How to Check My Browser Fingerprint (and Read the Results)

Checking your browser fingerprint takes about two minutes and costs nothing. Understanding what you are looking at takes a little longer — and that is the part almost nobody explains. Most guides point you at a testing site, show a screenshot of a hash, and call it a day. Then you are left staring at a wall of values like ANGLE (NVIDIA, NVIDIA GeForce GTX 1660 Direct3D11 vs_5_0 ps_5_0) with no idea whether that is good, bad, or meaningless.

This guide fixes that. I will walk you through the tools worth using, the signals that actually matter, how to read each one, and — because this is where most people trip up — how to tell the difference between a fingerprint that is merely unique and one that is actively suspicious. If you run multiple accounts or browser profiles for work, there is a dedicated section on checking each profile properly, because that is a different exercise from checking your personal browser.

First, know what you are checking

A browser fingerprint is the combination of attributes your browser hands over — voluntarily — to any page that asks. No cookies, no login, no permission prompt. Plain JavaScript can read your screen resolution, your installed fonts, your GPU model, your timezone, the number of CPU cores you have, and the exact way your machine renders a hidden canvas image or processes a synthetic audio signal. Individually, each value is mundane. Together they form a signature that is frequently unique to you among millions of visitors. The Wikipedia overview of device fingerprinting is a solid primer if you want the academic background, but the practical properties are what matter here:

• It survives cookie clearing. Delete every cookie you have; your fingerprint is identical afterwards.
• It survives incognito mode. A private window gives you a fresh cookie jar, not fresh hardware. Your GPU, fonts and screen come along for the ride.
• It is passive. There is no consent dialog. If a page can run JavaScript, it can fingerprint you, and you will never see it happen.
• It is probabilistic. A site does not need certainty. If your combination of attributes matches one seen yesterday with 95% confidence, that is more than enough to link two sessions — or two accounts.

Researchers usually talk about fingerprints in terms of entropy — bits of identifying information. You need roughly 33 bits to single out one person among everyone on Earth. A typical desktop browser leaks well past that threshold from canvas, WebGL, fonts and screen data alone, which is why the Electronic Frontier Foundation has been ringing this bell since 2010.

Fingerprint vs cookies vs IP address

People conflate three separate tracking layers, and it muddies every conversation about privacy. Cookies are stored state — data a site saved in your browser, which you can inspect and delete. Your IP address is network identity — a VPN or proxy swaps it in one click. Your fingerprint is device identity — the physical and software characteristics of the machine itself, and no VPN touches it. That is exactly why a VPN alone does far less than most people assume; if that distinction is fuzzy, the breakdown in Antidetect Browser vs VPN Difference: What Actually Matters covers it properly. A good fingerprint checker will show you all three layers side by side, which is where mismatches between them become visible — and mismatches, as we will see, are what actually get people flagged.

The tools I actually use to check my browser fingerprint

No single site shows everything well. Each of these has a distinct strength, and I use all of them depending on the question I am trying to answer.

Cover Your Tracks (EFF)

Cover Your Tracks is run by the Electronic Frontier Foundation, a nonprofit, which makes it the least conflicted tester on this list. Click one button and it reports whether your browser blocks tracking ads, blocks invisible trackers, and — the interesting part — whether your fingerprint is unique among the browsers it has recently tested. It expresses the result in bits of identifying information per attribute, so it is the best tool for building intuition about which of your attributes give you away. A value shared by one in two browsers contributes one bit; a canvas hash shared by one in 200,000 contributes about seventeen and a half. One caveat: its comparison sample skews toward privacy-conscious visitors, so the raw percentages are not representative of the general web population. Use it for the concept, not the exact numbers.

BrowserLeaks

BrowserLeaks takes the opposite approach: one dedicated page per signal. There is a canvas page, a WebGL page, a fonts page, a WebRTC page, a timezone page, a client-hints page, and a dozen more. When I want to inspect a single signal closely — say, verify exactly what WebGL renderer string a profile reports, or whether WebRTC is leaking a real IP behind a proxy — this is where I go. It gives you raw values and hashes with no editorializing. The WebRTC leak test alone justifies bookmarking it.

CreepJS

CreepJS is an open-source project (search for it on GitHub) and it is the most aggressive tester publicly available. It was built specifically to detect lies — places where a browser claims one thing while low-level behavior proves another. It cross-checks your user agent against your actual JavaScript engine quirks, your claimed platform against your font rendering, your reported GPU against your canvas output, and it assigns a trust score with explicit lie flags. If you use any privacy extension, user-agent switcher, or antidetect tool, run CreepJS against it. It is brutally honest, and that is the point: anything CreepJS catches, a commercial bot-detection vendor can catch too.

