Foundation guide
Browser fingerprinting: how it works and how profiles help.
Your browser leaks a dozen stable signals to every site: canvas rendering, fonts, screen values, hardware counts. Fingerprinting turns them into an ID that survives cookies being cleared.
Direct answer
Browser fingerprinting identifies users through device signals instead of cookies: user agent, canvas and WebGL output, fonts, screen parameters, timezone, and hardware counts. Persistent profiles defeat it by giving each account a fixed, realistic set of those signals plus a matching proxy. AliasMode does this free with deterministic fingerprint seeds per profile.
What a fingerprint collects
Fingerprinting needs no special permission. Pages read the rendering engine’s behavior and the environment’s configuration through ordinary browser APIs, then combine the readings into a stable identifier.
| Signal | Example reading | Why platforms collect it |
|---|---|---|
| User agent | Browser and OS version strings | Cheap first-pass grouping |
| Canvas and WebGL | Pixel-level rendering differences | Ties browser builds to GPUs |
| Fonts | Installed font list | Strong OS and install-history signal |
| Screen and media | Resolution, color depth, device pixel ratio | Distinguishes real machines from VM defaults |
| Hardware | CPU core count, memory, battery state | Hard to fake consistently |
| Timezone and locale | GMT offset, language, currency format | Must match the IP’s country |
| WebRTC | Local and public IP candidates | Leaks the real address behind proxies when mishandled |
How detection actually judges you
- Consistency: does the fingerprint match yesterday’s? Randomized fingerprints that change every launch look worse than a stable one.
- Coherence: do the signals agree? A Windows user agent with macOS fonts or a US IP with a GMT+7 clock is a flag.
- Automation markers: headless flags, driver artifacts, and CDP leaks betray bots regardless of fingerprint.
- Reputation: datacenter IP ranges and previously abused configurations carry history.
- Behavior: typing rhythm, mouse paths, and pacing separate humans from scripts even with perfect fingerprints.
The lesson from detection research is that platforms rarely block on one signal. They score consistency over time, which is why persistent profiles with deterministic values outperform both stock browsers and randomized spoofing.
Defenses that hold up
- Use a browser runtime built for fingerprint control rather than a stock browser with extensions.
- Give every account its own profile with a deterministic fingerprint seed that never changes between runs.
- Match timezone, locale, and language to the profile’s proxy country.
- Keep one stable exit IP per profile for the account’s lifetime.
- Warm new identities with human-paced activity before any automation.
- Test before real work: check for leaks and consistency with public fingerprint-reading tools.
Test your setup
Read the raw fingerprint
Open a fingerprint-checking site in the profile and note the reported user agent, canvas hash, fonts, screen values, and hardware counts.
Restart and compare
Close the profile, reopen it, and re-read the values. Every value should be identical; drift means the configuration is not deterministic.
Check the network story
Confirm the reported IP, timezone, language, and currency all point to the same country as the profile’s proxy.
Verify automation leaks
Run your Playwright or Puppeteer script against the check site and look for automation markers that the manual visit did not show.
Frequently asked questions
Can a fingerprint be changed?
Yes, per application: antidetect browsers override the values pages can read and keep them fixed per profile. You cannot fully block collection in a stock browser without breaking sites.
Does clearing cookies beat fingerprinting?
No. Cookies are the easy identifier; the fingerprint regenerates the same ID from device signals immediately. That is why real defenses operate at the browser layer.
Is fingerprinting worse on mobile?
Mobile browsers expose fewer readable signals, but their fingerprints are also more uniform, which makes outliers stand out. Both platforms punish inconsistency hardest.
How does AliasMode stop fingerprint drift?
Profiles store a deterministic seed plus explicit user agent, screen, proxy, and locale settings. Every run of a profile reports the same identity, and the CloakBrowser runtime keeps engine-level values coherent.
Sources and verification
- MDN Web Docs · Browser fingerprinting glossary entry (checked September 2026)
- Electronic Frontier Foundation · Cover Your Tracks fingerprint test (checked September 2026)
- AliasMode · AliasMode CloakBrowser documentation (checked September 2026)
- AliasMode · AliasMode browser profiles documentation (checked September 2026)
Public product details can change after the check date. Facts are re-checked on a monthly cycle.