Can I clear or reset my browser fingerprint?

Not in the way you clear cookies, because the fingerprint is not stored on your device. It is recalculated on every visit from how your browser looks. You can change it, for example through an update, or blur it by using a browser that reports fewer and coarser values. Firefox, Safari, Brave, and Tor Browser all have built-in protections for that.

Does incognito mode stop fingerprinting?

Mostly no. A private window throws away cookies and history when you close it, but your hardware, fonts, and screen stay the same. There are exceptions: Safari turns on its advanced fingerprinting protection in private windows by default, and Firefox applies part of its newer defenses there. Chrome blocks third-party cookies in incognito but has no dedicated fingerprinting switch.

Does a VPN change my browser fingerprint?

No. A VPN swaps your IP address for the VPN server address. The browser properties that make up the fingerprint stay exactly the same. For trackers the IP address is only one signal among many, and it changes often anyway.

Is browser fingerprinting legal?

In the US there is no general federal ban. Regulators have acted when companies tracked people without disclosure, as the FCC did with Verizon in 2016. In Europe and the UK, data protection authorities treat fingerprinting for advertising as something that usually needs consent. This is not legal advice.

How do I test my browser fingerprint?

Use Cover Your Tracks from the Electronic Frontier Foundation (coveryourtracks.eff.org) or AmIUnique, a research project from France (amiunique.org). Both show which characteristics your browser reveals and how rare the combination is in their own database. The result compares you with the visitors of those test sites, not with the whole web.

What is browser fingerprinting? What your browser gives away

Between December 2012 and October 2014, Verizon Wireless did something to its customers’ mobile web traffic that most of them never noticed. It inserted an extra line, a unique identifier header, into the requests their phones sent to websites. People called it a supercookie, though it had nothing to do with the browser. It could not be deleted, because it was not on the phone at all. In January 2015, news reports said an advertising partner was using it to bring back cookie IDs that users had cleared on purpose. The FCC settled the case in March 2016: a $1.35 million fine, and Verizon had to ask for opt-in consent before sharing the identifier with third parties.

Browser fingerprinting works on the same idea, and nobody needs your carrier to do it. Any website can recognize your browser by its characteristics, without storing anything on your device. This guide explains what browser fingerprinting is, what your browser also keeps in its own memory, how unique browsers really are according to the research, and which settings in Firefox, Safari, Brave, Tor Browser, and Chrome make a measurable difference. Short version up front: you can’t become invisible. You can become a lot more ordinary.

What is browser fingerprinting?

Every time you load a page, your browser introduces itself. The first request already carries its name and version, your preferred languages, and the formats it understands. Once the page is running, a script can ask follow-up questions. How big is the screen? Which time zone? How many processor cores? Which fonts are installed? Does the device support touch, and with how many fingers?

None of these answers identify you on their own. Lots of people run Windows on a 1080p monitor in the Eastern time zone. The trick is the combination. In 2010 the Electronic Frontier Foundation, a digital rights group, ran a test site called Panopticlick and asked visitors to check their browsers. Researcher Peter Eckersley analyzed 470,161 of those browsers. 83.6 percent had a fingerprint nobody else in the sample shared. With Flash or Java enabled, 94.2 percent did. He estimated at least 18.1 bits of identifying information, which means that if you picked a browser at random, at best one in 286,777 others would look the same. And his visitors were people who cared enough about privacy to go looking.

Signal	How a site gets it	What it narrows down
User agent and Client Hints	sent with each request or available on request	browser, version, operating system, sometimes device model
Language and time zone	browser settings, readable by script	region; unusual pairs stand out
Screen and window size	readable by script	resolution, scaling, taskbar or dock size
Fonts	measuring how wide text renders	software you installed brings its own fonts
Canvas	script draws a hidden image and reads it back	graphics chip, driver, anti-aliasing quirks
WebGL	queries the 3D graphics interface	graphics hardware and driver, often by name
Audio	script generates a signal and reads the output	small differences in audio processing
Hardware details	core count, memory, touch points	narrows down the device model

A quick note on the first row. The user agent is the browser’s self-description. Chrome trimmed it starting with version 113 in 2023. The details that disappeared from the default string can still be requested through a mechanism called Client Hints. Less is handed out automatically, but the information did not vanish.

