Last updated: 29 September 2026 · 9 min read

What a fingerprint is

Your browser answers questions that websites are allowed to ask: what you are running, what your screen is, what time zone you are in, what fonts you have, how your graphics hardware draws a line of text. None of those answers identifies you on its own. Combined, they can form a signature stable enough to recognise you again without storing anything on your device.

That is the difference from a cookie. A cookie is something a site gives you and can be deleted. A fingerprint is assembled from what your browser volunteers, so clearing your data does not change it.

What we measured

On 29 September 2026 we loaded our own browser privacy analyser in six engines and configurations and recorded each attribute it reads, plus a canvas and WebGL hash of our own. Everything ran on the same Mac, so anything that depends on the machine rather than the browser should be constant — which makes the attributes that still differ the interesting ones.

The results

Canvas hash is a 32-bit hash of the rendered PNG of a fixed string. WebGL extensions hash is a hash of the supported-extension list. Fonts were probed by measuring text width against a monospace baseline for eight common families.

What differed, and what did not

Fourteen of twenty attributes varied: user agent, vendor, languages, timezone, locale, screen size, hardwareConcurrency, deviceMemory, doNotTrack, plugin count, canvas hash, WebGL vendor, WebGL renderer and the WebGL extension list.

Six were identical everywhere: platform, colour depth, touch support, cookies enabled, Service Worker availability and the number of fonts detected. Most of those are identical because every run was on the same Mac — they describe the machine, not the browser. On a mixed population they would vary considerably.

The most discriminating value was the canvas hash: five distinct results from six configurations. Same machine, same GPU, same text. Chromium and Chrome — the same engine, different builds — produced different hashes, so a build number alone is enough to change it. The only pair that matched was Chromium against itself with the timezone and locale overridden, which is the point of the next section: changing what your browser claims leaves the drawing untouched.

What the browsers themselves give away

Three engines answered navigator.vendor three different ways: Google Inc. on Chromium, Apple Computer, Inc. on WebKit, and an empty string on Firefox. deviceMemory was reported as 32 by both Chromium builds and was undefined in Firefox and WebKit — the property is not implemented there, so a site learns something from the absence as well as the value.

navigator.doNotTrack came back three ways for what is nominally the same signal: null, unspecified and undefined. A field intended as a privacy preference is itself a distinguishing attribute.

What the privacy setting actually changed

The clearest comparison in the table is plain Firefox against Firefox with privacy.resistFingerprinting enabled, on the same machine, same version. It changed eight of the attributes we read:

• Timezone — Europe/London became Atlantic/Reykjavik, which is UTC year-round. The real timezone is simply not reported.
• hardwareConcurrency — 12 became 8, a standard value rather than the machine's true core count.
• WebGL vendor and renderer — Apple / Apple M1, or similar became Mozilla / Mozilla, masking the GPU.
• Canvas hash — changed, so the drawing surface is no longer producing the same signature as unprotected Firefox.
• Reported screen size — 1366×768 became 1280×720.
• Plugin count — 0 became 5, a standardised set rather than the real one.
• WebGL extension list — its hash changed too, so the reported capabilities differ, not just the vendor strings.

That is a genuine reduction, and it is worth knowing it is measurable rather than theoretical. But note what it did not change: the user agent was byte-identical to unprotected Firefox, and the font probe still detected the same seven of eight families. The setting narrows the signal; it does not remove it.

We also ran Chromium with an overridden timezone and locale, which is roughly what a "spoof my location" extension does. Timezone, languages and locale all changed — and the canvas hash and WebGL extension hash did not move at all. Changing what your browser claims about where it is does nothing to the graphics signature underneath.

Why a VPN does not help here

Every measurement above was taken over the same connection. None of these values is derived from your IP address, so changing your exit point changes none of them. A VPN moves where your traffic appears to come from; fingerprinting works on what your browser says once it arrives. They address different halves of the problem, which is why our VPN leak test and the browser privacy analyser are separate tools.

Check your own

Our browser privacy analyser reads exactly the attributes in the table above and shows you what your browser reports, without storing it. The useful exercise is comparative: run it in your normal browser, then in a different engine, then with a privacy setting enabled, and watch which rows move. Our how we test page explains the method behind this and the other tools.

Method and limits

Six configurations — Playwright Chromium, Chromium with timezone and locale overridden, Playwright Firefox, Firefox with privacy.resistFingerprinting, Playwright WebKit and the installed Chrome — each loading our live browser privacy page on 29 September 2026, on a single macOS machine, over one connection. The raw JSON output is what the table is generated from.

Four limits worth stating plainly:

• Six configurations is not a sample. No uniqueness or entropy figure can be drawn from it, and none is claimed here.
• All runs were headless automation. The user agents identify as HeadlessChrome, and headless builds are known to differ from ordinary browsing in ways that could affect several of these attributes. Treat the engine-to-engine differences as real and the absolute values as indicative.
• Reported screen dimensions are set by the automation harness, not by a physical display, so that row says less about real browsers than the others.
• One machine, one OS. The six attributes that stayed constant would not stay constant across different hardware.

Frequently asked questions

Does private or incognito mode stop fingerprinting?

It does not change any attribute in the table. Private mode discards cookies and history for the session; it does not alter your user agent, timezone, hardware values or canvas output. A site using fingerprinting rather than cookies is unaffected by it.

Does a VPN stop fingerprinting?

No. Nothing we measured derives from the IP address. A VPN is the right tool for hiding where you connect from and stopping your ISP seeing the sites you visit; it does nothing about what your browser reports.

Does changing my user agent help?

Not on its own. In our runs the user agent was identical between plain Firefox and Firefox with anti-fingerprinting on, while five other attributes changed — and the Chromium run with an overridden locale kept exactly the same canvas and WebGL hashes. A mismatched user agent can also make you more distinctive, because the claim stops matching the rest of the evidence.

Which of these settings actually did something?

Of the configurations we tested, only privacy.resistFingerprinting changed values that are hard to change — timezone, core count, GPU strings and the canvas hash. The locale override changed only what it was asked to change.