Quick answer
Browser fingerprinting identifies a browser by combining many attributes it exposes, such as user agent, screen size, time zone, languages, installed fonts and how it renders canvas graphics, into an identifier that survives clearing cookies.
What is browser fingerprinting?
Browser fingerprinting recognises a browser without storing anything in it. A script reads dozens of small details the browser exposes and combines them. Each detail is shared by millions of people; together they can be rare enough to pick one browser out of a crowd, and the result stays the same after cookies are cleared.
The signals it uses
| Signal | Example | How stable |
|---|---|---|
| User agent and client hints | Browser, version, operating system | Changes with updates |
| Screen | Resolution, pixel ratio, colour depth | Stable per device |
| Locale | Time zone, languages | Stable |
| Fonts | Which fonts are installed | Fairly stable |
| Canvas and WebGL | Tiny differences in how graphics are drawn | Stable per device and driver |
| Audio | How the audio stack processes a test signal | Stable |
| Hardware | CPU cores, memory class, touch support | Stable |
Canvas, font, audio and hardware probes are the active techniques: they exist mainly to tell browsers apart.
Fingerprint vs cookie vs server-side hash
| Cookie | Browser fingerprint | Coarse server-side hash | |
|---|---|---|---|
| Stored in the browser | Yes | No | No |
| User can reset it | Clear cookies | Hard | Change network or browser |
| Works across sites | Only third-party cookies | Yes, if the same script runs everywhere | No, with a per-site salt |
| Typical use | Logins, preferences, ads | Fraud detection, cross-site tracking | Counting visitors without cookies |
How browsers push back
Safari and Firefox block many known fingerprinting scripts and reduce the detail they expose; Brave randomises some values per site; Chrome is reducing the detail in the user agent string. For a person, the most practical defence is a common, up-to-date browser with tracking protection on.
What analytics actually needs
Counting visitors does not require a fingerprint. Ask an analytics vendor which signals it reads, whether identifiers work across sites, and how long they last.
TapCub does not run client-side fingerprinting scripts: no canvas, font, audio or hardware probing. The website script writes no cookie and no local storage. The visitor ID is an HMAC of the IP address and user agent computed on the server with a site salt; the user agent drops version numbers and IPv6 addresses use only the first 64 bits. In strict privacy mode the salt rotates every day, so the same browser is a new visitor tomorrow. See cookieless analytics and hashing.
Was this explanation clear?
We use your answers to fix and expand this page.
Couldn’t send. Please try again in a minute.
Thanks for the feedback. We’ll use it to improve this page.You’ve already sent feedback on this page. Thanks.
Solutions Engineer
Covers SDKs, API integrations, and data implementation, with an emphasis on validation, system interoperability, and troubleshooting.