Log in
Antifraud & trust

Browser Fingerprint: How It Works and Where It Is Used

Browser fingerprint: how a digital device fingerprint works

A browser fingerprint is the combination of dozens of small technical details — browser build, screen, fonts, graphics chip, clock settings — that a website reads to tell one visitor from another without cookies or a login. Each parameter on its own is shared by millions of people, but the combination is close to unique. In 2026 the fingerprint is one of the main anti-fraud tools: platforms use it to link accounts to each other, tell people from bots and notice that several “different” users sit behind one computer.

The word fingerprint also means the finger scan that unlocks a phone. Biometrics are a separate story: a phone keeps the finger scan in its secure chip and never shares it with sites. Here the topic is only what browsers reveal.

What goes into a browser fingerprint

The collection is done by a script that runs as the page opens. Nothing is shown to the visitor and no permission is requested. The usual ingredients are:

  • the User-Agent string: which browser, which build, which OS;
  • display size in pixels, colour depth, zoom factor;
  • clock offset, UI locale and the ordered languages the browser accepts;
  • fonts available on the system;
  • Canvas — an invisible drawing whose pixels differ slightly from machine to machine because of the GPU, drivers and anti-aliasing;
  • WebGL — the GPU vendor and renderer string plus quirks of 3D rendering;
  • AudioContext — how the device processes a sound signal;
  • the number of CPU cores and the amount of memory the browser reports;
  • connected cameras and microphones, touch screen support;
  • WebRTC — which can reveal the local and the real IP past the proxy.

There is also a network fingerprint. It comes from the connection rather than from a script: the order of ciphers and extensions in the TLS hello and the parameters of TCP packets. Anti-fraud checks them against the browser’s claims too.

How fingerprinting identifies a visitor

All the values are condensed into an ID, either a strict hash or a probabilistic match. A strict hash breaks when one value moves, so modern systems compare loosely: if most signals match, it is most likely the same device. A browser update or a new monitor does not make a person “new”.

The fingerprint then does two jobs:

  • recognition — the same fingerprint on another account means the accounts are probably run by one person;
  • consistency check — the parameters are compared with each other and with the network. The browser claims Windows while the graphics card is typical for a phone; the time zone is Moscow while the IP is American — such contradictions give away a spoofed setup.

The second job matters more than the first. A unique fingerprint that is internally consistent looks like an ordinary user. A fingerprint put together from details that do not fit raises suspicion even the first time it is seen.

Where browser fingerprinting is used

  • banks and payment systems — protection against account takeover and fraudulent payments;
  • ad accounts — finding linked accounts after one of them is banned;
  • social networks and marketplaces — limiting multi-accounting;
  • bot protection — telling an automated browser from a real one;
  • analytics and advertising — recognising a visitor when cookies are deleted or blocked.

That is why the fingerprint matters to anyone who runs several accounts: media buyers, SMM specialists and teams that advertise in different countries.

Fingerprint and IP address: two levels of one check

The fingerprint describes the device, the IP address describes the network. Anti-fraud looks at both at once, and a mistake on either level undoes the work on the other:

  • change the IP and keep the same fingerprint — the accounts are still linked through the device;
  • change the fingerprint in an anti-detect browser and keep one IP for all profiles — the accounts are linked through the network;
  • take an IP from one country and leave the time zone and language of another in the profile — the contradiction is visible at once.

A mobile IP covers the network level: the address belongs to a carrier and is shared by many subscribers, so platforms treat it with care. More on this in how websites detect mobile proxies. Still, swapping the IP leaves the device signature intact, and an anti-detect profile leaves the network address intact. Only the pair covers both levels.

How to align the fingerprint with mobile proxies

  1. Each profile gets its own proxy channel, and addresses never move between profiles.
  2. Clock, locale and geolocation in the profile follow the country of the IP. This pairing is covered in mobile proxies and time zone in anti-fraud.
  3. WebRTC does not reveal the real address: how to disable WebRTC.
  4. The profile looks ordinary: a widespread display size, a GPU that fits the claimed OS, a standard font list.
  5. A new profile does not start with the target action but gets a short history first — browser profile warm-up.

The result can be checked on fingerprint test sites: they show what a website sees and flag contradictions between parameters. Run the check through the same proxy the profile will work with.

Summary

A browser fingerprint is the digital fingerprint of a device that websites use to recognise a visitor and check whether the setup is plausible. The fingerprint covers the device level, the IP address covers the network level, and anti-fraud compares the two. A stable setup is built from both: a consistent fingerprint in an anti-detect browser and a separate mobile IP for each profile, for example from LTESpace plans.

More on this topic