AmIUnique

AmIUnique is a long-running research project that shows, for each attribute, what percentage of their dataset shares your value. It is the nicest way to see rarity at a glance — you might discover your screen resolution is common but your font list puts you in a 0.1% bucket. Like the EFF tool, its dataset skews technical, so treat percentages as directional.

Your own DevTools

Finally, do not underestimate the console. Press F12 on any page and check the raw values yourself:

• navigator.userAgent — what your browser claims to be
• navigator.webdriver — must be false; true screams automation
• navigator.hardwareConcurrency and navigator.deviceMemory — your reported cores and RAM
• Intl.DateTimeFormat().resolvedOptions().timeZone — your JavaScript-visible timezone
• screen.width, screen.height, screen.availHeight, devicePixelRatio — your reported display

Thirty seconds in the console is often the fastest sanity check when a testing site reports something strange.

How to read the results, signal by signal

This is the section most guides skip. Here is what each major signal means and what a healthy reading looks like.

User agent and client hints

The user agent string is the oldest identifier, and Chromium has deliberately frozen and reduced it in recent years, moving detail into client hints — structured headers like Sec-CH-UA-Platform and Sec-CH-UA-Full-Version-List that sites must request explicitly. When you check your fingerprint, look at both. The single most important reading: do they agree with each other and with everything else? A user agent claiming Windows 10 alongside navigator.platform reporting Linux x86_64 is a contradiction no real browser produces, and it is exactly the class of mismatch detection vendors hunt for.

Canvas fingerprint

The canvas technique draws hidden text and shapes using the Canvas API, reads the pixels back, and hashes them. The result differs subtly across machines because it depends on your GPU, graphics driver, operating system, anti-aliasing and font-rendering stack. Two things to check. First, the hash itself — testing sites will tell you how common it is; a hash shared by thousands of same-model laptops is unremarkable. Second, and more important: stability. Reload the test three times. On a real machine the hash is identical every time. If it changes on every reload, something is injecting random noise into your canvas — a privacy extension, usually — and a per-reload-random canvas is itself a detectable tell, because real hardware does not do that.

WebGL and your GPU

The WebGL renderer string is the most information-dense single value in the whole fingerprint. Learn to parse it: ANGLE (NVIDIA, NVIDIA GeForce RTX 3060 Direct3D11 vs_5_0 ps_5_0, D3D11) tells you the GPU vendor, the exact model, and the graphics backend. That last part carries platform truth — Direct3D is Windows, Metal is macOS, OpenGL and Vulkan are typical on Linux. So a fingerprint claiming to be a MacBook while reporting a Direct3D11 backend is an impossible machine. Alongside the string, testers hash an actual rendered WebGL scene; like canvas, that hash should be rock-stable across reloads.

Audio fingerprint

Audio fingerprinting runs a synthetic signal through an OfflineAudioContext — an oscillator, a compressor — and measures the output, which varies at the floating-point level across hardware and browser builds. You will see a number like 124.04347527516074. There is no good or bad value; what matters, again, is that it is stable for your machine across reloads and sessions, and that it does not collide with a supposedly different device you also operate.

Fonts

Sites detect installed fonts by measuring how text renders in each candidate typeface. Your font list quietly announces your operating system and software history: Calibri and Segoe UI say Windows, Helvetica Neue and San Francisco say macOS, and a copy of Microsoft Office or Adobe Creative Cloud each leave their own trail of installed families. When you check yours, look for coherence. A browser claiming Windows but exposing a macOS font set is a contradiction. So is an implausibly tiny list — a desktop reporting eleven fonts looks like a stripped-down container, not somebody's daily computer.

Screen, cores and memory

screen.width and screen.height should be a resolution that actually ships on real hardware, and devicePixelRatio should match it (a claimed Retina MacBook with a ratio of 1 is wrong). One subtle beauty: screen.availHeight is normally a little less than screen.height, because your taskbar or dock takes space. When the two are identical, there may be no window manager at all — a classic headless-browser tell. Check that hardwareConcurrency and deviceMemory describe a machine that exists: a 1366×768 budget laptop screen paired with 32 cores and 64 GB of reported RAM is the hardware equivalent of a typo.

Timezone, language and location

Three signals must roughly agree: your IP's geolocation, your JavaScript timezone, and your Accept-Language header. A German IP address with an America/New_York timezone and en-US language is a story that does not add up, and risk engines score exactly this trio. When you check your fingerprint through a proxy or VPN, this is the first place to look — the network location moved, but did the timezone and language move with it?

