What Your Browser Reveals
Everything a website can read about your device the moment you arrive, without a cookie, and without asking.
In short
Websites can read your screen size, timezone, language, fonts, GPU and canvas rendering without permission. The combination is often unique, persists through private browsing, and cannot be cleared like a cookie.
Last reviewed
Runs entirely in your browser. Nothing you type here is uploaded, stored or logged.
Why this is different from cookies
Cookies are files a site stores on your device. You can see them, block them and delete them, and there are laws about asking first.
A fingerprint isn't stored anywhere. It's derived from characteristics your browser broadcasts in order to work at all, screen size so pages lay out correctly, language so you get the right translation, fonts so text renders. Nothing is being stored on your machine, so there's nothing to clear.
Individually these values are unremarkable. Millions of people have a 1920×1080 screen. Millions are in the Europe/London timezone. But the combination of thirty such values is frequently unique, and it persists across private browsing windows and cookie clearing.
The counter-intuitive part
Making your browser unusual makes you easier to track, not harder.
If you install twelve extensions, a rare font pack, spoof your user agent to something no one else uses and disable a handful of APIs, you become the only person on the internet with that exact profile. You've turned yourself into a permanent identifier.
This is why the effective defence is the opposite: look like everyone else. Tor Browser makes every user report identical values, same window size, same fonts, same timezone, so the fingerprint identifies the crowd rather than the person.
What actually helps
- Tor Browser for anything where anonymity genuinely matters. It is the only mainstream option that treats fingerprinting as a primary threat.
- Firefox with
privacy.resistFingerprintingenabled, normalises timezone, screen and several APIs. It breaks some sites, which is the trade-off. - Safari ships fingerprinting protections on by default, presenting a simplified system profile.
- Brave randomises certain values per-session, so the fingerprint doesn't persist.
- A content blocker stops most fingerprinting scripts loading at all, which is more effective than fighting them once they run.
- Keep the window at a common size and don't maximise on an unusual monitor.
What doesn't help much: private browsing mode (it clears cookies, not characteristics), changing your user agent string alone, or a VPN by itself. A VPN hides your IP address, which is worth doing, but leaves the entire fingerprint intact.
What each signal gives away
| Signal | What it reveals |
|---|---|
| Screen and window size | Device class, and an unusual resolution is highly identifying |
| Timezone | Roughly where you are, and it contradicts a VPN in a different country |
| Languages | Where you're from, sometimes more precisely than your IP |
| CPU cores and memory | Device class and rough age |
| Graphics renderer | Your exact GPU model, often very distinctive |
| Canvas rendering | Tiny differences in how text and shapes draw, driven by OS, drivers and fonts |
| Touch support | Phone, tablet or desktop |
| Do Not Track | Ironically, another bit of identifying information. And it is almost universally ignored |
Where it's actually used
Advertising and analytics. As third-party cookies disappear, fingerprinting is the fallback for tracking people across sites. This is by far the largest use.
Fraud prevention. Banks and payment processors use device recognition to spot a login from an unfamiliar machine. This is a genuinely defensible use, and it's why blunt anti-fingerprinting sometimes triggers extra verification.
Bot detection. Automated traffic often has an implausible fingerprint, no fonts, headless browser, impossible hardware.
Paywall and limit enforcement. Recognising a returning visitor who cleared their cookies.
How worried to be
For most people this is a privacy annoyance rather than a danger: it means the advertising ecosystem can follow you around without your consent and without a mechanism for you to opt out.
For people whose safety depends on not being identified, journalists protecting sources, activists, people escaping abusive relationships, it's a real and underappreciated risk, and the right answer is Tor Browser rather than incremental hardening.
Either way, the reason to look is that the whole mechanism is invisible. You can see a cookie banner. You can't see this.
Frequently asked questions
What is browser fingerprinting?
Identifying you by the combination of settings your browser exposes, screen size, timezone, language, fonts, hardware, graphics rendering, rather than by a cookie. No single value identifies you, but the combination is often unique, and unlike cookies you cannot clear it.
Does this page track me?
No. Everything is read and displayed locally and nothing is transmitted or stored. The point is to show you what any site could collect the moment you arrive, without asking permission.
Why does my IP address not appear?
Because reading it would require contacting a server, which would mean sending your address somewhere. Every site you visit sees your IP automatically, that is how the request reaches them. But this page deliberately does not go looking for it.
How do I reduce my fingerprint?
Counter-intuitively, not by making yourself unusual. Rare configurations are more identifiable, not less. Tor Browser makes everyone look identical, which is the only genuinely effective approach. Firefox with resistFingerprinting and Safari's protections both help. Installing lots of unusual extensions and fonts makes things worse.
Is a unique fingerprint actually a problem?
It depends on your threat model. For most people it means advertising networks can follow them across sites without cookies. For journalists, activists and abuse survivors it can be considerably more serious. Either way it is worth knowing it exists, because it is invisible by design.