Fingerprinting

What is Device Fingerprint?

A device fingerprint is an identifier built from the hardware and software traits a device exposes: screen geometry, GPU and driver strings, CPU core count, memory, timezone, languages, installed fonts, audio and canvas rendering, and touch support. Hashed together, those values are stable enough to recognise a returning device across sessions without any cookie.

Collection runs in JavaScript on page load. A script reads navigator properties such as hardwareConcurrency, deviceMemory, maxTouchPoints, platform and languages, then screen dimensions and colour depth, devicePixelRatio, the Intl timezone, the WebGL unmasked vendor and renderer strings, an AudioContext output and a canvas raster. It probes installed fonts by measuring rendered text width against a fallback face. On the request side the server also reads Client Hints headers like Sec-CH-UA-Platform and Sec-CH-UA-Mobile. The collector hashes all of that into a visitor identifier and matches it against stored sessions.

Scoring depends on internal agreement far more than on rarity. A client that reports iOS in its User-Agent while showing zero touch points, a desktop GPU renderer string behind ANGLE and a devicePixelRatio of 1 reads as a desktop browser wearing an iOS header rather than as an unusual phone. The same logic runs across layers: a Europe/Berlin timezone with a Brazilian exit IP, or a mobile Client Hint arriving from a hosting ASN. Real devices are dull and consistent, and that consistency is what gets measured.

A proxy changes the network path and nothing above it. Route a browser through a mobile exit and the site sees a carrier ASN with an IP that belongs to real subscriber space, while the canvas hash, GPU strings and font list still describe the machine in front of you. Antidetect browsers exist to close that gap by holding one coherent set of device values per profile, so a profile presents as the same device every time it comes back.

Linkage is the practical risk. Ten accounts on ten different IPs that share one device fingerprint are ten accounts on one device, and platforms act on that reading when they suspend the whole cluster at once. Over-correction fails in the other direction. A profile whose fingerprint changes on every page load, or whose combination of GPU, fonts and screen size no other device on the internet reports, stands out as sharply as a duplicate does, and unstable values also break the site features that cache per device.

Where you meet it

You meet device fingerprinting when a ban follows you onto a fresh IP, or when a signup flow challenges a profile whose network signals look clean. It forces a choice between running a separate antidetect profile per identity and accepting that the accounts are linked to one machine. Before blaming the proxy, open a fingerprint-inspection page through it and read what the browser reports; the contradiction usually lives in the browser, not the exit.

Common questions

Does a proxy change my device fingerprint?

No. A proxy changes the IP address and the network path a request takes. Every device value comes from the browser and the machine running it, so the canvas hash, GPU strings, fonts and screen size are identical before and after you connect through any proxy.

What is the difference between a device fingerprint and a browser fingerprint?

A device fingerprint leans on hardware and operating system traits, such as GPU, CPU cores, screen and audio stack, which persist across browsers on the same machine. A browser fingerprint adds browser-specific state like extensions, plugins and settings. In web tracking the two overlap heavily and vendors often use the terms interchangeably.

Can I stop device fingerprinting?

You can reduce it. Browsers with anti-fingerprinting modes normalise or block the highest-entropy sources, and locked-down profiles report less. Blocking is itself visible, since a browser reporting no WebGL renderer and no fonts joins a small, distinctive group. Consistency usually works better than removal.

Related terms

Browser Fingerprint
A browser fingerprint is an identifier derived from the properties your browser exposes - user agent, screen and window dimensions, timezone, language, installed fonts, canvas and WebGL rendering output, audio stack behaviour, hardware concurrency. Combined, these values are often unique enough to recognise the same browser across sessions and sites without any cookie.
Mobile Proxy
A mobile proxy routes traffic through an IP address assigned by a cellular carrier, so requests appear to come from a handset or modem on a 4G or 5G network. Carriers share each public address among many subscribers, which gives mobile IPs a reputation that anti-bot systems are reluctant to block.
TLS Fingerprint
A TLS fingerprint is an identifier derived from the ClientHello a client sends when it opens an HTTPS connection: the TLS version offered, the ordered cipher suite list, the extension list, supported elliptic curves and signature algorithms. JA3 and JA4 are the common encodings of it. Different HTTP clients and browsers produce visibly different values.
JA3
JA3 is a TLS client fingerprinting method that reads five fields from the ClientHello, joins their decimal values into a single string and hashes it with MD5. The fields are TLS version, cipher suites, extensions, supported elliptic curves and EC point formats. The 32-character result groups clients by TLS library and configuration.
JA4
JA4 is the TLS client fingerprint in the JA4+ family published by FoxIO, designed to replace JA3. Rather than one opaque MD5, it produces a partly readable string: a ten-character prefix describing transport, TLS version, SNI, cipher and extension counts and ALPN, followed by two truncated SHA-256 digests of the sorted cipher and extension lists.
P0F
p0f is a passive OS fingerprinting tool that identifies the system behind a connection by watching traffic rather than probing it. It reads TCP SYN packets for initial TTL, window size, MSS, the order of TCP options and a set of quirk flags, then matches them against a signature database. It sends nothing to the host it identifies.
Canvas Fingerprint
Canvas fingerprinting draws hidden text and shapes into an HTML5 canvas, reads the pixels back with toDataURL or getImageData, and hashes them. The exact output varies with GPU, graphics driver, font rendering and anti-aliasing, so the hash stays stable for one device and browser build while differing between machines.
WebGL Fingerprint
A WebGL fingerprint is an identifier derived from how a browser's GPU and graphics driver render 3D content. Sites read the renderer and vendor strings the driver reports, then hash the pixels of a small scene drawn off-screen. Capability limits from the context add more. The result stays stable across sessions and changes only when the hardware or driver does.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.

View pricing Browse the glossary