Browser fingerprinting: what sites read and what helps

What a browser fingerprint is

Every website can read some facts about the browser that opens it, because pages need them to display correctly: the browser version, the window and screen size, the preferred languages, the time zone and whether graphics acceleration is available. One fact alone is shared by millions of people. Many of them combined can narrow a browser down to a small group or, sometimes, to one device.

Unlike a cookie, a fingerprint is not stored on your device, so clearing site data does not remove it. It is recalculated on each visit, and it changes when you update the browser, connect a new monitor or change a setting, which is why tracking companies combine it with other signals.

What sites can read without asking

The IPNixa browser test reads the same kind of values any page can read. The table lists the main groups and why each one varies between people.

An observed example

On 2 November 2026 we ran the same reads as the browser test in a Chromium-based browser on a Windows 11 laptop in Bangkok. Several results show how browsers already limit or leak detail:

• The user agent said Windows NT 10.0 even though the system runs Windows 11. Chromium freezes the operating system version in the user agent; the exact version is available only through Client Hints that a site must request.
• The basic WebGL renderer was the generic value WebKit WebGL, but the debug extension that Chromium-based browsers still expose returned the exact integrated graphics model and its Direct3D 11 driver.
• Two Canvas drawings of the same test image produced identical pixels, so the result was stable and readable. A browser that adds random noise would report the two samples as different.
• The time zone was Asia/Bangkok, the languages were English (US) then Korean, and the browser reported 22 logical CPU cores and a pixel ratio of 1.5. None of these would change by connecting to a VPN in another country.

Why a VPN does not change your fingerprint

A VPN replaces the address websites see with the address of its server. Everything the browser itself reports stays the same, because it is read on your device after the page arrives. If you connect to a server in Germany while your clock says Asia/Bangkok and your first language is Korean, a site can see that mismatch. That does not reveal who you are, but it can make the connection look unusual to fraud and VPN detection systems.

Some VPN apps include browser extensions that change the time zone or block WebRTC. They help only inside that browser and only for the values they cover.

What actually helps

There are two working strategies: make every browser report the same values, or make each value slightly different on every site and session. Blocking a single value often backfires, because few people block it.

• Tor Browser makes all of its users look alike: same window sizes in steps, same time zone, same fonts. It is the strongest option and also the most restrictive.
• Brave randomizes Canvas, WebGL and audio outputs per site and per session by default, so a fingerprint taken on one site does not match another.
• Safari adds noise to some readouts, such as Canvas, with Advanced Fingerprinting Protection, which is on by default in private browsing and can be enabled for all browsing.
• Firefox applies fingerprinting protections in private windows and in Strict tracking protection, and offers a stricter resist-fingerprinting mode that Tor Browser builds on.
• Keep extensions to a minimum. Each extension can change what pages see, and an unusual combination is easier to recognize.
• Keep the browser updated. Newer versions expose less detail by default, as the frozen user agent shows.

Test one setting at a time

A single result does not tell you how unique you are; the number of visible fields is not a tracking score. What a test can show reliably is whether a setting changes what sites read.

1. Open the IPNixa browser test, select the option to include Canvas and WebGL, and run it.
2. Keep the result for comparison. It is saved only in this tab’s session storage for up to 30 minutes, without Canvas pixels, a hash or a fingerprint ID.
3. Change one thing: turn on a browser protection, switch to a private window with protection on, or connect a VPN.
4. Return to the tab and run the test again. Read the changed, unchanged and unconfirmed fields. A value that disappears is not proof of protection; a value that changes on every run means it is being randomized.