Blog / IP & privacy

What Is Browser Fingerprinting? Signals Sites Read and How to Check

2026-10-21cdnping editors8 min read

A browser fingerprint is a set of device and software traits that a web page reads without telling you: OS and browser version, screen size, time zone and language, installed fonts, GPU rendering output, and so on. Each trait looks ordinary on its own, but combined they can be unique enough for a site to recognize the same device after you clear cookies or switch to a private window. To see what you expose, open cdnping's IP and environment check. It computes each fingerprint signal locally, and you can follow along with the sections below.

#How is a browser fingerprint different from a cookie?

A cookie is an identifier a site writes into your browser, and the browser sends it back on the next visit. It lives on your machine, so you can see it, delete it, and block it.

A fingerprint writes nothing. The site reads your browser's traits on the spot and computes a hash. The differences:

So a fingerprint is not always "tracking". Banks and login systems also use one to decide whether a sign-in comes from an unfamiliar device. The problem is that the same technique can link your visits across different sites without your consent.

#What can a site read? Five categories

Uniqueness here means how finely a signal splits the population. A low-uniqueness signal is meaningless alone, but identifiability rises sharply when several are stacked.

#Category 1: UA and operating system

• How it is read: the User-Agent and Accept-Language HTTP request headers; navigator.userAgent and navigator.platform in JavaScript; and, in Chromium-based browsers, navigator.userAgentData (Client Hints).
• Uniqueness: medium. Mainstream browser plus mainstream OS covers a lot of people, but niche versions or rare OS combinations stand out immediately.
• Can you change it? The UA string can be changed, but sites can still infer the OS and engine from other traits. The "engine version inference" check in cdnping /ip uses 23 browser features to infer the actual engine version and compares it with what the UA claims. If you change the UA but not the other traits, you create an inconsistency.

#Category 2: Screen and hardware

• How it is read: screen.width/height, devicePixelRatio, color depth; navigator.hardwareConcurrency (logical CPU cores); navigator.deviceMemory (a memory tier) in some browsers; and the touch point count maxTouchPoints.
• Uniqueness: medium to high. Resolution plus scaling ratio plus core count separates common laptops, external monitors, and high-end desktops fairly well.
• Can you change it? Not the hardware itself. Browser window size can differ every time, so some privacy setups round the window size to reduce the information in this signal.

#Category 3: Time zone, language, and fonts

• How it is read: Intl.DateTimeFormat().resolvedOptions().timeZone and new Date().getTimezoneOffset(); navigator.language and navigator.languages; fonts are probed by measuring the rendered width of a text string under different fonts, or checked with document.fonts.
• Uniqueness: fonts are the highest. People who have installed design software, office suites, or developer tools often have very different font lists. Time zone and language have low uniqueness within the same region.
• Can you change it? Language and time zone can be changed in system settings, and fonts can be uninstalled. This category is most closely tied to your IP: when the time zone and language do not match the region of your exit IP, sites notice. For what exactly gets exposed, see Browser fingerprint and environment check: what a time zone, language, font, and IP mismatch each reveal.

#Category 4: Canvas, WebGL, and audio rendering

This is the highest-uniqueness category and the hardest for ordinary users to notice.

• Canvas: a page draws text and shapes on an invisible canvas, then reads the pixels with toDataURL(). Different GPUs, drivers, system font rendering, and anti-aliasing settings produce subtle differences.
• WebGL: the WEBGL_debug_renderer_info extension exposes the GPU vendor and model string. Rendering a 3D scene and hashing the result adds differences that come from the GPU and driver.
• Audio: OfflineAudioContext generates and processes a signal, and the floating-point output varies slightly with the audio stack implementation.
• Uniqueness: high.
• Can you change it? Users can hardly change it short of swapping hardware or drivers. The workable approaches are to have the browser return a uniform result, or to add random noise each time; both are covered below.

