Online Privacy

What Is Browser Fingerprinting?

Your browser tells every website more about you than you probably realise: your screen size, your fonts, your operating system, your time zone, your language, even how your device draws a hidden image. Put together, those details can identify you without a single cookie. That is browser fingerprinting — and the numbers quoted about it disagree wildly. Here is why.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

Try the tool: Browser Fingerprint Demo

How fingerprinting works

When you visit a website, your browser has to share certain details so the page can display properly. A site needs to know your screen size to lay out the page, your language to serve the right text, and your operating system and browser version to work around known bugs. Each detail is ordinary and necessary. The trick is combination: your screen size plus your list of installed fonts plus your time zone plus your graphics hardware narrows the field fast. Add a canvas test — asking your browser to draw a hidden image and measuring the exact pixels, which vary subtly between devices — and the combination can become unique to you.

Unlike a cookie, a fingerprint is not a file stored on your device. You cannot delete it, and clearing your cookies does nothing to it. Trackers collect the same signals on every visit and match them against earlier visits. The fingerprint also changes over time: a browser update, a new font, a changed screen resolution all shift it, so it is a less stable identifier than a cookie — but a persistent tracker can often follow the changes. That is the core fact to understand: fingerprinting is real, it is harder to block than cookies, and it is best resisted by looking ordinary rather than invisible.

Why the uniqueness figures disagree

Search for "how unique is my browser fingerprint" and you will find figures from 33.6% to 90% and beyond — often quoted as if they were one settled fact. They are not. They come from different studies, measuring different people, in different years, with different signals. Here are the three studies that matter, each attributed properly.

Study	Figure	Who was measured
EFF Panopticlick, 2010 (Eckersley) — 470,161 browsers	83.6% unique; 94.2% with Flash or Java enabled	People who visited a fingerprinting test site on purpose — mostly privacy-aware users with unusual setups
AmIUnique, 2016 (Laperdrix and colleagues) — 118,934 fingerprints	89.4% unique overall; 90% of desktops, 81% of mobiles	Again, visitors to a fingerprinting test site — self-selected and privacy-aware
Gómez-Boix, Laperdrix and Baudry, 2018 — 2,067,942 fingerprints	33.6% unique	Ordinary visitors to a large French news website, measured with consent — a general audience, not test-site visitors

The disagreement has three causes. First, the audience. People who visit a fingerprinting test site are unusual by definition: they care about privacy, run uncommon extensions and customised browsers. Eckersley himself called his Panopticlick sample "quite biased". Ordinary visitors to a news site look far more alike — millions of people share the same phone model, operating system version and default settings. Second, the signals counted. The 2010 study's most identifying signals were the lists of browser plugins and system fonts, collected through Flash and Java. Flash reached end of life on 31 December 2020 and browser Java applets went with it — the headline 94.2% figure describes a browser that no longer exists. Modern studies count different attributes, including canvas and audio signals that did not exist in 2010. Third, time. Browsers have added anti-fingerprinting protections since 2018, and fingerprints change as people update software: in the 2010 study, 37.4% of returning visitors had changed at least one fingerprint value within a day.

What about the "90–99%" figures you sometimes see? They appear in vendor articles but do not trace to a single published study we could verify — they appear to round up the AmIUnique desktop figure of 90% or the Panopticlick Flash/Java figure of 94.2%, or to mix figures from different studies. Treat any "90–99%" claim without a named study, sample size and year as marketing, not research. The honest answer is a range, not a number: on a general audience, a minority of fingerprints are unique; among privacy-aware users with unusual setups, most are.

What makes a fingerprint distinctive

Not all signals matter equally. The most identifying ones in the published research are the list of installed fonts, the user-agent string (browser and operating system version), the screen resolution and colour depth, the time zone, and the canvas and WebGL rendering results. Language and installed plugins used to rank highly; they matter less now that plugin lists are gone. Mobile devices are harder to single out than desktops, because millions of people run the exact same phone, operating system and default settings — the 2016 AmIUnique study found 81% of mobile fingerprints unique versus 90% of desktop ones, and the gap is wider on a general audience.

What you can actually do

There is no switch that turns fingerprinting off, and anyone selling one is overselling. What works is making your browser look like everyone else's:

Use a common, up-to-date browser setup. The most popular browser in its default configuration is the hardest to single out. Unusual extensions and rare settings make you stand out, not blend in.
Block known trackers. Your browser's built-in tracking protection and a reputable content blocker stop many fingerprinting scripts from running at all — the best defence is a script that never loads.
Use your browser's anti-fingerprinting settings. Modern browsers offer fingerprinting resistance that standardises or limits the signals they reveal. Turn it on and leave it on.
Do not try to look "more private" with exotic tools. A rare browser configuration is itself a fingerprint. Looking ordinary beats looking special.
Remember the rest of the picture. Fingerprinting is one tracking method among many. Cookies, account logins and your IP address still identify you far more reliably. Our guides to how websites track you and what a VPN hides cover those, and our digital footprint guide shows how to check what is already out there about you.

You can also see your own fingerprint's signals for yourself. The EFF's Cover Your Tracks tool shows which characteristics your browser reveals and how many other visitors shared each value — it is an education tool, and it runs in your browser.

The honest summary. Fingerprinting is real and hard to block, but the scariest numbers about it come from self-selected test-site visitors in 2010 and 2016, measured with signals that no longer exist. On an ordinary audience, most browsers look alike. Your best defence is to look ordinary, block trackers, and not to obsess over one number.

Sources

Peter Eckersley, "How Unique Is Your Web Browser?", Electronic Frontier Foundation, 2010 — Panopticlick paper (PDF) . 470,161 browsers; 83.6% unique, 94.2% with Flash or Java. Last checked: 14 November 2026.
Pierre Laperdrix, Walter Rudametkin and Benoit Baudry, "Beauty and the Beast: Diverting Modern Web Browsers to Build Unique Browser Fingerprints", 2016 (AmIUnique) — 118,934 fingerprints; 89.4% unique; 90% desktop, 81% mobile. Last checked: 14 November 2026.
Alejandro Gómez-Boix, Pierre Laperdrix and Benoit Baudry, "Hiding in the Crowd: an Analysis of the Effectiveness of Browser Fingerprinting at Large Scale", The Web Conference 2018 — 2,067,942 fingerprints from a top French website; 33.6% unique. Last checked: 14 November 2026.
EFF — Cover Your Tracks — see your own browser's signals (2026). Last checked: 14 November 2026.
AmIUnique project — live fingerprint statistics (2026). Last checked: 14 November 2026.