Home / Knowledge hub / Browser fingerprinting
Knowledge hub
Browser fingerprinting
Identifying a visitor from the many small details their browser reveals.
What it means
Browser fingerprinting recognises a visitor by combining many small details their browser reveals: version, language, time zone, screen size, installed fonts, graphics behaviour and more. Each detail is common alone. Together they can be rare enough to pick one browser out of many.
Unlike a cookie, a fingerprint is not stored on the device, so clearing cookies does not remove it. The W3C has published guidance on how web specifications can reduce the amount of identifying detail they expose.
Why it matters
It cuts both ways. Fraud and bot teams use it to spot a returning device, a farm of automated sessions, or a sign-in from a browser that has never been seen. Advertisers and trackers use the same technique to follow people across sites.
That second use brings legal and trust issues. Regulators and browser makers treat tracking by fingerprint as comparable to tracking by cookie, so collecting it needs a clear purpose and, in many places, a lawful basis such as consent.
How it shows up
On the security side you meet it in fraud detection, risk-based sign-in and bot defence tools. On the privacy side you meet it in third-party tags and analytics scripts that collect more than the page needs.
The mistakes repeat. A fingerprint is treated as proof of identity, when it can change or be copied. It is collected without telling anyone. A vendor script gathers far more than its stated purpose. Use it as one signal among several, and review what your scripts collect.
Questions people ask
Browser fingerprinting, answered
Is a browser fingerprint unique?
Often close to it, though not always. Studies show many browsers are rare enough to be told apart, but the result varies by population, and fingerprints can change when a browser updates.
Treat it as a probabilistic signal, not an identifier.
Is fingerprinting the same as cookies?
No. A cookie is data your site stores in the browser. A fingerprint is calculated from what the browser reveals, with nothing stored.
That makes it harder for people to see or clear.
Can we use it as authentication?
No. It can be copied by a determined attacker and can change legitimately. Use it as one input to a risk decision, alongside real authentication such as MFA.
Is it legal?
It depends on where you are and what you do with it. Privacy rules in many places treat tracking through fingerprinting like other tracking and expect clear notice, and often consent.
Ask your legal adviser, and document the purpose.
Can users block it?
Partly. Some browsers reduce what they reveal, and some extensions add noise. That can make a person stand out more, not less, so results vary.
Site owners cannot rely on it either way.
Sources
Where this comes from
Related
Terms that sit next to this one
Fraud detection
Spotting abuse of your business by patterns in behaviour, devices and payments.
Bot traffic
Automated visitors that scrape, stuff credentials or buy stock before real customers.
Account takeover
An attacker ends up signed in as one of your real users.
Adaptive authentication
Asking for more proof when a sign-in looks unusual.
Third-party script risk
Code from outside vendors running on your pages with the same powers as yours.
What does your browser reveal?
Device signals are only one layer, and the flaws behind them still need finding. We find vulnerabilities in your web app and its APIs and prove each by exploiting it. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.