Canvas, fonts, and audio: making the browser draw

The most famous technique sounds almost harmless. A script asks your browser to draw a short line of text and a few shapes onto an invisible canvas, then reads the pixels back. You see nothing. But every combination of graphics chip, driver, operating system, and font smoothing renders slightly differently, and the result becomes a stable hash. Keaton Mowery and Hovav Shacham at UC San Diego described this in 2012.

Close-up of an artist canvas with visible weave, a single diagonal brushstroke of warm amber paint across it that breaks into fine jagged edges on the right, the left edge fading into darkness — The same stroke comes out very slightly different on every device. Canvas fingerprinting reads exactly that difference.

By 2014 it was in the wild. A team led by Gunes Acar at KU Leuven crawled the homepages of the 100,000 most popular sites and found canvas fingerprinting on more than 5.5 percent of them. About 95 percent of the scripts came from one company, AddThis, which made share buttons. Clicking “share” on a news story came with a fingerprint you never agreed to.

One of the largest measurements comes from Steven Englehardt and Arvind Narayanan at Princeton. In 2016 their automated crawler visited one million websites. Canvas fingerprinting showed up on 14,371 of them, or 1.6 percent, and 98.2 percent of it came from third-party scripts rather than the site itself. Popular sites were worse: 5.1 percent of the top thousand. The crawl also turned up something new at the time. Some scripts generated an inaudible audio signal and measured how the device processed it. It was rare. The most common script touching the audio interface ran on 512 sites, and it only checked whether the feature existed; real audio fingerprinting showed up on even fewer. Still, it shows the pattern. Whenever a browser feature reveals differences between devices, someone eventually tests it for tracking.

Fonts work in a similar way. A site measures how wide a word renders in a given typeface. If the font isn’t installed, the browser falls back to another one and the width changes. Repeat that a few hundred times and the site has a list of your fonts. Office suites, design apps, and language packs all add their own.

How unique is your browser today?

The numbers have dropped, which is genuinely good news. In 2016 a French team led by Pierre Laperdrix published results from the test site AmIUnique: 89.4 percent of 118,934 fingerprints were unique, and 81 percent on phones. Like Panopticlick, though, that site attracts people who tinker with their browsers.

In 2018 Alejandro Gómez-Boix and colleagues got access to a very different sample. They analyzed 2,067,942 fingerprints collected on one of the 15 most visited websites in France, a normal audience. Only 33.6 percent were unique. On computers it was 35.7 percent, on phones 18.5 percent. One big reason was that plugins like Flash, which used to leak a lot, had mostly disappeared.

There’s a catch. The same paper found that fingerprints which aren’t unique are fragile, and changing one attribute, like installing a font, often pushes a browser into a group of one. A fingerprint also doesn’t have to be unique to be useful. Combined with your IP address, or with one cookie that survived somewhere, a rough fingerprint is often enough to link two visits.

Eckersley noticed one more thing in 2010. Many fingerprints changed over time; 37.4 percent of returning visitors who accepted cookies showed at least one change. A very crude algorithm still ventured a match for 65 percent of the changed fingerprints, and 99.1 percent of those guesses were right. A browser update alone won’t shake a determined tracker.

A pile of smooth grey pebbles of almost identical size on dark sand, one of them crossed by a glowing amber vein — Among many similar browsers, the one with a rare trait stands out.

The notebook: what your browser stores about you

Fingerprinting is the invisible part. Your browser also keeps a lot on its own, most of it useful. Trouble starts when other parties can read it or when a storage feature gets repurposed.

An open notebook with blank pages on a dark wooden table, a ribbon bookmark and several paper tabs sticking out, crumbs and a tea cup ring beside it, warm desk lamp light — Whatever a site writes into your browser, it can open again on your next visit.

