Browser Fingerprinting: Why Incognito Can't Hide You

You open an incognito window because some browsing is nobody’s business but yours. Cookies off, VPN on, the little spy-guy icon smirking at you. You feel invisible. You are not. The site knew it was you before the page finished loading, and it will know you again tomorrow, on a different browser, on a different network, with every cookie wiped. The strange part is that there is nothing on your computer to delete, because the thing identifying you is your computer.

This article walks through how that works: how a site recognizes a machine it has never stored anything on, why the privacy tricks you have heard of barely dent it, and the twist almost nobody sees coming, where everything you do to hide can make you easier to find.

What is browser fingerprinting?

Browser fingerprinting is a way for a website to recognize your device without storing anything on it. Rather than asking your browser to keep a file, it reads dozens of small traits your browser already broadcasts to render pages, then combines them into one stable identifier. Because nothing lives on your machine, there is nothing for you to clear.

Start with the thing you think protects you: the cookie. A cookie is a little file the site asks your browser to keep, like a name tag clipped to your shirt. Handy for them, but you are in control. You can refuse it, let it expire, or peel it off. A fingerprint works nothing like that. The site stores nothing and instead recognizes how your browser is built, the way you would know a friend by their face, their height, the way they walk. You can change your shirt all day. You still have the same face.

Cookie A name tag clipped to your shirt

A little file the site asks your browser to keep. You can refuse it, let it expire, or clear it. Peel off the tag and it is gone.

STATEFUL · YOU CAN DELETE IT

Fingerprint Your face, your height, your walk

The site stores nothing. It reads how your browser is built and recognizes it next time. Change your shirt all day; you keep the same face.

STATELESS · NOTHING TO DELETE

That single difference, stateful versus stateless, is why clearing cookies feels like privacy but does almost nothing against a fingerprint. The W3C’s own guidance treats this kind of stateless recognition as a privacy threat precisely because the user has no obvious control over it.

Why incognito and a VPN don’t hide you

The usual privacy moves do so little because they were never built for this fight. Incognito wipes local storage when you close the window, so it hides the tab from the next person who picks up your laptop. It was never designed to hide you from a website. Your fonts, your screen, your graphics chip, and your timezone do not change when you go private, and those are exactly what a fingerprint reads.

A VPN feels like the whole game because it swaps your IP address. The catch is that fingerprinting barely glances at your IP. It reads traits a VPN never touches, and it can even punish you for using one. If your VPN says you are in France while your browser clock still says New York, you have handed over a mismatch that makes your device more distinctive, not less.

Incognito

Protects Wipes local storage when you close the window.

Still exposed Your fonts, screen, GPU, and timezone are unchanged. It hides the tab from the next person on your laptop, not from the website.

Clear cookies

Protects Deletes the files the site stored on you.

Still exposed A fingerprint stores nothing, so there is nothing to clear. The site re-recognizes the same machine on the next page load.

VPN

Protects Swaps the IP address you connect from.

Still exposed Fingerprinting barely glances at your IP. Worse, a VPN that says France while your clock says New York hands over a mismatch that makes you rarer.

FingerprintJS makes the point in five seconds: its demo hands you a visitor ID, and that ID stays the same when you reopen the page in incognito. Same machine, same number, no cookie involved.

How do weak signals add up to name one person?

The math is simpler than it sounds, and it rests on a property called entropy. There are about eight billion people. To single out any one of them, you need roughly thirty-three yes-or-no answers, because two raised to the 33rd power lands near eight billion. Thirty-three bits, and you are named.

No single trait gets you there. Your timezone might narrow the planet to a few percent. Your screen size trims it further. Your exact list of installed fonts trims it again. Not one of these is rare on its own, since millions of people share each. But every answer multiplies with the last, and it does not take many before the only person still standing is you. The classic measurement, Eckersley’s 2010 Panopticlick study, found that 83.6% of browsers were instantly unique once you stacked enough of these signals together.

