The four origins of a fingerprint signal
Every value in the index below comes from one of four places, and knowing which one explains most of its behaviour.
- The hardware - GPU, audio pipeline, CPU, sensors. These are physical, so they are consistent across realms and processes by construction, and expensive to change convincingly because a change has to be reflected everywhere the hardware is visible.
- The build - which engine, compiled with which options, linked against which libraries. This determines codec licensing, engine constants, and math rounding. Build-level values cannot be set per session, which is what makes them useful as oracles.
- The operating system - fonts, system colours, hyphenation, voices, timezone, locale. These reach the page through several unrelated APIs at once, so a change made at the OS level moves all of them and a change made in JavaScript moves one.
- The session - network path, declared locale, viewport. The only genuinely per-session layer, and the one where legitimate configuration lives.
Contradictions arise when a value is set at a different layer than the one it belongs to. Setting an OS-level fact in page JavaScript changes one surface and leaves the others reporting the truth, which is the mechanism behind almost every check in fingerprint lie detection.
The index
Rendering and hardware
Signals produced by the GPU, audio stack, and font rasteriser - the surfaces that describe the physical machine.
| Signal | What it reads |
|---|---|
| Canvas Fingerprinting | Canvas fingerprinting asks the browser to draw an invisible image and hashes the pixels. |
| WebGL Fingerprinting | WebGL fingerprinting reads the GPU renderer string, supported extensions, and rendering output to identify hardware. |
| WebGPU Fingerprinting | WebGPU fingerprinting reads the GPU adapter, limits, and compute output via navigator. |
| AudioContext Fingerprinting | AudioContext fingerprinting plays a silent waveform and hashes the floating-point output to identify the audio stack. |
| Font Fingerprinting | Font fingerprinting enumerates the typefaces installed on a system by measuring how text renders. |
| DOMRect Fingerprinting | DOMRect fingerprinting reads sub-pixel element geometry from getBoundingClientRect. |
| Hardware Fingerprinting | Hardware fingerprinting reads CPU core count, device memory, and screen metrics from JavaScript. |
| Media Devices Fingerprinting | navigator. |
| Speech Synthesis Fingerprinting | speechSynthesis. |
| Sensor Fingerprinting | Mobile sensors like the accelerometer, gyroscope, and magnetometer leak manufacturing imperfections that uniquely identify a device. |
| Battery Status API Fingerprinting | The Battery Status API exposed charge level and charging time precisely enough to act as a short-lived cross-site identifier, a convenience-API privacy signal. |
| Codec Fingerprinting | Which audio and video codecs a browser can play reveals its build, licensing, and OS. |
Network and transport
Signals emitted below the browser, by the TLS and HTTP stacks and by network path discovery.
| Signal | What it reads |
|---|---|
| TLS Fingerprinting (JA3/JA4) | TLS fingerprinting (JA3, JA4, JA4H) hashes the TLS Client Hello and HTTP/2 framing to identify clients before HTML is served. |
| JA3 Fingerprinting | JA3 hashes the TLS Client Hello - cipher suites, extensions, and curves - into a fingerprint that identifies the client stack. |
| JA4 Fingerprinting | JA4 is the TLS fingerprint that replaced JA3 after Chrome randomised extension order. |
| HTTP/2 Fingerprinting | Even with perfect JA4 TLS, HTTP/2 SETTINGS frames identify a client. |
| HTTP/3 / QUIC Fingerprinting | HTTP/3 runs over QUIC, whose transport parameters and initial packet form a fingerprint distinct from TLS and HTTP/2. |
| WebRTC IP Leak | WebRTC can reveal your real IP via STUN candidates even behind a proxy. |
| DNS Leak | A DNS leak happens when hostname resolution skips your proxy and exposes your real network. |
Engine and runtime
Values derived from how the JavaScript engine was compiled and which system libraries it links against.
| Signal | What it reads |
|---|---|
| Math & JS Engine Fingerprinting | Math fingerprinting runs floating-point operations whose last bits differ across CPUs, math libraries, and JS engines, revealing engines that mismatch identity. |
| WASM Fingerprinting | WebAssembly SIMD probes the actual CPU and SharedArrayBuffer enables a higher-resolution timer, both below the JavaScript layer. |
| Stack Depth Fingerprinting | The maximum JavaScript recursion depth before a RangeError varies by engine and platform. |
| Engine/OS Oracle Fingerprinting | Engine oracles are small constants that reveal the real JavaScript engine and operating system regardless of the User-Agent string. |
| Timing & Cache Side-Channel Fingerprinting | High-resolution timers let JavaScript measure CPU cache, GPU draw time, and memory latency to fingerprint hardware and expose headless rendering shortcuts. |
| Clock Coherence Detection | Browsers expose several clocks that must agree. |
Environment and display
Signals describing the screen, the locale, and the browsing context around the page.
