Understanding Browser Fingerprints
Technical deep-dive into Canvas fingerprinting, WebGL rendering, font detection, and the 47 parameters that make your browser unique. Learn how detection works and how to beat it.
Your browser leaks 47 data points every time you visit a site. Combined, they create a unique fingerprint that identifies you across the web. Here's how it works and how to stop it.
What Makes a Fingerprint Unique?
A browser fingerprint is a hash generated from your device and browser configuration. No cookies involved. Sites collect data points through JavaScript and combine them into a signature.
Research from Princeton University found that 84% of browsers are uniquely identifiable. That means your browser is basically a tracking cookie that you can't delete.
Here are the 47 parameters that matter:
| Parameter Category | Data Points | Entropy Bits | Detection Impact |
|---|---|---|---|
| Canvas Fingerprint | 5 | 15.4 | Critical |
| WebGL Fingerprint | 8 | 14.2 | Critical |
| Audio Context | 3 | 12.8 | High |
| System Fonts | 1 | 13.9 | Critical |
| Screen Properties | 6 | 8.3 | Medium |
| Navigator Object | 12 | 6.7 | Medium |
| Plugins & Extensions | 4 | 5.2 | Low |
| HTTP Headers | 8 | 4.1 | Low |
Entropy bits measure uniqueness. Higher bits = more unique. Canvas and WebGL are the killers. They alone provide 30 bits of entropy. That's enough to identify 1 in 1 billion browsers.
Canvas Fingerprinting: The Silent Tracker
Canvas fingerprinting uses HTML5 Canvas API to draw hidden images. Your GPU and graphics driver render the image slightly differently than everyone else's. The result gets hashed into a unique ID.
Here's how it works:
- Site loads invisible Canvas element
- JavaScript draws text and shapes using specific fonts and colors
- Your GPU renders the image based on your hardware and drivers
- The rendered pixel data gets hashed (MD5 or SHA-256)
- Hash becomes your Canvas fingerprint
Why is this unique? GPU models render anti-aliasing differently. Graphics drivers apply different sub-pixel rendering. Font rendering engines vary between systems. Even identical hardware produces different outputs due to driver versions.
💡 Real Data
EFF's Panopticlick project tested 2.5 million browsers. Canvas fingerprints changed in only 0.8% of tests. That means your Canvas stays constant across sessions, sites, and even browser updates.
WebGL Fingerprinting: GPU Tracking
WebGL exposes your graphics hardware directly to websites. Sites query your GPU vendor, renderer string, driver version, and supported extensions.
Tracked WebGL parameters:
- GPU Vendor: AMD, NVIDIA, Intel, Apple
- Renderer String: Exact GPU model (e.g., "NVIDIA GeForce RTX 3080")
- GLSL Version: Shader language version
- Supported Extensions: 40+ WebGL capabilities
- Max Texture Size: 4096, 8192, 16384 pixels
- Max Render Buffer Size: GPU memory limits
- Aliased Line Width Range: Anti-aliasing capabilities
- Shader Precision: High, medium, low float precision
WebGL rendering also creates a fingerprint similar to Canvas. Sites render 3D shapes and hash the output. Your GPU's floating-point precision creates unique rendering artifacts.
Font Detection: System Profiling
Your installed fonts reveal your operating system, language, and software. Sites test for 500+ fonts using invisible DOM elements.
Detection method:
- Create hidden span with test text
- Apply fallback font (Arial) and measure width/height
- Apply target font (Segoe UI) and measure again
- If dimensions change, font is installed
- Repeat for 500 fonts in 50 milliseconds
Common font signatures:
| Operating System | Signature Fonts | Additional Indicators |
|---|---|---|
| Windows 10/11 | Segoe UI, Calibri, Cambria | Arial Unicode MS, MS Gothic |
| macOS | San Francisco, Helvetica Neue | Apple Symbols, Monaco |
| Linux | Liberation Sans, DejaVu Sans | Ubuntu, Noto Sans |
| ChromeOS | Roboto, Arimo | Noto Sans, Cousine |
Adobe Creative Suite adds 100+ fonts. Microsoft Office adds 50+. Even niche software like AutoCAD or Sketch leaves font fingerprints.
Audio Context Fingerprinting
Web Audio API processes sound using your system's audio stack. Different audio hardware and drivers produce unique signal processing characteristics.
Sites create an AudioContext, generate oscillator signals, apply filters, and measure the output. Your audio processing chain creates subtle differences in frequency response and harmonic distortion.
Screen and Display Properties
Your screen reveals device type and usage patterns:
- Screen Resolution: 1920x1080, 2560x1440, 3840x2160
- Available Screen Size: Resolution minus taskbar/dock
- Color Depth: 24-bit, 32-bit, 48-bit
- Pixel Ratio: 1x (standard), 2x (Retina), 3x (4K)
- Orientation: Landscape vs portrait
- Touch Support: Touch events available
Multi-monitor setups leak even more. Sites detect total screen width spanning all monitors. Unusual values like 5120x1440 (dual 1440p) are highly unique.
Navigator Object: Browser Identity
The Navigator object exposes 12 browser properties:
- User Agent: Browser version and OS
- Platform: Win32, MacIntel, Linux x86_64
- Language: en-US, de-DE, ja-JP
- Hardware Concurrency: CPU core count (4, 8, 16 cores)
- Device Memory: RAM in GB (4, 8, 16, 32)
- Max Touch Points: Multi-touch support (0, 5, 10)
- Do Not Track: DNT header preference
- Cookie Enabled: Boolean flag
These seem generic. But combined with other parameters, they narrow your identity significantly.
How Multilogin Beats Fingerprinting
We don't block fingerprinting. We make you look like someone else.
Each profile gets a real fingerprint from our database of 10 million browser configurations. Your Canvas hash, WebGL data, and font list match actual users. Sites see a legitimate browser, not a blocker.
Key techniques:
- Canvas Spoofing: Inject noise into Canvas rendering without breaking functionality
- WebGL Masking: Replace GPU strings and shader precision with target values
- Font Substitution: Report a consistent font list matching your OS template
- Navigator Replacement: Override all Navigator properties coherently
- Audio Context Manipulation: Normalize audio processing outputs
Everything stays consistent. If you claim to be Windows 10 with an NVIDIA GPU, your Canvas, WebGL, fonts, and Navigator all match. No contradictions.
Dr. Sarah Martinez
Principal Security Researcher
Dr. Sarah Martinez holds a PhD in Computer Security from MIT. She's published 15 papers on browser fingerprinting and tracking prevention. At Multilogin.io, she leads research on detection evasion and fingerprint generation systems.