≈ 33 bits

is all it takes to single out one person from 8 billion. That is just 33 yes-or-no answers, because log2(8,000,000,000) ≈ 33.

Timezone ~3 bits

+

Screen size ~5 bits

+

User-agent ~10 bits

+

Installed fonts ~14 bits

=

Over 33 bits = 1 person

None of these is rare by itself; millions share each. Stacked, they multiply past the line. Twenty or thirty weak signals clear it with room to spare.

Canvas, WebGL, and audio: the signals that give you away

The strongest signals come from asking your browser to make something, then reading back the result. The headline technique is canvas fingerprinting. The site quietly tells your browser to draw a line of text off-screen, where you will never see it, then reads back the exact pixels. Your graphics chip, your drivers, and the way your system smooths the edges of letters all leave tiny differences. The same sentence renders a little differently on your machine than on mine.

WebGL pulls the same trick with 3D graphics and coughs up your GPU by name. There is even an audio version: the browser runs a tone through its sound engine and reads back the numbers. No microphone, no sound ever plays, just the math your particular stack produces. These rendering signals are powerful enough that researchers track them across the whole web. Acar’s 2014 study found canvas fingerprinting on 5.5% of the top 100,000 sites, and the 2016 one-million-site measurement counted it on 14,371 sites along with the newer audio vector.

Canvas Draw a line of text off-screen

Reads back the exact pixels. Your GPU, drivers, and anti-aliasing render the same sentence a little differently than mine.

WebGL Render a 3D shape

Coughs up your GPU by name and the quirks of how it draws in 3D, a second rendering signature on top of canvas.

Audio Run a tone through the sound engine

No microphone, no sound ever plays. The browser just reads back the numbers your particular audio stack produces.

Browser fingerprinting vs device fingerprinting

People search both terms, and they overlap more than they differ. Browser fingerprinting is the narrower idea: the traits a specific browser exposes, like its canvas output, fonts, and user-agent. Device fingerprinting is the broader goal of recognizing the underlying machine, which usually means combining those browser traits with lower-level signals like the network handshake.

The practical line is which one survives a browser switch. A pure browser fingerprint can change if you move from Chrome to Firefox. A device fingerprint aims to follow you across both, which is why the systems that care most about recognition, the anti-fraud ones, reach past the browser into the network layer.

Can blocking JavaScript stop fingerprinting?

Killing JavaScript, blocking third-party trackers, and installing extensions is a reasonable instinct, and it barely helps. There are two reasons. First, plenty of fingerprinting runs first-party, served straight from the site you came to visit, so a third-party blocker never sees it. Second, a big chunk of your fingerprint gets collected before any JavaScript runs at all.

Every request your browser sends carries a stack of headers, in a particular order, with particular values, and that pattern alone is identifying. Underneath that, the encrypted handshake your browser makes with each server has its own signature: the precise order it lists its ciphers and extensions. Security people hash that order and call it JA3. Your browser broadcasts it on every connection, and there is no setting to switch it off.

Connect Header order

→

TLS handshake Cipher order = JA3

→

Headers Values + sequence

→

JS runs Too late to hide

▲ Fingerprint already taken here

The TLS handshake lists its ciphers in a precise order. Hashed, that order is called JA3, and your browser broadcasts it on every connection. There is no setting to switch it off.

My favorite example of how deep this goes lives in Chrome. Every time you click “never translate this language,” that choice gets quietly tacked onto a header your browser sends everywhere. Do it for a handful of languages and you have assembled a custom, ordered list almost nobody else has. You were trying to dismiss a translate popup. You signed a unique identifier instead.

Why does trying to hide make you easier to find?

Here is the twist, and it wrecks everyone’s instincts: the harder you try to hide, the easier you often become to find. Install an anti-fingerprint extension that scrambles your canvas, and it feels like a win until you notice it scrambles the same way every time, which is a brand-new signal unique to you. Harden Firefox with fifty config tweaks off a forum, and you might be the only person alive running that exact combination.

