Log in
Antifraud & trust

Browser Fingerprint: How It Works and Where It Is Used

Browser fingerprint: how a digital device fingerprint works

A browser fingerprint is a digital fingerprint of a device: a set of browser and system parameters that lets a website recognise a visitor without cookies and without a login. Each parameter on its own is shared by millions of people, but the combination is close to unique. In 2026 the fingerprint is one of the main anti-fraud tools: platforms use it to link accounts to each other, tell people from bots and notice that several “different” users sit behind one computer.

The word fingerprint also means the finger scan that unlocks a phone. That is a different technology: the biometric template stays on the device and is never sent to websites. This article is only about the digital fingerprint of a device and browser.

What a device fingerprint contains

A website collects the fingerprint with a script while the page loads. The visitor sees nothing and no permission is asked. A fingerprint usually includes:

  • the User-Agent — browser, its version and the operating system;
  • screen resolution, colour depth and scaling;
  • time zone, interface language and the list of preferred languages;
  • the set of installed fonts;
  • Canvas — how the browser draws a hidden image: the result depends on the graphics card, the driver and font smoothing;
  • WebGL — the graphics card model and how it renders;
  • AudioContext — how the device processes a sound signal;
  • the number of CPU cores and the amount of memory the browser reports;
  • connected cameras and microphones, touch screen support;
  • WebRTC — which can reveal the local and the real IP past the proxy.

There is also a network fingerprint. It is taken not by a script but from the connection itself: how the TLS handshake is built and what the TCP packets look like. These signals are also compared with what the browser claims to be.

How a browser fingerprint works

The parameters are turned into an identifier — a hash or a probabilistic model. A hash changes with any single change, so modern systems compare fingerprints loosely: if most signals match, it is most likely the same device. A browser update or a new monitor does not make a person “new”.

The fingerprint then does two jobs:

  • recognition — the same fingerprint on another account means the accounts are probably run by one person;
  • consistency check — the parameters are compared with each other and with the network. The browser claims Windows while the graphics card is typical for a phone; the time zone is Moscow while the IP is American — such contradictions give away a spoofed setup.

The second job matters more than the first. A unique fingerprint that is internally consistent looks like an ordinary user. A fingerprint put together from details that do not fit raises suspicion even the first time it is seen.

Where browser fingerprinting is used

  • banks and payment systems — protection against account takeover and fraudulent payments;
  • ad accounts — finding linked accounts after one of them is banned;
  • social networks and marketplaces — limiting multi-accounting;
  • bot protection — telling an automated browser from a real one;
  • analytics and advertising — recognising a visitor when cookies are deleted or blocked.

That is why the fingerprint matters to anyone who runs several accounts: media buyers, SMM specialists and teams that advertise in different countries.

Fingerprint and IP address: two levels of one check

The fingerprint describes the device, the IP address describes the network. Anti-fraud looks at both at once, and a mistake on either level undoes the work on the other:

  • change the IP and keep the same fingerprint — the accounts are still linked through the device;
  • change the fingerprint in an anti-detect browser and keep one IP for all profiles — the accounts are linked through the network;
  • take an IP from one country and leave the time zone and language of another in the profile — the contradiction is visible at once.

A mobile IP covers the network level: the address belongs to a carrier and is shared by many subscribers, so platforms treat it with care. More on this in how websites detect mobile proxies. But a mobile IP does not change the fingerprint, and an anti-detect browser does not change the IP. They only work together.

How to align the fingerprint with mobile proxies

  1. One profile, one proxy channel. An address is never shared between profiles.
  2. The time zone, language and geolocation of the profile match the country of the IP. This pairing is covered in mobile proxies and time zone in anti-fraud.
  3. WebRTC does not reveal the real address: how to disable WebRTC.
  4. The fingerprint is plausible: a common screen resolution, a graphics card typical for the claimed system, an ordinary set of fonts.
  5. A new profile does not start with the target action but gets a short history first — browser profile warm-up.

The result can be checked on fingerprint test sites: they show what a website sees and flag contradictions between parameters. Run the check through the same proxy the profile will work with.

Summary

A browser fingerprint is the digital fingerprint of a device that websites use to recognise a visitor and check whether the setup is plausible. The fingerprint covers the device level, the IP address covers the network level, and anti-fraud compares the two. A stable setup is built from both: a consistent fingerprint in an anti-detect browser and a separate mobile IP for each profile, for example from LTESpace plans.

More on this topic