how to stop browser fingerprinting browser fingerprinting prevent browser fingerprinting

How to stop browser fingerprinting (and what actually works)

Adrian Maverick · · 10 min read

Short answer: you cannot stop browser fingerprinting completely, and no tool makes you invisible. What you can do is make your fingerprint either common (you look like a crowd of other users) or unstable (you look different every time), so it stops working as a long-term ID. In practice that means using a browser with built-in fingerprinting protection, turning it up to its stricter setting, and not stacking random extensions and tweaks on top.

Cookies were the old way to follow you around the web, and you can delete them. A fingerprint is different. It is built from what your browser and device already are, so there is nothing to delete. Mozilla puts it bluntly on its own Firefox page: fingerprinting "may still be used even if you clear cookies or browse privately."

Here is what a fingerprint is made of, what the browser makers themselves do about it, and the steps that actually reduce it.

What browser fingerprinting is

Browser fingerprinting is a way for a site, or a third-party script on that site, to recognize your browser by combining many small details about it. None of the details is unique on its own. Together they often are.

Firefox's documentation lists the kind of inputs used:

  • Your browser type and operating system
  • Screen resolution and device type
  • Installed fonts
  • Language and time zone settings
  • Hardware and graphics details
  • Your user agent, IP address, and the way your browser responds to certain scripts or APIs

Apple's WebKit team describes three layers: static device configuration such as built-in hardware, dynamic configuration such as your settings or plugged-in devices, and your browsing data, for example checking which sites you are logged in to. Some techniques go deeper. Canvas, WebGL and audio fingerprinting ask your browser to draw an image, render 3D graphics or process a sound, then read back the tiny differences your particular hardware and software produce.

The Tor Project names the two reasons this is worse than cookies. First, a script does not need your permission to collect any of it. Second, if one attribute or a combination of them is unique, your device can be tracked across sites without a single cookie being set.

Why "just hide everything" does not work

The instinct is to block or fake every value a site can read. The browser makers and the EFF all warn against doing that piecemeal.

  • Many values cannot be hidden without breaking the web. Pages need to know roughly how big your window is and which language to show. The Tor Project says some attributes, like the operating system and language, "cannot be completely hidden or spoofed."
  • Odd protections make you stand out. The EFF's Cover Your Tracks explains that your protections can themselves become part of your fingerprint, turning you into a "mystery user with a very specific combination of privacy protections installed."
  • Faking one value backfires. If you switch your user agent to claim you are on Chrome while everything else about your browser says Safari, the EFF notes you may be "the only browser out there identifying itself as Chrome but looking like Safari."

So the goal is not a perfect disguise. It is to be hard to single out, and that comes from two strategies that only work when the browser does them for everyone at once.

The two strategies that actually work

The EFF describes them plainly. To resist fingerprinting, your browser needs a fingerprint that is either:

  1. So common that a tracker cannot tell you apart from the crowd. This is the Tor Browser approach.
  2. Randomized so a tracker cannot tell it is you from one moment to the next. This is Brave's approach.

Here is how each browser maker says it handles it, in its own documentation.

Browser What its maker says it does about fingerprinting Default or opt-in
Tor Browser Puts users into a small number of "buckets": window sizes rounded to multiples of 200 x 100 pixels, letterboxing when you resize, a normalized user agent per platform, limited fonts and languages Default
Brave Randomizes fingerprintable values so you "look different to every site, each time you restart the browser," and blocks highly identifying APIs Default
Safari Only exposes web fonts and fonts that come with the operating system, not fonts you installed; keeps the user agent from changing with minor updates; "advanced tracking and fingerprinting protection" blocks connections to companies that use advanced fingerprinting Font and user agent limits by default; advanced protection is on by default in Private Browsing and can be switched on for all browsing
Firefox Blocks known fingerprinters through Enhanced Tracking Protection, adds protections for suspected fingerprinters, can randomize canvas readback; Resist Fingerprinting is a stricter mode Known-fingerprinter blocking by default; stricter protections in stricter modes
Chrome (Incognito) The EFF says Chrome "does not provide protection against trackers or fingerprinters in Incognito Mode" Not offered

How to reduce browser fingerprinting, step by step

Start with step 1. Most people only need steps 1 to 4.

