrahamjuliot.github.io/creepjs is the most thorough public tool, and it specifically reports contradictions between contexts rather than a single score.
• whoer.net for IP, timezone and proxy detection.

Run yours. Then close the browser, reopen it, and run it again. If anything drifts, that is the finding.

We wrote a fuller consistency checklist with the specific pairs that have to agree.