What Websites Know About You: Browser Fingerprinting Explained

If you think going incognito makes you anonymous, this will change your mind. The moment a page loads, your browser hands it a long list of details: your exact screen resolution, the fonts installed on your system, the graphics card rendering the page, how many CPU cores you have, whether your battery is charging, and even the time zone your laptop is set to. None of these are 'personal information' on their own. Combined, they form a fingerprint so specific that most users are one in several million.

This is browser fingerprinting, and it is the reason an ad for something you only talked about near your phone can follow you across websites you have never visited. Unlike cookies, a fingerprint cannot be deleted — it is computed from your hardware, not stored on it.

The cleverest signal is the canvas fingerprint. Your browser is asked to draw hidden text and shapes on an invisible canvas element; tiny differences in GPU, font rendering and anti-aliasing make the resulting image mathematically unique per device. The page hashes those pixels and — congratulations — that hash is you. Similar tricks read your audio stack's rounding behavior and the exact set of sensors your phone exposes.

Studies consistently find that a large share of desktop browsers are uniquely identifiable, and mobile browsers are not far behind. Blocking cookies does nothing here because no data is being stored — the website is doing math on signals your browser volunteers.

The fastest way to understand fingerprinting is to see your own. A proper fingerprint scan shows you every signal a website can read: the canvas hash, GPU renderer string, battery status, installed fonts, WebRTC leaks and more — and rates how unique your setup is. It is the same technology trackers use, pointed at you for defensive purposes.

You cannot make your fingerprint perfectly generic — few people can. But knowing what you expose changes behavior: which browser you use for sensitive tasks, which extensions actually help, and why 'private browsing' is not the privacy win people assume.

Practical defenses exist, and none require paranoia. A mainstream browser with a fingerprint-randomizing extension shatters the stable canvas and audio hashes. Keeping your system fonts standard makes you blend into a bigger crowd. Disabling WebRTC prevents IP leaks behind a VPN. And using tools that process data locally — instead of signing into yet another web service — removes the account graph that makes fingerprints so valuable in the first place.

Privacy is not about being invisible; it is about being expensive to track. Every signal you blur raises the cost, and for most people that is enough.