#Category 5: Automation traces

• How it is read: whether navigator.webdriver is true; whether headless-browser-specific properties exist or certain plugins are missing; whether the window size and screen size relate abnormally; and the rhythm of mouse and keyboard events.
• Uniqueness: this signal is not for telling individuals apart, but for telling "human or script".
• Can you change it? Ordinary users usually do not trigger it. If you have done testing with Selenium or Playwright, leftover configuration on your machine can sometimes leave traces in your everyday browser too. You can confirm with /ip.

#Self-check with cdnping /ip: steps you can follow

The fingerprint check on /ip runs locally in your browser and uploads nothing; when you generate a result image, you can choose to hide your IP. Go through it in this order:

1. Open /ip in the browser you use most, not in private mode, so you see your everyday state. Wait for all checks to finish.
2. Look at the region and type of your exit IP, and note the country and time zone it maps to. For the difference between datacenter and residential IPs, see Datacenter IP vs residential IP: what's the difference.
3. Compare the "time zone, language, fonts" results: do the browser time zone, system language, and IP location agree? A mismatch is not necessarily a problem (a business trip, a corporate network), but you should know it exists.
4. Check the "hardware fingerprint": do core count, screen, and GPU string match your real device? A GPU string shown as a generic name usually means the browser is normalizing it.
5. Check "engine version inference": does the inferred engine version agree with the UA? A mismatch most often comes from a UA-modifying extension.
6. Check "automation traces": for an everyday browser, all should be negative.
7. While you are there, check WebRTC and DNS leaks. They are not fingerprints, but they also expose your real network information. For the mechanics, see DNS leak and WebRTC leak; for how to turn WebRTC leaks off in each browser, see How to fix a WebRTC leak.
8. Test again in another browser or a private window and compare which items changed and which did not. The ones that did not change are what clearing cookies cannot remove.

To learn how to read each result on the /ip page, see Browser environment check explained: all 13 checks. The calculation methods for each item are public in Methodology.

#How do you interpret the results?

#How can you reduce identifiability?

The goal here is privacy: reducing the chance of cross-site tracking. It is not about impersonating someone else, or bypassing a site's risk control or region restrictions. You still need to follow each platform's risk-control rules and terms of service.

#Principle: looking "ordinary" beats looking "random"

Fingerprinting works on rarity. A browser with a dozen niche extensions, a modified UA, and a pile of custom fonts is easier to recognize than one with default settings. So the first step is usually subtraction:

• Uninstall extensions you do not use, especially ones that modify pages or request headers;
• Keep the browser updated to the current stable release, since an old version is itself a minority;
• For high-privacy browsing, use a separate clean browser profile without extra fonts or extensions.

#Built-in fingerprint protection

• Firefox: in about:config, set privacy.resistFingerprinting to true. Once enabled, the time zone is reported as UTC, window size is rounded, Canvas reads may trigger a permission prompt, and some APIs return uniform values. For everyday use, you can start by turning on only the Strict mode of Enhanced Tracking Protection.
• Tor Browser: by default it makes all users present a fingerprint as identical as possible. It suits high-privacy needs, at the cost of speed and compatibility.
• Other browsers: some offer Canvas or WebGL result randomization, or restrict fingerprinting APIs in private windows. Check each browser's official documentation.

#The costs

With fingerprint protection on, you may see: times on web pages computed in UTC, wrong time zones in maps or calendars, failures in Canvas-based online tools and some CAPTCHAs, and extra verification at login. If a site stops working, allow it for that site only instead of turning protection off globally.

#Which identifies you more easily, fingerprint or IP?

They complement each other. The IP tells a site which network you come from; the fingerprint tells it what device you use. Many sites look at both, plus latency characteristics, to decide whether you are going through a relay; for the mechanics, see How sites use latency to tell you are on a proxy. Handle only one and the other is still visible.

If you want to check exit IP, DNS, WebRTC, fingerprint, and API connectivity all at once, work through the Developer network self-check checklist (2026 edition).