Storage	What’s in it	Who can read it
First-party cookies	logins, cart, preferences	the site you’re on
Third-party cookies	an ID from an embedded service like an ad network	that service, on every site that embeds it
Local storage (localStorage, IndexedDB)	similar to cookies, often more	scripts from that site
Cache	copies of images, scripts, fonts	the server that sent them, via validators like ETags
History	every address you visited	you, anyone using the device, your account if synced
Autofill and saved passwords	name, address, email, logins	meant for you only, with form tricks as the exception
Permissions	which sites may use location, camera, mic, notifications	that site
Extensions	depending on permissions, everything you see	the extension’s developer

Third-party cookies are the classic tracking tool. An ad network embedded on a thousand sites sees the same ID on every one of them. Firefox now locks those cookies into a separate jar per site, and Safari blocks them outright. Chrome blocks them by default only in incognito. Google had planned to change that and dropped the plan in April 2025, keeping the choice inside Chrome’s existing settings.

The cache is a quieter place to hide an ID. Your browser keeps images and scripts so pages load faster, and later only asks the server whether something changed. To do that it sends back a validator called an ETag. In 2011 researchers at UC Berkeley showed that the analytics firm KISSmetrics, running on Hulu, used that field to recognize visitors even with all cookies blocked. Tricks like that are called supercookies. Firefox 85, released in January 2021, partitions every cache by the site you’re visiting, from images to the HSTS list that remembers which sites use encryption. A cached ID from one site is useless on another.

Autofill had its own surprise. In late 2017, Acar, Englehardt, and Narayanan reported two ad scripts that slipped an invisible login form into pages. The browser’s password manager filled in the saved email address, the script read it, hashed it, and sent it off. Those scripts ran on 1,110 of the top million sites. An email address is a better tracking ID than any fingerprint, because it almost never changes and it links your laptop, phone, and apps.

Two more items belong on the list. The referrer tells a site which page linked you there, and modern browsers now send only the domain to other sites by default, not the full address. Extensions are the other one. A good content blocker helps a lot. An extension allowed to “read and change all your data on all websites” can also see everything you do. For history itself, and why deleting it locally isn’t the whole story, see our guide on how to delete your search history.

Why trackers like fingerprints

Phones come with an advertising ID, a number apps are allowed to use for ad tracking. Browsers don’t have one, and cookies keep getting cleared, blocked, or locked into jars. Fingerprinting fills that gap.

In December 2024 Google told companies using its ad products that from February 16, 2025, it would no longer prohibit fingerprinting. The UK’s data protection regulator, the ICO, responded the next day and called the change irresponsible. It quoted Google’s own 2019 position that fingerprinting “subverts user choice and is wrong.” The regulator also put the consumer problem in one sentence: even if you clear all site data, a fingerprinting company could identify you again right away.

Fairness requires one more point. Banks and stores use similar signals to catch fraud, for instance when someone logs in with your password from a device that has never touched your account. The technique is the same. What differs is who runs it and whether you know.

How to prevent browser fingerprinting, browser by browser

Fully preventing it isn’t possible, and the reason is simple. For a page to work, your browser has to share some things, like the window size for the layout or the time zone for a calendar. Browser makers take one of two routes. Some report fewer, coarser values. Others add a little randomness so the fingerprint changes from session to session.

