Browser fingerprinting is a way of recognising your browser by combining many small details about it, such as its version, language, screen size and installed fonts. Because the technique does not store anything on your device, clearing cookies does not erase it. You can make fingerprinting less effective, but few people can eliminate it entirely.
How browser fingerprinting works
Whenever you load a page, your browser tells the site a number of things so the page can display properly. Scripts can also ask the browser to reveal more. Any single detail is common and harmless. The trick is that the combination can be unusual. Think of describing a stranger: “wears glasses” fits thousands of people, but glasses, a green coat, a limp and a particular accent might fit only one.
The signals a site may combine include:
- Browser name and version, and the operating system it runs on.
- Screen resolution, colour depth and window size.
- Preferred languages and time zone.
- Installed fonts and plug-ins or extensions that can be detected.
- How your graphics hardware draws a hidden test image, which varies slightly between devices and drivers.
- How your audio system processes a test sound.
- Settings such as whether you have asked sites not to track you.
The values are mixed into a short string, often called a hash. If the same hash appears again later, the site can guess that it is the same browser, even with no cookie present.
Why fingerprinting is hard to see and hard to stop
Cookies are visible: you can list them and delete them. A fingerprint exists only in the calculation done by a script, and there is nothing stored for you to remove. Sites also use it for reasons that are not about advertising. Banks and online shops sometimes check whether a login comes from a browser they have seen before, as one signal for spotting stolen accounts. That is why blocking every fingerprinting attempt can sometimes trigger extra verification steps.
That dual use is worth keeping in mind. Fingerprinting for fraud prevention and fingerprinting for ad profiling use similar techniques but serve very different interests. Our overview of how websites track you places it alongside the other methods.
How unique are you, really?
Uniqueness depends on how ordinary your setup is. A very common phone running a default browser with default settings looks like many other people. A desktop with unusual fonts, extra extensions, a rare screen size and a customised browser stands out far more. The paradox is that heavy customisation in the name of privacy can make you easier to single out.
Several public testing pages let you see how distinctive your browser appears. Use them as a rough guide only, because results vary and the tests do not reflect every technique a real tracker might use.
Realistic ways to reduce it
Use a browser that tackles fingerprinting directly
Some browsers deliberately return generic or slightly randomised answers to the questions fingerprinting scripts ask, so that many users look alike. Others block known fingerprinting scripts. Check the privacy documentation of your browser to see which approach it takes, and enable the relevant option if one exists.
Keep your setup boring
Fewer extensions, a standard window size and default settings tend to blend in better. Resizing the window to unusual dimensions or installing many add-ons adds to the pattern a script can read.
Keep software updated
Browser makers regularly add protections and close loopholes that scripts exploit. Updated software also means your version number matches the large crowd of other updated users. The wider benefits are covered in our post on why software updates matter.
Limit what runs in the first place
A content blocker that stops known tracking scripts prevents many fingerprinting attempts from running at all. This is often more effective than trying to disguise your browser, because a script that never loads cannot measure anything.
Separate browsing contexts
Using different browsers or profiles for different purposes, for example one for banking and one for general reading, prevents a single fingerprint from tying everything together. Remember that a fingerprint is easiest to use when combined with a login, so signing out of accounts also matters.
Where a VPN fits in, and keeping risk in proportion
A VPN replaces your IP address with the VPN server’s address, which removes one ingredient from the fingerprint, and it protects traffic on untrusted networks. It does not change your fonts, screen size, browser version or hardware behaviour. So a VPN reduces tracking by location and network, not tracking by browser traits. For more on this limit, see our look at VPNs and anonymity.
Keeping the risk in proportion
Fingerprinting is one tool among several, and it tends to be less accurate over time because browsers change and updates alter the values. For most people the sensible response is not to chase perfect anonymity but to make bulk profiling harder. If you have specific safety concerns, such as avoiding a harassing individual, seek advice suited to your situation and local laws.
Where to start
Choose a browser with built-in anti-fingerprinting and tracker protection, keep it updated, and trim extensions to the few you really use. Test your browser once to understand how it looks, then leave the settings alone. More practical guides are collected in our Online Privacy category.
Frequently asked questions
Can I delete my browser fingerprint?
Not in the way you delete cookies, because nothing is stored on your device. You can only change the details your browser reveals, or block the scripts that collect them.
Does private browsing prevent fingerprinting?
Not reliably. A private window still presents largely the same browser and device details to a site, so a fingerprint can look very similar.
Is fingerprinting legal?
Rules differ by country and by how the data is used, so we cannot give a single answer. Check the privacy laws and a site's policy where you live.
Why do some sites use it for security?
A familiar browser signature is one clue that a login is genuine. Fraud teams use it alongside passwords and other checks.
