Correction, October 7, 2026: This guide now combines two overlapping fingerprinting articles. We removed a current-looking uniqueness percentage derived from an older study sample, corrected categorical claims about cookies and private browsing, and clarified that this site’s local tool reports selected signals rather than population uniqueness.
Browser fingerprinting is a way to compare visits using characteristics exposed by a browser and device. A tracker might observe screen dimensions, language, time zone, graphics behavior, available browser features, or network-level details. The combination can be more distinguishing than any one value.
That does not make a fingerprint a permanent name tag. Values change, browsers apply defenses, and matching systems make mistakes. A useful privacy review asks three separate questions:
What can this site observe?
Which values remain stable between visits?
Does the observer have enough comparison data to connect those visits?
Cookies and fingerprints solve different tracking problems
A cookie is state saved for a site. A browser fingerprint is inferred from values a site can observe. Trackers can use either technique or combine them.
Safari blocks third-party cookies by default, and Firefox isolates cross-site cookies through Total Cookie Protection. Chrome still exposes controls that let a user allow or block third-party cookies; it did not simply make cookies disappear. Those changes make some forms of cross-site tracking harder, but they do not turn fingerprinting into the only tracking method.
Private-browsing windows mainly change storage and session behavior. They do not replace the graphics card, screen, operating system, preferred language, or every browser API. A private window may therefore remain linkable through some signals, but it is too broad to claim that its fingerprint is always identical to a normal window.
Signals that can contribute to a fingerprint
Canvas and text rendering
A script can ask the browser to draw text or shapes and inspect the result. Small differences in fonts, graphics libraries, drivers, and browser behavior may change the pixels or text measurements. A browser can respond by standardizing, blocking, or modifying the returned value.
WebGL and graphics capabilities
WebGL exposes capabilities needed to render graphics. Renderer information, supported extensions, precision, and output from a test scene can add useful signals. Modern browsers may reduce or alter some of this information, so an observed value is evidence about the current browser context rather than proof of a particular physical device.
Audio processing
The Web Audio API performs calculations that may vary by browser and platform. Scripts can process a generated signal and compare the numerical result. This does not require microphone access because the browser can generate and process the signal internally.
Fonts, layout, and locale
Sites need to lay out text and adapt content to language and region. Font metrics, language lists, time zone, and formatting behavior can therefore contribute to a fingerprint. Browser defenses must balance reducing variation with keeping sites readable and useful.
HTTP and connection behavior
A server also sees information outside JavaScript: request headers, the public IP address, and properties of the network connection. These signals can complement browser observations. A VPN changes the public route and address seen by the destination, but it does not automatically change canvas, WebGL, font, or screen signals.
“Unique” always means unique within a comparison set
EFF’s 2010 Panopticlick study showed that combinations of browser attributes could be highly distinguishing in the browsers that reached that study. It did not establish a permanent percentage for every browser on today’s internet.
A uniqueness result depends on who is in the dataset, which attributes are collected, when they are collected, and how the matcher treats changes. A local page that lacks a population dataset can show values but cannot honestly say that one visitor is unique among all users.
The same limit applies to before-and-after testing. If a value changes after a setting change, that confirms the setting affected that value. It does not prove that the complete fingerprint became more common or that a tracker can no longer reconnect the visits.
How browser defenses differ
Reduce exposure to known trackers
Content blocking can prevent many third-party scripts from loading. That reduces the number of parties receiving signals. It does not alter every signal for scripts that still run, and a first-party site can perform its own measurement.
Make users look more alike
Tor Browser limits variation through measures such as letterboxing, user-agent normalization, and font restrictions. The Tor Project explicitly documents that perfect uniformity is not possible: operating-system, language, and behavioral differences can remain.
This approach also depends on the crowd. Customizing a browser that is designed to share defaults with other users can create a rarer configuration. Tor Browser warns against adding extensions for that reason.
Randomize selected outputs
Brave documents a different strategy for some APIs: return values that are stable enough for a site to function but vary in ways intended to frustrate linking. A randomized value is not a promise of anonymity. Other signals may remain stable, and sites may react to the modification.
Firefox includes protections against known and suspected fingerprinters. Mozilla also documents a stronger fingerprint-protection mode and the possibility of site breakage. A more restrictive setting can be useful for a higher-risk browsing session, but compatibility is part of the decision.
A practical review workflow
Start with the browser’s built-in tracking protection. Review its standard and strict modes before adding extensions.
Remove extensions you do not need. Each extension adds code and permissions; uncommon combinations can also make a setup more distinctive.
Separate activities when the consequence matters. A dedicated browser profile or Tor Browser session can reduce accidental account and storage links.
Treat a VPN as a network tool. Use it when changing who can observe the connection or destination-facing IP fits the threat model.
Test for understanding, not a score. Use the Browser Fingerprint tool to inspect selected local signals, then read the browser vendor’s documentation before changing advanced settings.
No browser setting makes every visit unlinkable. The useful goal is narrower: reduce unnecessary exposure, avoid claims a test cannot support, and choose a browser mode that fits the activity and the breakage you can tolerate.