# What is browser fingerprinting? Source: https://kavralab.com/glossary/browser-fingerprinting/ **Browser fingerprinting** is a technique that recognizes a web browser from the information it shares with every page it loads: its version, operating system, screen, language, timezone, fonts and how it renders content. Combined, these values are often distinctive enough to tell one browser from millions of others without storing a cookie. ## How browser fingerprinting works Every time a browser requests a page, it sends headers such as its user agent and preferred language. Once the page loads, JavaScript can read many more values: screen resolution, color depth, number of CPU cores, supported media formats, installed fonts and whether certain features exist. A script can also ask the browser to draw hidden text or shapes and measure the exact output. Those values are combined into a fingerprint. On their own, most values are shared by many people. Together, they narrow the crowd down sharply. Researchers at the Electronic Frontier Foundation showed this with their Panopticlick project, later renamed Cover Your Tracks, which lets anyone test how unique their own browser looks. ## What a browser fingerprint typically includes | Signal | Example | How stable it is | |---|---|---| | User agent and client hints | Chrome on Windows | Changes with every browser update | | Screen | Resolution, pixel ratio, color depth | Stable unless the monitor changes | | Locale | Language list, timezone | Stable, but easy to fake | | Fonts | Which fonts are installed | Fairly stable per machine | | Rendering | Canvas, 3D graphics and audio output | Stable per hardware and driver | | Features | Supported codecs, APIs, storage limits | Changes with browser version | ## Browser fingerprinting vs cookies **Cookies** - An ID stored on the device by the site - Deleted by clearing browser data or private mode - Blocked or limited for third parties by most browsers - Exact: the same cookie means the same browser **Browser fingerprint** - Computed from traits, nothing stored - Survives clearing cookies and private mode - Weakened by browser privacy features and spoofing - Probabilistic: similar traits suggest the same browser ## Why it matters in fraud prevention For a fraud team, a browser fingerprint answers a simple question: have we seen this browser before, and with which accounts? A fraudster who clears cookies between signups still shows the same fingerprint. That is why fraud tools target it directly. [Antidetect browsers](https://kavralab.com/glossary/antidetect-browser/) give each profile invented values, [headless browsers](https://kavralab.com/glossary/headless-browser/) used by bots try to mimic a normal desktop, and some tools randomize values on every load. A browser fingerprint is also narrower than a [device fingerprint](https://kavralab.com/glossary/device-fingerprinting/): switch from Chrome to Firefox on the same laptop and most browser values change. For linking accounts, both views are useful. On the defense side, the most useful question is not "is this fingerprint unique?" but "is this fingerprint honest?" A real Safari on an iPhone exposes a predictable set of features, fonts and rendering quirks. When a visitor claims to be that iPhone but supports features only desktop Chrome has, or reports a screen size no iPhone ships with, the mismatch says more than any single value. Consistency checks like these also help with [bots](https://kavralab.com/glossary/bot/) that copy a real user agent string but run in a server environment. ## How to make browser fingerprinting hold up The fix is to stop trusting what the browser says about itself. Check whether the claimed browser version really supports the features it reports, whether its rendering matches the claimed hardware, and whether its network fits its stated location. Kavra runs these checks across layers on every visit and flags spoofed or rotating fingerprints. Learn how in [fingerprint spoofing and rotation](https://kavralab.com/detect/fingerprint-spoofing/). Good fingerprinting also respects the people it describes. Collect only what is needed to recognize devices and spot tools, honor consent choices, and never use the fingerprint itself as the identifier stored in your systems. A random, opaque visitor ID tied to the evidence is safer and easier to erase on request. ## FAQ ### How can I see my own browser fingerprint? Public test sites such as the EFF's Cover Your Tracks or AmIUnique show which values your browser exposes and how rare the combination is. They are a good way to understand the technique. Keep in mind that fraud detection systems usually collect different signals and compare them across layers, so your result there will not match what any one website sees. ### Do privacy browsers block browser fingerprinting? They reduce it. Some browsers limit which values pages can read, return the same values for many users, or add small random noise. That makes tracking across sites harder. Fraud detection is a different use: it looks for contradictions and known tool behavior, and privacy features used by real people should never be treated as fraud on their own. ### Can two people have the same browser fingerprint? Yes. Popular phones with default settings, or company laptops with identical setups, can produce matching fingerprints. That is why a fingerprint should never be used as proof of identity by itself. Pair it with network, behavior and account history before deciding that two sessions belong to the same person. --- Kavra Lab: bot and fraud detection that explains every decision. Book a demo: https://kavralab.com/contact/