What a browser fingerprint is actually made of

One in nine thousand on the Tuesday. One in four hundred thousand on the Thursday. Same laptop, same profile, nothing touched in between except an automatic browser update that installed itself overnight.

One field moved. The browser shipped a change to how it draws text, my machine started producing a rendering result that hardly anyone else had yet, and a profile that had been sitting comfortably in a crowd turned into one of the more distinctive things online for about a fortnight, until everybody else updated too.

I run mobile proxy lines on real carrier SIMs and a rack of Android phones that people rent by the month, so a chunk of every week goes on working out why one session gets waved through and a near identical one hits a verification wall. This is a defensive breakdown of what is inside a fingerprint and roughly what each piece is worth. No tools, no vendors, no recipe for beating anybody.

Think in bits

A fingerprint is a pile of values a page can read about your browser and your machine. What makes one value matter more than another is how many other people share it, and the unit for that is entropy.

A value shared by half the internet halves the candidate pool. One bit. Almost worthless on its own.

A value held by one person in fifty thousand leaves roughly a hundred thousand people worldwide who share it, out of five billion or so online. That is about fifteen and a half bits, and it came out of a single field.

Bits add up. Thirty three of them picks one individual out of eight billion. Which means nothing in the parts list has to be individually damning for the combination to be an identifier, and that is the sentence worth remembering.

The four that do the heavy lifting

The exact set of fonts installed on a machine is the sharpest single item I have watched in practice, and it is the one almost nobody thinks about. A font list is a history of the box: every design tool that was ever trialled, every office suite, every language pack, every installer that quietly shipped a typeface alongside itself. A fresh operating system install has a boring standard list. Six months of real use and it drifts somewhere personal, in a direction nobody chose on purpose.

The alphabet is huge. A stock Windows install carries north of two hundred font families; add a design suite and you are past three hundred. The number of possible subsets is astronomical, and a scoring system only needs to notice that yours matches nobody else’s. Reading it is cheap too: a page renders a string in a named font, measures the box, then compares against the fallback.

Second is how your graphics hardware draws. A page asks the browser to render a small test image and reads the pixels back. To your eye the picture is identical on every machine, but the exact rounding in the shading, the way edges get smoothed and the driver version doing the work all nudge the numbers around. Same machine, same image, same answer every time. That stability is what makes it valuable. The same rendering path will also name the graphics vendor and the chip model if a page asks politely.

Third is audio. Generate a tone, push it through the browser’s audio processing, read the numbers at the far end. The arithmetic is supposed to be identical everywhere; in practice it runs on different processors through different libraries and the last few decimals disagree. It narrows you down less than graphics does. Its real job is corroboration, because a machine telling one hardware story on graphics and a different one on audio has a problem neither field shows alone.

Fourth is screen, and people write it off because resolution alone is dull. Plenty of us run nineteen twenty by ten eighty. The combination is what bites: width and height, the usable height left once the taskbar and window furniture come out, colour depth, and the pixel ratio the display is scaled at. Windows scaling at 125% is ordinary on a laptop. 150%, on a particular resolution, with a particular usable height, is a far smaller club than any of those numbers separately.

The middle band exists for cross checks

Below those four sits a group that carries real information without being decisive: language and timezone, the platform family the browser admits to, the number of hardware threads it reports, and the memory class, a rounded bucket rather than your actual RAM.

Hardware threads is two or three bits at best. Browsers report four, eight, twelve, sixteen, and consumer machines cluster hard on that handful. Memory class is blunter still, deliberately rounded to a tiny set of values.

These fields earn their keep by contradicting each other. Sixteen threads paired with a memory class of two gigabytes is a combination that barely exists in the wild, and nobody scoring you has to work out which half is lying to conclude something is wrong.

The user agent is worth two or three bits

It gets more airtime than everything above put together and deserves the least of it.

Years ago the user agent string was a genuine leak. A full operating system version, a browser build number down to the patch, sometimes the device model, sometimes a list of what was installed. Browser vendors have spent a long time sanding that down. Version numbers frozen or rounded off, the operating system version flattened to something generic, the fine detail parked behind a separate request that most sites never bother making.

What is left describes an enormous share of everyone online: a recent version of a major browser on a major operating system. If a session’s user agent is the only thing that changed between two visits, whoever is scoring you almost certainly did not care. If the font list changed, they cared.

A rare value is worse than a common one

This is the trap on the other side of the arithmetic, and it took me an embarrassingly long time to internalise.

Share a graphics signature with two million other machines and you are standing in a herd. Share it with nobody at all and you are a lighthouse, and you are the same lighthouse tomorrow morning. The instinct on first learning about fingerprinting is to make everything unusual, which is precisely backwards. Blending is dull values, held by a lot of people, that agree with each other.

What arrives before the page does

Everything so far is read by a script inside the page. Underneath that is a layer the page never has to touch, and it lands before a single line of JavaScript executes.

One part is the shape of the encrypted handshake: your browser puts up a list of ciphers in a specific order with a specific set of extensions in their own order, and that pattern is a signature of a browser build and the library beneath it. The other part is ordering, meaning which requests fire after a page loads and in what sequence, how headers get arranged, how a redirect gets handled. Those habits stay consistent per browser family.

Neither is high entropy on its own. There are only so many browser builds. What they are is hard to argue with, because they sit below the level where a page can easily be told a different story.

Which sets up the most common contradiction I see. The network says the connection comes out of Frankfurt; the browser says the clock is Singapore and the language is English as spoken in the United States. Nothing in that pair is exotic, and every field involved is worth a couple of bits. The disagreement is what costs you. A real person in Frankfurt overwhelmingly has a clock set to Frankfurt, and catching that needs no clever maths at all.

Where my ranking was wrong

For about a year I kept a spreadsheet ranking these fields by entropy, treated my ranking as a fact about the world, and allocated my attention by it.

A ranking only holds inside one population. Change the crowd and it reshuffles. A font list is enormously informative across a random sample of consumer machines; inside a company where every laptop was imaged from the same file it is worth close to zero, because everyone has the identical list and it separates nobody. It runs the other way too. In a population that is almost entirely phones, a desktop screen combination is loud all by itself, and that would have sat near the bottom of my sheet.

So a number I copied off a paper about European web users told me very little about the crowd any given platform actually compares people against. I stopped ranking in the abstract after that. The question now is who else is standing in this bucket with me.

It drifts, so it is upkeep

Fingerprints move on their own. A browser update changes how the test image renders and the graphics signature shifts overnight across every profile at once. A system update rewrites part of the audio stack. One application install brings four fonts with it. A different monitor changes the screen numbers. Daylight saving rolls over and the timezone offset moves by an hour, on a schedule that has to match wherever you claim to be.

A fingerprint that was coherent in January is not automatically coherent in July, and the failure is silent. Nothing warns you when a value that used to sit inside a crowd of millions has quietly gone rare. That is the honest limit here: this is maintenance, and anybody promising permanence is selling you the calendar.

I re check drift on my own profiles roughly monthly. Twenty minutes, deeply boring, and it has caught two silent breakages I would otherwise have found the expensive way. The full written tests and the picks I actually trust live here.

Get new guides and videos first — join the Telegram channel.