Guides · Your IP & privacy

Browser fingerprinting explained: how sites recognise you without cookies

Written by Aldo · blue-team threat hunter
Last updated November 9, 2026 · 4 min read

You clear your cookies, open a private window, and a site still seems to know you. Sometimes that's your login or your IP address. Sometimes it's your browser's fingerprint: the particular combination of things it says about itself.

What a page can read without asking

To show pages correctly, browsers tell sites a lot. Some of it is sent with every request; the rest any script can read. Here's a selection, from iplover's own homepage, for two fresh test browsers with default settings on 9 November 2026:

Notice that these are claims: the WebKit test build ran on a Windows PC and still reported macOS, because that's what it tells pages. Now look at the graphics row. Chrome reports the exact graphics chip, with a model code. Safari's engine says only “Apple GPU”, on purpose: it's one of the ways Safari makes its users look alike. The processor row is similar: 28 threads is unusual and narrows things down; 8 describes millions of machines.

Real fingerprinting scripts go much further than this card. They draw invisible text and shapes and measure tiny differences in how your device renders them (canvas fingerprinting), list the fonts installed, measure audio processing, and read dozens of browser features. Each detail adds a little information. Combined, they make a profile that rarely matches anyone else's exactly.

Why it's used, and why it's hard to stop

Fingerprinting has honest uses: banks and shops use it to notice that a login comes from an unfamiliar device, and to slow down fraud. It's also used to track people across sites without consent, which is why privacy regulators in the EU treat reading these details for tracking much like setting cookies: it needs consent.

It's hard to stop because, unlike a cookie, there's nothing stored on your device to delete. The fingerprint is just a description of your browser, recomputed each visit. Private windows don't change it much either: same browser, same screen, same graphics card.

The paradox: privacy settings can make you stand out

A fingerprint works by being unusual. Every setting that very few people have makes yours more distinctive: a rare browser, a dozen extensions, a custom font collection, an odd window size, a language combination few people use. Some privacy extensions are detectable themselves, and add to the profile they're meant to hide.

The approach that works is the opposite: look like everyone else, or keep changing.

What actually helps

If you want to see how unusual your browser is, the EFF's Cover Your Tracks and the research project AmIUnique compare your browser with the visitors they've seen. Treat their numbers as a rough guide: their visitors aren't a random sample of internet users.

What a fingerprint can't do

A fingerprint recognises a browser, not a name. It links visits made with the same browser on the same device; it doesn't tell a site who you are unless you also log in, buy something or give your email. It also drifts: a browser update, a new monitor or a change of settings alters it, so trackers have to keep re-matching. That's why fingerprinting is rarely used alone. It's most effective combined with what you hand over yourself.