  1. Check your fingerprint first. Open the EFF's Cover Your Tracks and run the test. It shows whether your browser has a unique fingerprint and which details give you away. Run it again after each change below so you can see what helped.
  2. Use a browser with fingerprinting protection built in. Built-in protection works because every user of that browser gets the same treatment, which is exactly what blending in or randomizing needs. Brave and Tor Browser do it by default. Safari and Firefox do it by default to a degree, with stronger options available.
  3. Turn it up.
    • Safari: turn on "Use advanced tracking and fingerprinting protection" for all browsing, not just private windows. Apple says some site features may be affected; if a page breaks, choose View > Reload Reducing Privacy Protections for that page.
    • Firefox: choose the stricter Enhanced Tracking Protection setting in Firefox's privacy settings. Mozilla says its protections are strengthened "in stricter privacy configurations," including Resist Fingerprinting.
    • Brave: leave Shields on. Aggressive mode applies more protections, with a higher chance of breaking sites.
  4. Stop adding extensions and tweaks to "fix" it. Each extra add-on, custom font or unusual setting is another detail that can make you rarer. The Tor Project goes further and recommends against installing add-ons in Tor Browser at all. Keep the browser close to its defaults plus its own protection setting.
  5. Do not fight Tor Browser's window size. It starts windows at sizes rounded to multiples of 200 x 100 pixels, and adds margins (letterboxing) when you maximize, so users stay in a few size groups. That is working as intended.
  6. Consider turning off JavaScript for sensitive browsing. The EFF says most trackers run on JavaScript and cannot gather much without it, and suggests a tool like NoScript in Firefox. The trade-off is real: disabling JavaScript "breaks a staggering amount of websites."
  7. Do not sign in where you do not need to. Fingerprinting is about recognizing you without knowing who you are. Logging in tells the site exactly who you are, and the Tor Project makes the same point about web forms: give your name or email and you are no longer anonymous to that site.

What does not stop fingerprinting

  • Incognito or private mode on its own. Private windows clear cookies and history when you close them. Your screen, fonts, hardware and settings stay the same, so your fingerprint stays the same. The exception is a browser that adds fingerprinting protection to private windows, as Safari does. More on what private mode does in is incognito mode really private.
  • Clearing cookies. Useful against cookie tracking, irrelevant to a fingerprint.
  • A VPN. A VPN changes the IP address sites see, and Firefox lists IP address as one of many fingerprint inputs. It does not change your browser, fonts, screen, graphics or settings, so the rest of the fingerprint is untouched. See what a VPN hides for the full picture.
  • Switching your user agent with an extension. As the EFF explains, a faked browser name that does not match everything else is a stronger signal, not a weaker one.
  • The old Do Not Track setting. Apple removed it from Safari because it "ironically was used as a fingerprinting vector," adding uniqueness to the people who turned it on.

Be honest about the limit

Every source here says the same thing in its own words. The Tor Project says "it is impossible to have perfect anonymity, even with Tor," and calls it "practically impossible to make all Tor Browser users identical." The EFF says completely blocking trackers is difficult even with a full tracker blocker, and adds that "privacy protection does not have to be perfect to make a big difference." Brave's approach exists because hiding every value is not workable.

So aim for "hard to track over time," not "invisible." A fingerprint that matches many other people, or that changes every session, is not much use to an advertiser trying to build a profile of you.

Where Secria fits

Fingerprinting is a browser problem, so the fix is mostly in your browser. Two other kinds of tracking sit right next to it, and those are where Secria helps.

Your IP address is one of the details sites collect. Secria VPN hides your IP address from the sites you visit, uses post-quantum encryption on every connection, runs on RAM-only servers, and keeps no activity logs: we do not record browsing, DNS queries or traffic contents. Pair it with a browser that resists fingerprinting, since the VPN does not change the fingerprint itself.

Email is the other quiet tracker, through tracking pixels. In Secria Mail, tracking pixels are removed automatically and senders never see your IP address. It is free, with no phone number and no card. You can sign up here.

FAQ

Can you completely stop browser fingerprinting? No. Sites need some information about your browser to show pages correctly, and that information can always be combined. You can make your fingerprint common or randomized so it is far less useful for tracking you over time.

Does incognito mode stop fingerprinting? Not by itself. Private windows delete cookies and history, but your device and browser look the same to sites. Safari turns on advanced fingerprinting protection in Private Browsing by default; the EFF says Chrome's Incognito offers no fingerprinting protection.

Does a VPN stop browser fingerprinting? No. A VPN changes the IP address sites see, which is one input, but your browser, fonts, screen and hardware details stay exactly the same.

Which browser is best against fingerprinting? Tor Browser and Brave have the strongest default protections, using opposite strategies: Tor makes users look alike, Brave makes each session look different. Safari and Firefox also protect against known fingerprinters by default and offer stronger settings.

Do anti-fingerprinting extensions help? Often not. The EFF warns that extra protections can become part of your fingerprint and that faking a single value can make you more identifiable. A browser's built-in protection is the safer choice.

How do I check my browser fingerprint? Run the EFF's free Cover Your Tracks test. It shows whether your fingerprint is unique and which details stand out.

Sources

Secria fact-checks every post against primary sources. Spotted something wrong or out of date? Email hq@secria.me and we will correct it.

Back to all posts