What is Browser Fingerprint?

A fingerprint is assembled from values a page can read without asking permission. JavaScript reports navigator properties, screen and viewport dimensions, device pixel ratio, timezone offset, the language list, hardware concurrency and an approximation of how much memory the device claims. Fonts are detected by measuring rendered text width with candidate families applied and watching which measurements change. Any single value is common. The combination carries enough entropy to pick one browser out of a very large population, which the EFF's Cover Your Tracks project illustrates by scoring how rare a visitor's configuration is.

The strongest signals come from asking the machine to render something. A canvas draws text and shapes offscreen and the page hashes the resulting pixels; GPU, driver version, font rasteriser and antialiasing settings each shift the output a little, so the hash stays stable on one device and differs across devices. WebGL adds vendor and renderer strings along with the result of drawing a shaded scene. An AudioContext run through an oscillator and a compressor yields a comparable value from the audio stack. None of this triggers a permission prompt.

Detection systems care less about any single value than about whether the set agrees with itself. A user agent claiming Safari on an iPhone alongside Chrome-only APIs, a timezone in Europe behind a US exit address, a WebGL renderer reporting SwiftShader or llvmpipe where a consumer GPU belongs, a resolution no shipping device uses - each contradiction is cheap to test and awkward to fake. Headless runtimes add markers of their own unless they are patched, and patching one property while leaving the related ones untouched creates a fresh contradiction.

A proxy changes the network layer and leaves all of this untouched. Two accounts driven from the same browser profile share a fingerprint even on separate mobile IPs, and a site storing that hash links them whatever the routing says. Antidetect browsers exist for this reason. Each profile pins a coherent set of values and reuses them, so an identity looks like one ordinary device coming back rather than a new machine every session. Randomising everything per request is worse than pinning, because a configuration nobody has ever seen is itself a signal.