What Is Browser Fingerprinting? The Tracking That Survives VPNs and Incognito Mode

You deleted your cookies. You opened a private window. You connected through a VPN. You even tried a different browser.

And the website still recognised you.

Browser fingerprinting is a tracking technique that doesn't rely on cookies, your IP address, or any data stored on your device. Instead, it builds an identifier from the technical characteristics of your browser and hardware — signals that are nearly impossible to change without fundamentally altering how your browser works.

Understanding it requires separating two questions: *what does it collect*, and *why does it survive the privacy measures most people use*. Those answers are different, and conflating them leads to both over-reaction (thinking you're constantly being comprehensively identified) and under-reaction (thinking a VPN is enough).

You can see your own browser's fingerprint — canvas hash, WebGL renderer, timezone, screen, fonts, and more — using the live tool at myipco.com/browser-fingerprint. Checking it takes about 10 seconds and makes the rest of this guide concrete.

Browser fingerprinting is the practice of collecting a set of attributes from a visitor's browser and device, combining them into a composite identifier, and using that identifier to recognise the same visitor across sessions — without storing anything on their device.

The technique was first formally documented by the EFF's Peter Eckersley in 2010 (the Panopticlick study), which showed that 84% of browsers had a fingerprint unique enough to identify them in a dataset of nearly a million visitors.

The core insight: no single attribute is identifying on its own. Your timezone is shared by hundreds of millions of people. Your screen resolution is shared by tens of millions. Your browser version is shared by millions. But the intersection of timezone + screen resolution + browser version + installed fonts + canvas hash + WebGL renderer + audio context fingerprint narrows the field dramatically — often to fewer than a handful of users worldwide sharing the same combination.

This is what makes fingerprinting fundamentally different from cookie tracking: - No storage required — nothing written to or read from your device - Passive — the page you visit assembles the fingerprint from data the browser provides automatically - Persistent across sessions — the attributes are properties of your hardware and browser, not session state - Survives clearing — because there's nothing to clear

A comprehensive fingerprint draws from multiple categories of browser-exposed data:

Canvas fingerprint The most distinctive single signal. JavaScript draws an invisible image using the Canvas API and reads back the pixel data. Differences in GPU, graphics drivers, OS font rendering, and anti-aliasing settings cause subtly different pixel outputs — the same drawing instruction produces different results on different machines. The resulting hash is stable across browser restarts and often across browsers on the same machine.

WebGL fingerprint Similar principle, using the WebGL API. Also exposes the GPU vendor and renderer string directly — often identifying the exact GPU model (e.g., "ANGLE (Intel, Intel(R) Iris(R) Xe Graphics Direct3D11 vs_5_0 ps_5_0, D3D11)").

Fonts Browsers can detect which fonts are installed on a system through JavaScript timing measurements or Canvas rendering. The set of installed fonts reflects the operating system, language packs, and installed applications — and is surprisingly distinctive.

Timezone and language Your timezone and accept-language settings narrow geographic and demographic origin significantly. Combined with other signals they are disproportionately identifying.

Screen and display Screen resolution, color depth, pixel ratio, and available window dimensions. Unusual resolutions (ultrawide monitors, HiDPI displays) are particularly identifying.

Hardware signals CPU thread count (`navigator.hardwareConcurrency`), device memory estimate (`navigator.deviceMemory`), touch point count, and presence of touch/pointer support — these reflect specific device configurations.

Audio context fingerprint The Web Audio API processes a mathematically defined audio signal; floating-point rounding differences in audio hardware and drivers produce slightly different outputs across machines.

Browser configuration Plugins list (largely deprecated), cookies enabled, Do Not Track setting, ad blocker presence (detectable by checking if certain known ad-network URLs load), and various browser feature flags.

You can see the exact values your browser is exposing right now at myipco.com/browser-fingerprint.

IP tracking and browser fingerprinting are often conflated, but they operate on completely different layers and have different failure modes.

The key practical difference: a VPN changes your IP but leaves your fingerprint completely intact. Your canvas hash is determined by your GPU and graphics stack, not your network. Your timezone doesn't change because you connected to a Dutch VPN server.

This is why fingerprinting is used as a *complement* to IP tracking, not a replacement. When a site wants to recognise a returning visitor who might be behind a VPN, in a different location, or using a different device, fingerprinting fills in what IP tracking cannot reach.

For context on what IP tracking alone reveals — without fingerprinting — see what can someone do with your IP address.

This deserves a direct answer because it's the most common misconception.

Why VPNs don't help: A VPN operates at the network layer. It changes your IP address and encrypts your traffic. It has no effect whatsoever on what JavaScript can read from your browser — your canvas hash, WebGL renderer, screen size, installed fonts, and hardware signals are all determined by your local machine, not your network path. From the fingerprinting script's perspective, connecting through a VPN is invisible.

