Cookies Are Only Half the Story§
Everyone knows about cookies. Clear your cookies, go incognito, use a VPN — these are the standard moves for people who care about privacy. But there is another tracking method that none of these defenses stop: browser fingerprinting.
Fingerprinting doesn't store anything on your device. It doesn't need your permission. It works even in private/incognito mode. And it's used by ad networks, analytics providers, and fraud detection systems everywhere.
What Gets Collected During Fingerprinting?§
A fingerprint is assembled from dozens of browser and device properties. Each individual value is ordinary — but in combination, they create something surprisingly unique.
Here's what fingerprinting scripts typically read:
Browser and OS§
- User agent string (browser name, version, OS)
- Browser language and timezone
- Do Not Track header value
- List of installed browser plugins
Screen and Display§
- Screen resolution and color depth
- Device pixel ratio (reveals Retina/HiDPI displays)
- Available screen size vs. total screen size (reveals taskbar presence)
- Window size and orientation
Hardware Signals§
- Number of logical CPU cores (
navigator.hardwareConcurrency) - Device memory (
navigator.deviceMemory) - Battery status (charge level, charging state)
- Network connection type (4G, Wi-Fi, etc.)
Canvas and WebGL§
Canvas fingerprinting draws invisible shapes in an off-screen canvas element, then reads back the pixel values. Because different graphics hardware and drivers render text and shapes slightly differently, two devices rarely produce identical canvases — even running the same browser on the same OS.
WebGL fingerprinting does something similar: it queries the GPU vendor and renderer strings, then renders a 3D scene to compare pixel output.
Audio Context§
The Web Audio API generates and processes a short audio buffer. Hardware and software differences in audio processing produce a unique "audio fingerprint."
Fonts§
Scripts test which fonts are installed on your system by rendering text in hundreds of font families and measuring whether the font loaded (based on element dimensions). Your combination of installed fonts reveals a lot about your OS, software, and locale.
How Unique Is a Browser Fingerprint?§
The EFF's research project "Cover Your Tracks" (formerly Panopticlick) found that 83.6% of browsers have a unique fingerprint among visitors to their site. If your browser has JavaScript enabled and Flash installed (historically), that number rises above 94%.
The math: if 10 attributes each have 10 possible values, that's 10^10 = 10 billion combinations. In reality, most attributes have far fewer values, but the correlation between attributes makes the space of real-world fingerprints much smaller — and more unique.
Fingerprinting vs. Cookies: Key Differences§
| Cookies | Browser Fingerprinting | |
|---|---|---|
| Storage location | Your device | Tracking server |
| Can be deleted | Yes | No (it's recalculated) |
| Works in incognito | No | Yes |
| Requires consent (GDPR) | Yes (in EU) | Debated |
| Survives browser reinstall | No | Sometimes (if hardware unchanged) |
| Survives VPN | No | Yes (if browser/hardware unchanged) |
This is the fundamental problem: fingerprinting is stateless from your device's perspective. There is nothing to clear, block, or delete.
Check Your Own Fingerprint§
The NexaTools Browser Fingerprint tool shows exactly what data your browser exposes and generates your fingerprint hash in real time. You'll see every attribute collected — canvas data, WebGL, hardware values, installed fonts — and how unique your configuration is.
This is useful for:
- Privacy audits before important browsing sessions
- Testing the effectiveness of anti-fingerprint browser extensions
- Understanding what tracking scripts can see
Who Uses Fingerprinting, and Why?§
Advertising Networks§
Cross-site fingerprinting allows ad networks to track your journey across different websites without a shared cookie. If you read about running shoes on one site, you'll see shoe ads on unrelated sites — even after clearing cookies.
Fraud Detection§
Banks and payment processors use fingerprinting for the opposite purpose: legitimate security. If your account is suddenly accessed from a browser with a completely different fingerprint, that's a signal of account takeover. Fingerprinting is a key tool in fraud detection systems like Sift and Kount.
Analytics Services§
Some analytics platforms use fingerprinting to de-duplicate "unique visitors" more accurately than cookies alone.
Paywalls and Bot Detection§
Publishers use fingerprinting to enforce article limits ("10 free articles per month") even when users clear cookies. Bot detection services (Cloudflare, Akamai) use it to distinguish humans from automated scripts.
Can You Stop Browser Fingerprinting?§
Fully blocking fingerprinting without breaking the web is very difficult. Here's an honest assessment of the options:
Tor Browser§
Tor Browser is the most aggressive anti-fingerprint browser. It normalizes every fingerprint attribute to make all Tor users look identical: same window size, same fonts, same canvas output (via controlled randomization). The tradeoff: many sites block Tor exit nodes.
Brave Browser§
Brave randomizes canvas and audio fingerprints per session. This doesn't make your fingerprint identical to others — it makes it different each time, so trackers can't build a persistent profile. This is called "fingerprint randomization" rather than "fingerprint blocking."
Firefox with Privacy Resistances§
Firefox's privacy.resistFingerprinting setting (available in about:config) applies Tor Browser-style normalization. It also disables the Battery API, limits timezone precision, and reports fake screen dimensions.
Browser Extensions§
Extensions like "Canvas Blocker" and "CanvasBlocker" intercept canvas read operations and return randomized or zeroed data. The problem: blocking canvas entirely makes your browser more distinctive, not less.
VPN§
A VPN changes your IP address but does nothing to your browser fingerprint. IP address is typically not included in fingerprint calculations anyway.
Conclusion§
The most practical defense for most people is Brave (randomization) or Firefox with privacy.resistFingerprinting. Full protection requires Tor Browser. No extension or VPN alone is sufficient.
The GDPR Question§
Under the GDPR and ePrivacy Directive, fingerprinting for tracking purposes requires a legal basis — typically consent. The UK ICO has explicitly stated that fingerprinting for tracking is subject to cookie law. However, enforcement is patchy, and many sites fingerprint without explicit disclosure.
Related Tools and Reading§
- NexaTools Browser Fingerprint Viewer — see your own fingerprint
- EXIF Stripper — remove device metadata from photos before sharing
- NexaVault File Encryption — encrypt sensitive files before cloud storage
Understanding what your browser reveals is the first step to controlling it. Run the Browser Fingerprint tool to see your own exposure — no account, no tracking, all client-side.