Browser	What it does	Where to set it
Firefox	blocks known fingerprinters, alters canvas and other values for suspected ones	Settings, Privacy & Security, Enhanced Tracking Protection: Strict
Safari	advanced protection feeds known fingerprinting scripts imprecise values	Mac: Safari, Settings, Advanced. iPhone: Settings, Apps, Safari, Advanced
Brave	randomizes canvas, audio, and other values, on by default	Shields settings, usually nothing to change
Tor Browser	makes all users look as alike as possible	built in; don’t maximize the window
Chrome	reduced user agent, third-party cookies blocked in incognito	Settings, Privacy and security, Third-party cookies

Firefox. The default mode already does a fair amount. Mozilla says the second phase of its defenses, completed with Firefox 145 in November 2025, cut the share of Firefox users who look unique by almost half. Those newer protections apply in private windows and in Strict mode first. So if you go to Settings, Privacy & Security and set Enhanced Tracking Protection to Strict, you get them everywhere. A few sites may break; the shield icon in the address bar lets you make an exception per site. Forums often recommend privacy.resistFingerprinting in about:config. It comes from the Tor project and is thorough, but it changes things like your reported time zone and makes some sites misbehave. Mozilla explicitly does not recommend it for the average user.

Safari. The setting is called “Use advanced tracking and fingerprinting protection.” It keeps known fingerprinting scripts from reliably reading things like screen dimensions, canvas output, and audio values, and it strips known tracking parameters from links. By default it is on only in private windows. On a Mac it lives under Safari, Settings, Advanced; on an iPhone under Settings, Apps, Safari, Advanced, where you can switch it to all browsing. Apple’s Safari 26 announcement talked about fingerprinting protection in all browsing by default. That referred to a separate layer tied to “Prevent cross-site tracking.” The Advanced setting itself still defaults to private browsing.

Brave goes the randomization route. Since 2020 it slightly alters values like the canvas image and audio output for each site and each session, in ways people can’t notice. A tracker keeps seeing new fingerprints instead of the same one.

Tor Browser does the opposite and tries to make everyone identical. Every Windows machine reports as Windows 10, fonts are limited, and the window opens at a size rounded to a grid of 200 by 100 pixels. Maximize it and you get gray margins, called letterboxing, so your real screen size doesn’t leak. What Tor does beyond that, and where it stops, is in our guide to what Tor Browser protects.

Chrome offers the least here. Google shortened the user agent, and incognito blocks third-party cookies. There’s no switch in the settings aimed at fingerprinting like the ones in Firefox and Safari. What you can do is block third-party cookies in normal windows too, under Privacy and security. That one change is worth making.

Then there’s advice that sounds backwards: don’t stack five privacy extensions. Germany’s federal cybersecurity agency, the BSI, warns that such add-ons can make your browser more distinctive and easier to recognize. Eckersley saw the same thing in 2010. Rare privacy tools put their users in a rare group.

Run a browser fingerprint test

Panopticlick became Cover Your Tracks in November 2020 and lives at coveryourtracks.eff.org. It checks whether your browser blocks trackers and, in a detailed view, lists each characteristic: fonts, language, screen, canvas, audio, and how many other visitors shared each value. AmIUnique at amiunique.org comes out of the French research mentioned above and does much the same.

Read the result with some distance. Both sites compare you with their own visitors, who are unusually interested in the topic. “Your browser is unique” means unique among people who take fingerprint tests. The test is most useful as a before-and-after check. Run it once, raise your browser’s protection, and run it again.

Where the defenses stop

Even the best browser leaves traces. Once you log in somewhere, the site knows who you are and can share that with partners. Every server you talk to sees your IP address. A VPN moves that to the provider, but it does nothing to your fingerprint. And syncing your phone and laptop through the same browser account deliberately puts your history and passwords in a second place.

Nobody is invisible online. We made that case in detail in our piece on what OPSEC is. The realistic goal is smaller: don’t be easier to recognize than you need to be. A browser that looks like many others, that doesn’t pass cookies to third parties, and whose password manager doesn’t fill hidden forms makes tracking more work. It won’t make you disappear.

Seen from above, a crowd under identical dark navy umbrellas crosses a wet square at night, the people hidden beneath them, the pavement reflecting warm light from a street lamp — Looking like everyone else makes you harder to pick out. That is the idea behind Tor Browser and part of the protections in Firefox and Safari.