The rule underneath it is that anonymity lives in the average. You do not vanish by being weird. You vanish by being boring, by looking like a million other people. A fingerprint that is one hundred percent unique is not armor. It is a neon sign with your name on it.

RARER ↑

Anti-fingerprint extension

Scrambles your canvas, but the same way every time. That stable scramble is a brand-new signal unique to you.

RARER ↑

50 Firefox config tweaks

Copied off a forum, that exact combination might make you the only person alive running it.

RARER ↑

An obscure privacy browser

Almost nobody runs what you run, so you stand out for the simple reason that you are rare.

100% unique ≠ armor Anonymity lives in the average. A fully unique fingerprint is a neon sign with your name on it.

How do you defend against browser fingerprinting?

The people who do this well stop chasing invisibility and pick one of two real strategies. One is to blend: run a browser engineered so every user looks identical, one big indistinguishable crowd. That is Tor, and Mullvad. The other is to lie constantly: feed every site slightly different fake values so there is nothing stable to grab. That is Brave, reshuffling your canvas each session. Both work.

Standardize Blend in

Run a browser tuned so every user looks the same. You vanish into one big indistinguishable crowd.

Tor · Mullvad

Randomize Lie constantly

Feed every site slightly different fake values each session, so there is nothing stable to grab onto.

Brave

✕ Fails Cranking every privacy dial to maximum, which turns you into the most memorable person in the room.

For most people that means letting a browser carry the load, and the right pick depends on how much site breakage you can tolerate. None of these is a magic switch, and the field shifts every few months, so treat this as a mid-2026 snapshot.

The defenses are real and improving. In November 2025, Firefox 145 shipped protections Mozilla says cut the share of trackable users by about half, leaving roughly one in five still uniquely fingerprintable. That figure is Mozilla’s own, and it is a fraction, not a cure.

Who uses browser fingerprinting, and is it legal?

It is easy to assume everyone fingerprinting you is a villain, but most of it today is not ad tracking. The dominant production use is fraud and bot defense: the systems that notice when one machine quietly opens a thousand accounts, or when a login lands from a device nobody has ever seen. That is fingerprinting too, and it is probably running on your bank right now.

The big one Fraud & bot defense

Spotting when one machine quietly opens a thousand accounts, or a login lands from a device nobody has seen. This is the dominant use, and it is probably running on your bank right now.

Contested Advertising

The legally shaky use. Shaky enough that the UK regulator called Google's 2025 move to permit advertiser fingerprinting "irresponsible."

The contested use is advertising, where the legal ground is far shakier. EU and UK regulators treat fingerprinting as falling under consent rules, since users cannot easily see it or switch it off. In December 2024 the UK’s data regulator responded to Google permitting advertiser fingerprinting from February 2025 by calling the change “irresponsible” and “not a fair means of tracking users online.” Security and fraud uses tend to rest on firmer footing; cross-site ad tracking is the highest-risk, least defensible end.

How can you test your own fingerprint?

Go see it for yourself, because the lesson lands harder on your own machine. Run the EFF’s Cover Your Tracks test and look at your bits of identifying information. The result you want is not a clean, empty profile. It is the word “randomized.” You are aiming to be noise, or to look like the herd, not to be spotless and one of a kind.

Then open the FingerprintJS demo, copy the visitor ID it hands you, and reopen it in an incognito window. Watch the number stay exactly the same. For a per-trait breakdown of which signals give you away, AmIUnique shows the entropy of each one. None of it requires installing anything, and it turns an abstract idea into a number you can watch refuse to change.

The bottom line

You cannot delete your way out of being recognized, because there is nothing stored to delete. The thing identifying you is the machine you are reading this on, read from the outside, fresh every visit. That is what makes browser fingerprinting so durable and so easy to underestimate.

The takeaway is not that you are doomed, and it is not a checklist of six extensions to install tonight. What you actually get to choose is which crowd you disappear into. So quit trying to be nobody, and get good at looking like everybody. For the full walkthrough, with every signal animated, watch the companion video below.