You cleared your cookies, opened a private window and turned on a VPN. Some websites can still tell it's you. Not by anything they stored on your device, but by the browser itself: the fonts you have installed, the way your graphics card draws a line of text, your screen size, your language list and your time zone. Put together, those details form a browser fingerprint.
I built a free Browser Fingerprint Test on this site so you can see yours, signal by signal. This post explains what fingerprinting is, what the test shows you, and what actually helps if you want to be less recognisable.
What is browser fingerprinting?
A cookie is an ID that a site stores on your device. You can see it, delete it or block it. A fingerprint is different: nothing is stored. The site simply asks your browser a series of ordinary questions, such as "what's your screen size?", "which fonts do you have?" and "draw this image and show me the pixels", and combines the answers into one ID.
No single answer identifies you. Millions of people use a 1920×1080 screen. But the combination of dozens of answers narrows things down fast, and because the ID is recalculated from scratch on every visit, clearing cookies doesn't reset it. That's why ad-tech, analytics and anti-fraud systems use fingerprints alongside cookies and your IP address.
The signals that give you away
- Canvas. The browser draws text and shapes off-screen. Tiny differences in your GPU, driver, OS and fonts change the exact pixels, so the result differs between devices that look identical.
- WebGL. Your graphics card's name, plus the limits and extensions it supports.
- Audio. A silent tone is processed in memory. Each platform's audio stack rounds the numbers slightly differently.
- Installed fonts. Microsoft Office, Adobe apps, developer tools and language packs all install fonts that most people don't have.
- Device and browser details. The user agent, screen resolution, CPU cores, memory, languages, time zone, dark mode and similar preferences.
- Request headers. Your browser sends some of these details (language, browser brand, platform) with every request, before any script runs. You can inspect them with the HTTP Header Checker.
How the Browser Fingerprint Test works
Open findwhatismyip.com/fingerprint and it starts working straight away. You get up to three IDs:
- Your fingerprint ID. A hash of every signal from the quick scan that your browser reports consistently. It's computed automatically in a fraction of a second.
- No-JavaScript fingerprint ID. Built only from the request headers your browser sent to load the page. This is what any server can see even if you block all scripts.
- Detailed fingerprint ID. Appears when you click Run detailed scan. It adds a deeper set of signals on top of the quick scan.
| Quick scan (automatic) | Detailed scan (on request) |
|---|---|
| Canvas rendering hash | About 200 fonts instead of 60 |
| WebGL GPU name, limits and extensions | A WebGL rendering test (your GPU draws a small shaded scene) |
| Audio processing hash | Every WebGL 2 limit and shader precision value |
| 60 common fonts | Text-to-speech voices installed on your system |
| User agent, platform, languages, time zone | Which audio and video codecs your browser can play |
| Screen, hardware, display preferences, browser flags | Maths precision quirks of your JavaScript engine |
| Request headers (no JavaScript needed) | How numbers, money and dates are formatted for your locale |
The detailed scan is optional and gets its own ID on purpose: your main fingerprint ID stays the same whether or not you run it, so you can compare it across visits. The page shows how long the detailed scan took, which is usually well under a second.
What happens to your data: the fingerprint is computed in your browser and is never sent to my server or stored. The page has no form that submits it and sets no cookies of its own. Like the rest of the site it does load Google Analytics, but the fingerprint itself never leaves your browser. You can copy the full result as JSON if you want to keep it or compare it later.
How to read your results
Each signal has a short explanation of why it identifies you. Some also get a badge:
- randomised: your browser added noise, so the value
changes every time it's read. Brave, Firefox with
resistFingerprintingand Safari do this for some signals. - blocked: your browser refused, returned a blank result or hid the real value (such as the GPU name).
- not supported or timed out: the feature isn't available in your browser, or it took too long.
Signals with any of these badges are left out of the IDs, so a browser that randomises canvas gets a warning instead of a silently different ID on every reload. If anything is randomised or blocked, a banner at the top tells you your browser appears to resist fingerprinting.
One thing the test deliberately doesn't do is tell you that you're "1 in 300,000". That would need a database of other visitors' fingerprints, and this tool keeps none. It shows what your fingerprint is made of, not how many people share it.
Three quick experiments to try
- Open the test in a private window. Compare the fingerprint ID with the one in a normal window. In most browsers it stays the same, because private mode removes cookies, not your device's characteristics.
- Turn on a VPN and reload. Your IP address changes, but the fingerprint doesn't. Your time zone can even reveal that the VPN location isn't where you really are.
- Try another browser on the same computer. The ID changes, but notice how many signals stay identical: screen, fonts, GPU and time zone. Trackers that match fingerprints approximately can still link the two.
How to reduce your fingerprint
Hiding individual values rarely works. An unusual setting can make you more distinctive, not less. What works is a browser that either makes everyone look the same or randomises the noisy signals:
- Tor Browser makes all its users look as alike as possible: same window size, fonts, time zone and user agent.
- Brave randomises canvas, WebGL and audio output for each site and session.
- Firefox with
privacy.resistFingerprintingnormalises or blocks many signals. - Safari with Advanced Tracking and Fingerprinting Protection adds noise to canvas and audio and limits fonts to the system set.
After changing a setting, run the fingerprint test again. The badges tell you straight away whether the protection is working.
The other side: anti-detect browsers
There's a whole category of software built to do the opposite of the privacy browsers above: anti-detect browsers, which give every profile its own fake fingerprint, storage and proxy so one person can look like many different devices. They come up a lot in testing, scraping and multi-account discussions, and they come with real terms of service and ban risks. I wrote a separate explainer on my test automation blog: What Is Dolphin{anty}? Anti-Detect Browsers and Fingerprinting, Explained for Testers. It covers how sites spot spoofed fingerprints and what testers should use instead when they need isolated test users.
Frequently asked questions
What is browser fingerprinting?
Browser fingerprinting identifies a browser from the details it exposes, such as its user agent, screen, language, time zone, installed fonts and the way its GPU draws graphics, instead of storing an ID on the device the way a cookie does.
Does incognito or private mode stop fingerprinting?
Usually not. Private mode starts with no cookies, but most fingerprint signals come from the browser and device themselves, so they are normally the same in a private window.
Does a VPN change my browser fingerprint?
No. A VPN changes your IP address, not your browser. Your fonts, screen, GPU and language settings stay the same, so the fingerprint stays the same. Your time zone can even give away that the VPN location is not where you are.
Is the fingerprint from the test sent to your server?
No. The fingerprint is computed in your browser and never sent anywhere or stored. The only server-side part is the no-JavaScript ID, which is built from the headers your browser already sent to load the page.
What is the difference between the quick and detailed scan?
The quick scan runs automatically and covers canvas, WebGL, audio, 60 common fonts and basic device signals. The detailed scan runs only when you click the button and adds about 200 fonts, a WebGL rendering test, speech voices, media codecs, maths precision and locale formatting. It produces its own Detailed ID and leaves the main ID unchanged.
Why did my fingerprint ID change?
Any change to any signal changes the whole ID. A browser or OS update, a new GPU driver, a newly installed font, a different monitor or zoom level, or a changed language setting can all do it. Browsers that randomise canvas or audio are shown with a badge, and those signals are left out of the ID.
Related: System Info · What Is My User Agent · HTTP Header Checker · What Is an Internet Proxy?