Browser Fingerprinting: How to Test Yours, and Why Half the Fixes Make It Worse
Clear your cookies, open a private window, switch on a VPN, and a site can still recognise you. Fingerprinting does not store anything on your machine. It reads what your browser reveals just by loading a page, and combines those details into an identifier.
Screen size, timezone, installed fonts, language, graphics card behaviour, audio stack quirks. Any one of them is shared by millions of people. Together they are often unique.
Test yours first, before changing anything
Two minutes, and it reframes everything that follows.
Run a fingerprinting test in your normal browser, the one you use daily, with your usual extensions. The reputable public testers report the same thing: how many other visitors share your configuration, and which attributes make you stand out.
⚠️ Read the result correctly. The number that matters is not a score out of ten, it is how common you are. Being one in a thousand is not a small problem, it is an identifier. And run the test twice, once with extensions on and once in a clean profile, because the gap between the two is usually the most useful thing you will learn.
Why more privacy extensions often make it worse
This is the part that surprises people, and it is the reason this article exists.
Every extension that changes what your browser reports makes your browser less common. Spoofing your user agent, blocking canvas, faking your timezone: each one removes you from the crowd rather than hiding you in it.
Fingerprinting does not need to know the truth about you. It only needs you to be consistent and distinctive, and an unusual set of anti-fingerprinting tools delivers exactly that.
The stack of five privacy add-ons that feels safest is frequently the most identifiable configuration on a given site.
Two ways of being in the same square. The people in the middle are hard to pick out because they look like everyone next to them; the ones crossing the empty space alone are trivially trackable even though nobody is holding a list of names. That is the whole mechanism, and it explains why standing out is the risk rather than being recorded.
The two approaches that actually work
They are opposites, and mixing them gives you the worst of both.
Look like everyone else. This is what the Tor Browser does: every user is deliberately given the same fingerprint, so the crowd is genuinely a crowd. It works because it is enforced by default and nobody customises it. If you change its window size or install extensions, you have left the crowd and undone the protection. Our page on the Tor Browser covers what it does and does not cover.
Be a different person each time. Firefox and its derivatives take the other route: rather than making everyone identical, they add controlled noise so the same attribute reports differently across sites and sessions. The identifier stops being stable, which breaks the link between your visits even though each visit looks unusual.
Both are real defences. Neither survives being combined with the other, or with a pile of extensions that reintroduce a distinctive shape.
What it is actually used for
Not only advertising. Fingerprinting is also how banks recognise a familiar device, how services detect fraud, and how sites spot automated traffic. That is worth knowing for two reasons: it means the technique is not going away, and it means breaking your own fingerprint will occasionally break a legitimate site, usually a login flow that no longer recognises you.
⚠️ We publish no figure on how uniquely identifiable a typical browser is. Public estimates vary enormously with the population being measured and the attributes tested, and a number quoted out of that context would mislead. Run the test yourself: your own result is the only one that applies to you.
What to do, in order
- Test your current browser, with and without extensions.
- Pick one strategy, uniformity or randomisation, and stop there.
- Resist adding tools. Each addition is a subtraction from the crowd.
- Keep the browser updated, because both strategies depend on you resembling other people running the same recent version.
- Decide what you are defending against. Fingerprinting matters a great deal against cross-site advertising and very little against someone with your password, which is the kind of ranking a threat model is for.
The short version
- Fingerprinting reads how your browser is configured. Clearing cookies does nothing to it.
- Test yours, and read the result as how common you are, not as a score.
- More privacy extensions usually make you more identifiable, not less.
- Two strategies work: look identical to everyone, or look different every time. Never both.
- It is used for fraud detection as well as advertising, so breaking it sometimes breaks a login.