| Signal | What it reads |
|---|---|
| Screen Resolution Fingerprinting | Screen and window dimensions, device pixel ratio, and available area form a coherent display fingerprint that can expose headless scrapers. |
| CSS Media Query Fingerprinting | matchMedia() exposes OS-level preferences - color scheme, reduced motion, contrast, pointer type - as fingerprint signals that reveal headless defaults. |
| Client Hints Fingerprinting | User-Agent Client Hints (Sec-CH-UA) expose browser brand, platform, and architecture as structured headers, which anti-bots cross-check against the UA string. |
| Timezone / IP Mismatch | A timezone that disagrees with the proxy IP geolocation is a reliable bot signal. |
| Incognito Detection | Sites detect private/incognito browsing through storage quota limits, filesystem API behaviour, and persistence differences. |
| Favicon Fingerprinting (Supercookies) | Favicon fingerprinting abuses the browser's dedicated favicon cache as a persistent supercookie that survives incognito mode and cache clears to encode an ID. |
Automation surface
Artefacts left by drivers, debugging protocols, and injected code rather than by the hardware.
| Signal | What it reads |
|---|---|
| navigator.webdriver | navigator. |
| CDP Detection | Anti-bot scripts detect when a browser is driven by the Chrome DevTools Protocol. |
| Input Provenance Detection | How sites tell real input from scripted input: Event. |
| Native Function Integrity Checking | How detection scripts verify that browser built-ins are genuine natives: toString output, property descriptors, receiver brand checks, and honeypot properties. |
| Browser Extension Detection | Sites detect installed browser extensions by probing web-accessible resources, observing DOM changes, or timing behaviour. |
| How Is Mobile Emulation Detected | Device emulation changes the User-Agent, viewport, and touch flags but leaves desktop hardware underneath. |
Analysis methods
Not surfaces but techniques - how collected signals get turned into a verdict.
| Signal | What it reads |
|---|---|
| Browser Fingerprinting | Browser fingerprinting identifies visitors by their device characteristics - fonts, canvas, WebGL, TLS - without cookies. |
| Fingerprint Entropy | Fingerprint entropy measures how much identifying information a browser leaks, in bits. |
| Fingerprint Clustering | Fingerprint clustering judges a browser by the combination of its fingerprint fields, not each alone, rejecting visitors that fall outside real-device clusters. |
| Fingerprint Lie Detection | Lie detection is how anti-bots evaluate fingerprints: instead of trusting reported values, they check them for internal contradictions and signs of tampering. |
| Cross-API Coherence Checking | Cross-API coherence checking asks a browser the same question through two independent APIs and compares the answers. |
| Realm Coherence Detection | Realm coherence detection compares what the page, a Web Worker, and a fresh iframe report about one browser. |
| What Are Spec Invariants in Fingerprinting | A spec invariant is a rule the web standard places on a value, so a violation is provable from the specification alone - no reference data or corpus needed. |
| Fingerprint Reconnect Stability | Reconnect stability is whether a browser returns the same fingerprint across reloads and sessions. |
| FingerprintJS | FingerprintJS is a widely used open-source library that builds a stable browser visitor identifier from device signals. |
| How to Read a Fingerprint Test Score | Fingerprint testers measure different things: uniqueness, coherence, or known tells. |
How to read the map
The index is deliberately long, and most of it does not matter on any given request. Three notes on using it.
Volume is not weight. The rendering group has the most entries, but a single contradiction in the automation group usually carries more weight than an unusual value anywhere in rendering. Rare hardware has innocent explanations; a debugging artefact does not.
Work downward, not outward. The instinct when a request fails is to add surfaces to the list of things being managed. The more productive move is usually to go down a layer: a single change at the engine or OS level fixes every derived value at once, where a dozen changes in page JavaScript each create a new object for integrity checks to find.
The analysis group is where the leverage is. Understanding entropy, clustering, and coherence explains why the other five groups behave as they do, and prevents the most common failure - optimising a uniqueness score by editing values, which reliably makes coherence worse.
For teams whose objective is collecting public web data, the practical reading of this index is that it describes a maintenance surface rather than a checklist. Every group is a set of facts that must stay mutually consistent for the life of a session, across every realm and protocol. That is precisely the work a managed web data API exists to absorb.