What Is a Browser Fingerprint? Canvas, WebGL, Fonts, Time Zone and More

You clear your cookies, switch to a different IP, and a site still seems to know you've been there before. The usual explanation is browser fingerprinting: building an identifier from the characteristics your browser reveals while it loads a page. No single characteristic is unusual. Combined, they can be distinctive enough to recognise a device across visits.

Understanding fingerprinting is useful for two reasons. It explains what's happening to your privacy online, and if your team legitimately runs separate work environments (different clients, stores or brands), it tells you which signals need to stay consistent inside each one.

What a browser fingerprint is

Sites collect fingerprint data in two ways:

• Passively, from information every request already carries: your IP address and HTTP headers such as User-Agent and Accept-Language.
• Actively, by running JavaScript that queries browser APIs: screen size, time zone, graphics hardware, or asking the browser to draw something and hashing the result.

It helps to group the signals into three layers: network, device and browser.

Network-layer signals: IP, DNS, WebRTC and time zone

The common failure here is inconsistency: a US IP, a resolver at a Chinese ISP and a system clock on Beijing time. Our guide on how to check if a proxy IP is clean covers WebRTC and DNS leak tests step by step, and SOCKS5 vs HTTP proxies explains how the protocol affects where DNS is resolved.

Device-layer signals: Canvas, WebGL, audio, fonts, screen and hardware

• Canvas. A script asks the browser to render text and shapes using the Canvas API, then reads back the pixel data and hashes it. Differences in GPU, drivers, operating system and font rendering produce slightly different output.
• WebGL. Also rendering-based, and it can additionally expose the graphics vendor and renderer strings, for example a specific integrated GPU.
• Audio. The Web Audio API processes a generated signal; tiny differences in the output vary between devices.
• Fonts. By measuring how wide text renders in different font families, a script can infer which fonts are installed. A "US user" with a full set of Chinese system fonts stands out.
• Screen. Resolution, available area, color depth and device pixel ratio.
• Hardware hints. Logical CPU core count (navigator.hardwareConcurrency), a rounded memory figure (navigator.deviceMemory, in Chromium browsers), and touch support.

All of these APIs exist for legitimate reasons, and MDN documents each of them. Fingerprinting is a side effect of how much they expose.

Browser-layer signals: user agent, Client Hints, language and extensions

• User agent. The browser name, version and operating system string.
• User-Agent Client Hints. Chromium-based browsers also expose brand, version and platform through Sec-CH-UA request headers and the navigator.userAgentData interface. These need to agree with the user agent string.
• Language. The Accept-Language header and the language list JavaScript reads should match each other and plausibly match the IP's region.
• Extensions. Some extensions modify pages or inject elements, which makes them indirectly detectable.
• Feature support. Which APIs exist, whether cookies are enabled, and similar flags add a few more bits.

What anti-detect browsers can and can't change

AdsPower ships two engines, Chrome-based SunBrowser and Firefox-based FlowerBrowser. GoLogin offers a desktop app plus a cloud browser. The core job of tools like these is the same: give each profile its own internally consistent fingerprint and keep its cookies and storage isolated from every other profile.

The right-hand column matters most. Platforms also link accounts through account data, payments and behaviour, and no browser changes any of that. An anti-detect browser solves a narrow problem: keeping separate work environments on one computer from bleeding into each other. It does not make rule-breaking safe, and no vendor can honestly promise a profile is "undetectable." If you're comparing tools, see how to choose an anti-detect browser.

One more principle: consistency beats randomness. A profile whose settings contradict each other, such as a Windows platform with macOS-only fonts or a time zone that doesn't match the IP, is more conspicuous than an ordinary one. Good defaults that agree with the proxy are usually better than aggressive spoofing.

How to test your own fingerprint

You don't need special tools to see your own fingerprint.

1. Run a leak and fingerprint check on a public test site such as BrowserLeaks. It breaks results down by category: IP, WebRTC, DNS, Canvas, WebGL, fonts and more.
2. Check overall consistency with an open-source project such as CreepJS, which highlights values that look modified or contradict each other.
3. Cross-check the essentials yourself. IP country, time zone, browser language and DNS resolver location should all tell the same story.
4. Compare two profiles. In an anti-detect browser, create two profiles, run the same tests in each, and confirm that values like the Canvas and WebGL hashes differ between them while each profile remains internally plausible.

For hands-on setup, the AdsPower tutorial and GoLogin tutorial both walk through creating a profile, attaching a proxy and running these first checks.

The short version

A browser fingerprint is the sum of network, device and browser signals. Whether your goal is privacy or cleanly separated work environments, aim for profiles that are realistic, internally consistent and isolated from each other. Then remember the limits: account details, payments and behaviour identify you too, and the only reliable answer there is to operate within each platform's rules.