Foundation guide

Browser fingerprinting: how it works and how profiles help.

Your browser leaks a dozen stable signals to every site: canvas rendering, fonts, screen values, hardware counts. Fingerprinting turns them into an ID that survives cookies being cleared.

Direct answer

Browser fingerprinting identifies users through device signals instead of cookies: user agent, canvas and WebGL output, fonts, screen parameters, timezone, and hardware counts. Persistent profiles defeat it by giving each account a fixed, realistic set of those signals plus a matching proxy. AliasMode does this free with deterministic fingerprint seeds per profile.

What a fingerprint collects

Fingerprinting needs no special permission. Pages read the rendering engine’s behavior and the environment’s configuration through ordinary browser APIs, then combine the readings into a stable identifier.

Common fingerprint signals
SignalExample readingWhy platforms collect it
User agentBrowser and OS version stringsCheap first-pass grouping
Canvas and WebGLPixel-level rendering differencesTies browser builds to GPUs
FontsInstalled font listStrong OS and install-history signal
Screen and mediaResolution, color depth, device pixel ratioDistinguishes real machines from VM defaults
HardwareCPU core count, memory, battery stateHard to fake consistently
Timezone and localeGMT offset, language, currency formatMust match the IP’s country
WebRTCLocal and public IP candidatesLeaks the real address behind proxies when mishandled

How detection actually judges you

  • Consistency: does the fingerprint match yesterday’s? Randomized fingerprints that change every launch look worse than a stable one.
  • Coherence: do the signals agree? A Windows user agent with macOS fonts or a US IP with a GMT+7 clock is a flag.
  • Automation markers: headless flags, driver artifacts, and CDP leaks betray bots regardless of fingerprint.
  • Reputation: datacenter IP ranges and previously abused configurations carry history.
  • Behavior: typing rhythm, mouse paths, and pacing separate humans from scripts even with perfect fingerprints.

The lesson from detection research is that platforms rarely block on one signal. They score consistency over time, which is why persistent profiles with deterministic values outperform both stock browsers and randomized spoofing.

Defenses that hold up

  1. Use a browser runtime built for fingerprint control rather than a stock browser with extensions.
  2. Give every account its own profile with a deterministic fingerprint seed that never changes between runs.
  3. Match timezone, locale, and language to the profile’s proxy country.
  4. Keep one stable exit IP per profile for the account’s lifetime.
  5. Warm new identities with human-paced activity before any automation.
  6. Test before real work: check for leaks and consistency with public fingerprint-reading tools.

Test your setup

  1. Read the raw fingerprint

    Open a fingerprint-checking site in the profile and note the reported user agent, canvas hash, fonts, screen values, and hardware counts.

  2. Restart and compare

    Close the profile, reopen it, and re-read the values. Every value should be identical; drift means the configuration is not deterministic.

  3. Check the network story

    Confirm the reported IP, timezone, language, and currency all point to the same country as the profile’s proxy.

  4. Verify automation leaks

    Run your Playwright or Puppeteer script against the check site and look for automation markers that the manual visit did not show.

Frequently asked questions

Can a fingerprint be changed?

Yes, per application: antidetect browsers override the values pages can read and keep them fixed per profile. You cannot fully block collection in a stock browser without breaking sites.

Does clearing cookies beat fingerprinting?

No. Cookies are the easy identifier; the fingerprint regenerates the same ID from device signals immediately. That is why real defenses operate at the browser layer.

Is fingerprinting worse on mobile?

Mobile browsers expose fewer readable signals, but their fingerprints are also more uniform, which makes outliers stand out. Both platforms punish inconsistency hardest.

How does AliasMode stop fingerprint drift?

Profiles store a deterministic seed plus explicit user agent, screen, proxy, and locale settings. Every run of a profile reports the same identity, and the CloakBrowser runtime keeps engine-level values coherent.

Sources and verification

  • MDN Web Docs · Browser fingerprinting glossary entry (checked September 2026)
  • Electronic Frontier Foundation · Cover Your Tracks fingerprint test (checked September 2026)
  • AliasMode · AliasMode CloakBrowser documentation (checked September 2026)
  • AliasMode · AliasMode browser profiles documentation (checked September 2026)

Public product details can change after the check date. Facts are re-checked on a monthly cycle.