Browser fingerprinting: how sites recognise a browser without cookies

A cookie is something a site leaves on your computer and reads back later. Browser fingerprinting leaves nothing. The script asks the browser questions any page is allowed to ask (how many CPU threads, which GPU, what screen, which timezone), runs a few small drawing and audio jobs, and hashes the answers. The result is the browser fingerprint; fingerprinting is the act of collecting it. EFF's Surveillance Self-Defense guide describes the same thing: identifying a browser by the many small characteristics it reveals rather than by stored data.

How browser fingerprinting works

A fingerprinting script gathers three kinds of value.

The first is values the browser simply reports. navigator.hardwareConcurrency gives the number of logical processors (MDN). Others give screen size, pixel ratio, language list, timezone, the User-Agent and its client hints. Each on its own is common; thirty of them together rarely are.

The second is values the browser produces. A canvas drawn with the same text and shapes comes out a few pixels different on different GPUs, drivers and font stacks, so its hash says something about the hardware (canvas fingerprinting). WebGL exposes the renderer string and hundreds of limits (WebGL fingerprinting). An offline audio graph renders a signal whose last decimals depend on the machine.

The third is the connection. The way a browser opens a TLS connection, the extensions it lists and their order, identifies the client library before a page has loaded (TLS fingerprinting). Client hints arrive as request headers (client hints fingerprinting). WebRTC can hand over an address the proxy was meant to hide (WebRTC leak).

How it works: Its own Chromium

What sites use it for

Fraud and bot teams use it to ask "have we seen this device before?" at sign-up and login, and to spot one machine behind many accounts. Advertisers and analytics vendors have used it to follow people where cookies are blocked. The same reading serves both, which is why privacy browsers fight it and why it decides whether two accounts look related. If two accounts on one site report the same fingerprint, the site treats them as one computer, however carefully their cookies were kept apart.

Detectors also look for contradictions. A Mac renderer string under a Windows User-Agent, or a timezone 6 hours from the IP address, is a stronger signal than any single rare value, because no real machine reports it.

How to check what yours gives away

Open our fingerprint checker or EFF's Cover Your Tracks and read the list. Then open a private window and run it again: the values that stay put are the ones fingerprinting relies on. Ways to reduce it in an ordinary browser, and what each one costs, are in how to stop browser fingerprinting.

How Mosaic handles it

Mosaic does not try to make a profile invisible to fingerprinting, because a browser that answers nothing is its own signal. It gives each profile a different, coherent answer. Tesseract Chrome, our own Chromium, changes the values in C++ inside the engine, so every page, frame and worker reads the same machine; nothing is spoofed with injected JavaScript. The hardware is drawn as one real device from a catalogue of 155 desktop records, and timezone, language and location follow the proxy's measured exit. Values that would otherwise be identical across every profile and equal to your own computer, such as dark mode or the monitor count, are drawn per profile too. The engine page lists what the patches cover.