You cleared your cookies, switched accounts, even opened a private window — and yet the website still seems to recognise you. It is not your imagination. It relies on a form of identification that does not depend on cookies: the browser fingerprint.
The previous article on WebRTC leaks noted that your real IP is only one channel that exposes your identity. The fingerprint is another, and harder to shed. This article breaks down what it is made of.
What a browser fingerprint is
Every time you visit a site, your browser hands over — actively or passively — a bundle of environment details: operating system, screen resolution, installed fonts, graphics card, timezone, language and more. In isolation each item is ordinary and shared by many people.
But combined, they can form a nearly unique identifier. Just as height, weight or hair colour alone cannot confirm a person, a dozen traits stacked together make an overlap vanishingly unlikely.
The key difference is this: a cookie is something the site stores on your device, and you can delete it; a fingerprint is something the site computes from your device's characteristics, and you cannot. Unless you change the device's traits themselves, clearing cookies, switching browser profiles or opening a private window usually leaves the fingerprint intact.
What a fingerprint is made of
User-Agent and platform information
The most basic layer. The User-Agent (UA) string declares your browser type, version and operating system. Together with properties like navigator.platform and navigator.language, it forms the basic outline of an identity.
This layer is the easiest to fake, so risk systems do not trust it alone. They cross-check it against other signals — for instance, a UA claiming to be an iPhone while supporting mouse hover events is a contradiction.
Screen and display parameters
Screen resolution, available area, colour depth, device pixel ratio. The combination is more distinctive than you would expect, especially once multiple monitors, high-DPI screens and scaling settings stack up.
Canvas fingerprint
The classic and most effective technique. It works by having the browser draw text or shapes on a hidden canvas, then reading back the pixel data of the result.
Because different graphics cards, drivers, operating systems and font-rendering engines produce minute but stable differences when processing the same drawing instructions, that pixel data becomes a highly stable identifier. You see nothing drawn, but the site already has the result.
Canvas fingerprints are very stable — on the same device, they usually stay unchanged for a long time.
WebGL fingerprint
Similar to Canvas but going further, using 3D rendering. It can read your graphics card model and driver information (for example "ANGLE (NVIDIA GeForce RTX 3060)") and extract finer hardware differences by rendering a 3D scene.
The graphics information WebGL exposes is also a key basis for detecting virtual machines: if the renderer shows a software renderer like SwiftShader or llvmpipe, there is very likely a virtual machine or headless browser behind it.
Installed fonts
A site can probe which fonts your system has by measuring the rendered size of text. Font lists vary from person to person — a device that has had particular software, language packs or design tools installed carries a distinctive combination, quite discriminating.
Audio fingerprint
Like Canvas but using audio. The browser generates and processes an audio signal, and different devices' audio stacks produce subtle differences that form an identifier. This one is fairly stealthy; ordinary users almost never notice it.
Hardware and system information
Logical CPU core count (navigator.hardwareConcurrency), device memory (navigator.deviceMemory), touch support, battery status and so on. Each is weakly distinctive on its own, but as part of the combination still contributes information.
Why risk systems value fingerprints
For risk control, fingerprints solve a problem the IP cannot: tracking the same device across IPs.
A person can change IPs, proxies and cookies frequently, but if their device fingerprint stays the same, the risk system can still tie those actions back to one machine. Conversely, if one fingerprint appears with many different accounts and IPs in a short window, that is itself a strong signature of bulk operation.
This is why "anti-detect browsers" exist — they try to forge an independent, consistent fingerprint for each account, so every identity looks like it comes from a different real device. But forging a fingerprint is hard to do perfectly: the traits must all be consistent with one another, and a single mismatch gives it away.
Can a fingerprint be eliminated entirely
Hardly, and the direction is often counter-intuitive.
"Invisibility" is not necessarily safer. If you block every probeable item, you end up with an anomalous "nothing detectable" fingerprint — a device that rare is itself conspicuous. What is genuinely hard to track is usually an ordinary configuration that blends into the crowd, not one deliberately hidden.
Some countermeasures introduce new traits. Certain anti-fingerprint tools add random noise to Canvas so each read differs. But "the result changes every time" is itself a recognisable pattern.
Fingerprinting evolves. Browser vendors are gradually restricting high-risk APIs (Firefox and Safari's default protections for Canvas and fonts, for example), but new probing methods keep appearing. It is a continuous back-and-forth.
For most people, the practical privacy strategy is not to chase a "zero fingerprint" but to use browsers or tools that actively protect against fingerprinting while keeping you looking as ordinary as possible.
How to check your own fingerprint
Open the environment check and the page lists the main fingerprint items your browser exposes: UA, screen parameters, graphics renderer, timezone, language and more, flagging the parts that look anomalous.
A few signals worth watching:
- Graphics renderer shows a software renderer (SwiftShader, llvmpipe) → possibly a virtual machine or headless environment
- Timezone inconsistent with the IP's location → a common risk flag
- UA contradicts actual capabilities (claims to be a phone yet supports mouse events) → the UA has been spoofed
All of these checks run locally in your browser and upload nothing.
Summary
A browser fingerprint is a cookie-independent form of identification, formed from a dozen-odd traits: UA, screen parameters, Canvas, WebGL, fonts, audio and more. Its value lies in tracking the same device across IPs and across cookies, which makes it one of the core tools of risk systems.
A fingerprint is hard to eliminate, and hiding it deliberately often backfires — a "too clean" fingerprint is more conspicuous than an ordinary one. Understanding its composition helps you judge how your environment looks to a website, and that is exactly what the environment check is there to show you.