Why incognito mode doesn't help: Incognito mode prevents your browser from saving history, cookies, and form data to disk after the session ends. It does not change any of the hardware or software signals that fingerprinting reads. Your canvas hash in incognito is identical to your canvas hash in normal mode, because it's a property of your GPU — not a stored value.

Why clearing cookies doesn't help: Fingerprinting doesn't use cookies. There's nothing to clear. The signals are regenerated fresh from your hardware and browser configuration on every page load.

Why even blocking JavaScript partially helps — but introduces its own problem: Disabling JavaScript entirely prevents most fingerprinting. But it also breaks the majority of the modern web. Partial blocking (NoScript, uMatrix) helps selectively, but introduces the fingerprint stability paradox covered in the next section.

This is the counterintuitive finding that most privacy guides miss.

Imagine 10,000 people visit a website. Most of them have JavaScript enabled, default browser settings, and standard hardware. Their fingerprints cluster — many share the same canvas hash, the same font set, the same screen resolution. They're harder to individually identify because they blend into groups.

Now imagine a subset of those visitors has disabled canvas fingerprinting via a browser extension. From the fingerprinting script's perspective, their canvas hash returns a null or blocked value. That blocked value is itself a signal — and a distinctive one. If only 2% of visitors have canvas fingerprinting blocked, those visitors are actually *more* identifiable as a group (and within that group, other signals narrow them further).

The EFF's Cover Your Tracks tool (formerly Panopticlick) demonstrates this: many users who think they're protecting themselves with fingerprinting blockers end up with *higher* uniqueness scores than users with default settings, because the combination of blocking + their other attributes is rare.

The only defence that actually works is making your fingerprint *identical to a large group*, not just different. This is what Tor Browser does: it normalises screen size, disables canvas, WebGL, and audio fingerprinting, and forces all users to appear identical. The cost is significant usability friction — many sites break, and the matching-everyone approach requires genuine commitment.

For most users: knowing your fingerprint exists and understanding what it reveals is more actionable than attempting to block it imperfectly.

Yes — with some important caveats about scale and intent.

High-confidence re-identification is realistic for large commercial sites (ad networks, analytics platforms, e-commerce). These operators have millions of fingerprint samples, sophisticated matching algorithms, and financial incentives to invest in accuracy. For them, fingerprinting is one signal in a broader probabilistic model — combined with IP, behavioural patterns, and any available account data.

Small sites running basic analytics typically don't implement fingerprinting at all — it requires custom JavaScript, server-side storage, and matching logic. Most use third-party analytics (Google Analytics, Plausible) which do varying amounts of fingerprinting at the network level.

Partial fingerprints are often enough. Sites don't need a perfect unique match to re-identify you. Matching on canvas hash + WebGL renderer + timezone + screen resolution across two sessions is sufficient to conclude with high confidence that it's the same visitor — even if those four signals don't uniquely identify you among all internet users. In the context of a single site's returning visitor pool, the combination is usually far more than sufficient.

Cross-site fingerprinting (recognising you on site B based on a fingerprint collected on site A) is harder, requires coordination between sites or a shared third-party script, and is where legal protections (GDPR, CCPA) apply most directly.

Ranked from most to least practical:

1. Use Firefox with privacy.resistFingerprinting enabled Firefox's built-in `privacy.resistFingerprinting` setting (set `true` in `about:config`) spoofs canvas, audio, WebGL, screen size, timezone, and several other signals. It makes Firefox look like a generic Firefox on a generic machine — significantly reducing fingerprint uniqueness without breaking the web as severely as Tor Browser does.

2. Use Brave Browser Brave randomises canvas, WebGL, and audio fingerprints per session and per domain — each site sees a slightly different value, breaking cross-session and cross-site tracking. The randomisation approach is an interesting middle ground: you're not blocking (which signals blocking), you're providing different false data each time.

3. Use Tor Browser The strongest protection — normalises all fingerprinting surfaces to make every Tor user appear identical. Significant usability cost: many sites break or present CAPTCHAs, and streaming/video is impractical.

4. Limit installed fonts and plugins Reduce the fonts installed on your system, don't install unnecessary browser extensions (each extension changes your fingerprint slightly), and use a browser profile with minimal customisation.

5. Check your current exposure Before deciding what to change, see what you're actually exposing. The myipco.com browser fingerprint checker shows your canvas hash, WebGL renderer, screen signals, hardware concurrency, timezone, and more — with plain-English descriptions of what each reveals.

For a broader overview of privacy techniques including IP masking — which, as covered above, addresses a different layer — see how to hide your IP address.