# What is browser fingerprinting? > Browser fingerprinting is recognising a browser by reading its hardware, settings and rendering quirks instead of storing a cookie. How sites do it. Source: https://mosaicbrowser.com/glossary/browser-fingerprinting ## Browser fingerprinting: how sites recognise a browser without cookies Browser fingerprinting is the practice of recognising a browser by reading dozens of values it gives away, such as GPU, screen, fonts, timezone and how it draws a canvas, and combining them into an identifier. Nothing is stored on the computer, so clearing cookies or opening a private window does not change it. ![Browser fingerprinting, drawn as a mosaic of tiles](https://mosaicbrowser.com/covers/browser-fingerprinting.webp) A cookie is something a site leaves on your computer and reads back later. Browser fingerprinting leaves nothing. The script asks the browser questions any page is allowed to ask (how many CPU threads, which GPU, what screen, which timezone), runs a few small drawing and audio jobs, and hashes the answers. The result is the [browser fingerprint](https://mosaicbrowser.com/glossary/browser-fingerprint); fingerprinting is the act of collecting it. EFF's [Surveillance Self-Defense](https://ssd.eff.org/module/what-fingerprinting) guide describes the same thing: identifying a browser by the many small characteristics it reveals rather than by stored data. ## How browser fingerprinting works A fingerprinting script gathers three kinds of value. The first is values the browser simply reports. `navigator.hardwareConcurrency` gives the number of logical processors ([MDN](https://developer.mozilla.org/en-US/docs/Web/API/Navigator/hardwareConcurrency)). Others give screen size, pixel ratio, language list, timezone, the User-Agent and its client hints. Each on its own is common; thirty of them together rarely are. The second is values the browser produces. A canvas drawn with the same text and shapes comes out a few pixels different on different GPUs, drivers and font stacks, so its hash says something about the hardware ([canvas fingerprinting](https://mosaicbrowser.com/glossary/canvas-fingerprinting)). WebGL exposes the renderer string and hundreds of limits ([WebGL fingerprinting](https://mosaicbrowser.com/glossary/webgl-fingerprinting)). An offline audio graph renders a signal whose last decimals depend on the machine. The third is the connection. The way a browser opens a TLS connection, the extensions it lists and their order, identifies the client library before a page has loaded ([TLS fingerprinting](https://mosaicbrowser.com/glossary/tls-fingerprinting)). Client hints arrive as request headers ([client hints fingerprinting](https://mosaicbrowser.com/glossary/client-hints-fingerprinting)). WebRTC can hand over an address the proxy was meant to hide ([WebRTC leak](https://mosaicbrowser.com/glossary/webrtc-leak)). Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Its own Chromium](https://mosaicbrowser.com/features/engine) ## What sites use it for Fraud and bot teams use it to ask "have we seen this device before?" at sign-up and login, and to spot one machine behind many accounts. Advertisers and analytics vendors have used it to follow people where cookies are blocked. The same reading serves both, which is why privacy browsers fight it and why it decides whether two accounts look related. If two accounts on one site report the same fingerprint, the site treats them as one computer, however carefully their cookies were kept apart. Detectors also look for contradictions. A Mac renderer string under a Windows User-Agent, or a timezone 6 hours from the IP address, is a stronger signal than any single rare value, because no real machine reports it. ![A profile fingerprint in Mosaic: GPU, screen, fonts, timezone and language matched to the exit](https://mosaicbrowser.com/shots/fingerprint-detail.png) *One profile's fingerprint, drawn as one machine and matched to its exit* ## How to check what yours gives away Open our [fingerprint checker](https://mosaicbrowser.com/tools/fingerprint-checker) or EFF's [Cover Your Tracks](https://coveryourtracks.eff.org/) and read the list. Then open a private window and run it again: the values that stay put are the ones fingerprinting relies on. Ways to reduce it in an ordinary browser, and what each one costs, are in [how to stop browser fingerprinting](https://mosaicbrowser.com/guides/stop-browser-fingerprinting). ## How Mosaic handles it Mosaic does not try to make a profile invisible to fingerprinting, because a browser that answers nothing is its own signal. It gives each profile a different, coherent answer. Tesseract Chrome, our own Chromium, changes the values in C++ inside the engine, so every page, frame and worker reads the same machine; nothing is spoofed with injected JavaScript. The hardware is drawn as one real device from a catalogue of 155 desktop records, and timezone, language and location follow the proxy's measured exit. Values that would otherwise be identical across every profile and equal to your own computer, such as dark mode or the monitor count, are drawn per profile too. [The engine page](https://mosaicbrowser.com/features/engine) lists what the patches cover. ## Sources 1. [EFF Surveillance Self-Defense: What Is Fingerprinting?](https://ssd.eff.org/module/what-fingerprinting), read November 2, 2026 2. [EFF: Cover Your Tracks](https://coveryourtracks.eff.org/), read November 2, 2026 3. [MDN: Navigator.hardwareConcurrency](https://developer.mozilla.org/en-US/docs/Web/API/Navigator/hardwareConcurrency), read November 2, 2026 ## Questions ### Is browser fingerprinting legal? Its most common uses are fraud prevention and bot detection. Whether a site needs your consent to do it depends on what the reading is for and on the privacy law where you are, so there is no single answer. ### Does incognito mode stop browser fingerprinting? No. A private window starts with no cookies, but it runs on the same hardware, fonts and timezone, so the values a fingerprinting script reads are the same as in a normal window. ### Does a VPN stop browser fingerprinting? A VPN changes the IP address. Everything else a fingerprinting script reads, from the GPU to the canvas output, comes from the computer and stays the same. ### How do I see my own browser fingerprint? Open a fingerprint test page, such as our free fingerprint checker or EFF's Cover Your Tracks, and read what it collects. Run it twice, in a normal and a private window, and compare. ## Related [Browser fingerprint: what a site can read about your machine](https://mosaicbrowser.com/glossary/browser-fingerprint): A browser fingerprint is the set of values a site reads about your browser and computer, which together recognize you without cookies. What goes into one. [Canvas fingerprinting: how a drawing identifies your computer](https://mosaicbrowser.com/glossary/canvas-fingerprinting): Canvas fingerprinting draws hidden text and shapes, reads the pixels back and hashes them. Small rendering differences make the hash a mark of your machine. [WebGL fingerprinting: what your graphics card tells a page](https://mosaicbrowser.com/glossary/webgl-fingerprinting): WebGL fingerprinting reads the GPU vendor and renderer strings, dozens of driver limits and a rendered image, which together identify your GPU. [TLS fingerprinting: identifying a client by its handshake](https://mosaicbrowser.com/glossary/tls-fingerprinting): TLS fingerprinting identifies the software behind a connection from its TLS ClientHello, read before any page loads. JA3 and JA4 are the common formats. [How to stop browser fingerprinting, and what makes it worse](https://mosaicbrowser.com/guides/stop-browser-fingerprinting): You can't stop a page reading your browser. You can make what it reads useless: block the collectors, blend in with Tor or Mullvad, or split your browsing. [An anti-detect browser with its own Chromium engine](https://mosaicbrowser.com/features/engine): Mosaic is an anti-detect browser with its own Chromium engine, Tesseract Chrome: stock source plus 64 patches that change fingerprint values in C++.   ## See browser fingerprinting on a real profile Mosaic shows the values a site reads, per profile, and runs a leak test from inside the profile’s own page. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.