The bottom line

Peter Eckersley built Panopticlick so people could see what their browsers say about them. That’s still the best place to start. A fingerprint is invisible, but it isn’t fate. The major browsers have added real defenses in the last few years, and a few minutes in the settings do more than any extension. You can’t take off the ID badge. You can make sure it looks pretty ordinary.

Sources: FCC, FCC Settles Verizon “Supercookie” Probe, Requires Consumer Opt-In for Third Parties (PDF), March 7, 2016 · Peter Eckersley, How Unique Is Your Web Browser? (PDF), PETS 2010 · Pierre Laperdrix, Walter Rudametkin, Benoit Baudry, Beauty and the Beast: Diverting modern web browsers to build unique browser fingerprints (PDF), IEEE S&P 2016 · Alejandro Gómez-Boix, Pierre Laperdrix, Benoit Baudry, Hiding in the Crowd (PDF), The Web Conference 2018 · Steven Englehardt, Arvind Narayanan, Online Tracking: A 1-million-site Measurement and Analysis (PDF), ACM CCS 2016 · Gunes Acar et al., The Web Never Forgets (PDF), ACM CCS 2014 · Gunes Acar, Steven Englehardt, Arvind Narayanan, No boundaries for user identities: Web trackers exploit browser login managers, December 27, 2017 · Mika Ayenson et al., Flash Cookies and Privacy II: Now with HTML5 and ETag Respawning, July 29, 2011 · ICO, Our response to Google’s policy change on fingerprinting, December 19, 2024 · Mozilla, Firefox 85 Cracks Down on Supercookies, January 26, 2021 · Mozilla, Firefox expands fingerprint protections, November 2025 · Mozilla Support, Resist Fingerprinting · Apple, Change Advanced settings in Safari on Mac · WebKit, WebKit Features in Safari 26.0 · Jeff Johnson, Safari 26 advanced fingerprinting protection: A confusing feature, September 29, 2025 · Brave, Fingerprint randomization, March 5, 2020 · Tor Project, Fingerprinting protections · Google, Next steps for Privacy Sandbox and tracking protections in Chrome, April 2025 · Chromium, User-Agent Reduction · BSI, JavaScript, Cookies und Fingerprints (German) · EFF, Introducing Cover Your Tracks!, November 19, 2020

Frequently asked questions

What is browser fingerprinting?: A way of recognizing a browser by its characteristics instead of by a stored cookie. A script on the page reads things like screen size, time zone, language, installed fonts, and the way your graphics hardware draws a hidden test image. Combined, those values often form a pattern that only one device has. Nothing is saved on your computer, so clearing cookies does not remove it.
Can I clear or reset my browser fingerprint?: Not in the way you clear cookies, because the fingerprint is not stored on your device. It is recalculated on every visit from how your browser looks. You can change it, for example through an update, or blur it by using a browser that reports fewer and coarser values. Firefox, Safari, Brave, and Tor Browser all have built-in protections for that.
Does incognito mode stop fingerprinting?: Mostly no. A private window throws away cookies and history when you close it, but your hardware, fonts, and screen stay the same. There are exceptions: Safari turns on its advanced fingerprinting protection in private windows by default, and Firefox applies part of its newer defenses there. Chrome blocks third-party cookies in incognito but has no dedicated fingerprinting switch.
Does a VPN change my browser fingerprint?: No. A VPN swaps your IP address for the VPN server address. The browser properties that make up the fingerprint stay exactly the same. For trackers the IP address is only one signal among many, and it changes often anyway.
Is browser fingerprinting legal?: In the US there is no general federal ban. Regulators have acted when companies tracked people without disclosure, as the FCC did with Verizon in 2016. In Europe and the UK, data protection authorities treat fingerprinting for advertising as something that usually needs consent. This is not legal advice.
How do I test my browser fingerprint?: Use Cover Your Tracks from the Electronic Frontier Foundation (coveryourtracks.eff.org) or AmIUnique, a research project from France (amiunique.org). Both show which characteristics your browser reveals and how rare the combination is in their own database. The result compares you with the visitors of those test sites, not with the whole web.