WebRTC and your real IP

WebRTC can discover your addresses via STUN for peer-to-peer connections, and historically that could expose your real IP even while a proxy or VPN carried all your normal traffic. Run the BrowserLeaks WebRTC test: if you are behind a proxy and your real home IP still appears in the candidate list, you have found the single most damaging leak in your setup. Fix it before worrying about anything else, because it undoes the proxy entirely.

Red flags: what a suspicious fingerprint looks like

After you have run the tools, scan your results against this list. Detection systems are not primarily hunting unique browsers — uniqueness is normal. They are hunting liars, and lies look like this:

• navigator.webdriver returning true — the browser is announcing it is automated.
• The user agent disagreeing with navigator.platform, the WebGL backend, or the font set about what operating system this is.
• A canvas or audio hash that changes on every reload — randomization noise that no genuine device produces.
• availHeight equal to height, missing plugin data, or other headless artifacts.
• Timezone and language pointing to a different country than the IP address.
• Hardware combinations that were never manufactured — a phone resolution with desktop cores, a Mac with a Direct3D GPU string.
• A brand-new, never-seen fingerprint arriving from the same IP every single session, which is its own pattern.

One clean way to think about it: every attribute is a witness, and detection is cross-examination. Witnesses are allowed to be distinctive. They are not allowed to contradict each other.

Uniqueness is not the goal — consistency is

Here is the counterintuitive part, and the mistake that burns most people who try to fight fingerprinting by hand: the more aggressively you block and randomize, the more identifiable you often become. The EFF's own testing has long noted that anti-fingerprinting extensions can backfire, because a browser that refuses canvas reads, reports scrambled values, and carries an exotic extension stack is rarer — and therefore more distinctive — than a stock browser. You did not disappear; you put on a very memorable disguise.

There are only two strategies that genuinely work. The first is to blend into a large crowd of identical browsers — this is Tor Browser's approach, where every user is made to look the same, at real cost to usability. The second is to present a coherent, plausible, stable identity: a fingerprint that describes a real machine, tells the same story in every attribute, and repeats identically tomorrow. For ordinary private browsing, a mainstream browser without exotic extensions already puts you in a reasonably big crowd. For anyone operating multiple accounts, only the second strategy scales — and it has to be done per profile, which brings us to the part of fingerprint checking that most guides never touch.

Checking fingerprints when you run multiple browser profiles

If you manage several accounts — as an agency, an e-commerce seller, an affiliate, or a scraping operation — the question changes. It is no longer “am I unique?” but three harder questions: do my profiles read as different devices, is each one internally consistent, and does each one stay identical to itself over time? An antidetect browser exists to answer yes to all three; if the mechanics are new to you, What Is an Antidetect Browser and How Does It Work? explains the architecture, and the field guide to the best antidetect browser for multiple accounts compares the current options.

Whatever tool you use, verify it yourself. Here is the per-profile audit I actually run:

1. Open each profile and run the checkers inside it. Never assume the vendor's marketing matches the runtime reality. Load BrowserLeaks and CreepJS inside the profile window itself.
2. Confirm no two profiles collide. Canvas hash, WebGL hash, audio value and font list should differ across profiles. Two accounts sharing one canvas hash are, to a detector, one device.
3. Confirm each profile agrees with its proxy. Timezone, language and geolocation should match that profile's exit IP, not your real location. This matters double for scraping workloads — the consistency rules in Web Scraping Without Getting Blocked are the same rules, applied at volume.
4. Close, reopen, retest. Each profile's hashes must be byte-identical to yesterday's. A fingerprint that drifts between sessions breaks the very continuity that keeps logged-in accounts trusted.
5. Run the WebRTC test in every proxied profile. The masked IP should be the proxy exit, never your real address.
6. Log the results. A simple spreadsheet of profile name, canvas hash, WebGL string and timezone catches collisions and drift that memory will not. Teams should fold this into their broader hygiene — see Browser Profile Management: Best Practices for Teams.

A note on how fingerprints get applied, because it shows up in your test results. Many tools spoof by injecting JavaScript that overrides APIs like toDataURL — and testers like CreepJS can detect the overridden functions themselves, which turns the disguise into a flag. Dual Login takes the other route: fingerprints are applied natively inside a custom Chromium engine, so there is no injected JavaScript to detect, and the spoofed values hold even inside web workers, where injected scripts often fail to reach. Each profile gets its own persistent data directory (so logins survive), its own proxy with WebRTC masked to the proxy's exit IP, and a fingerprint that is generated once and stays stable for the life of the profile. Those are precisely the properties the audit above tests for — which is deliberate.

A ten-minute routine you can run today

If you only bookmark one thing from this article, make it this sequence:

1. Minute 1–2: Open Cover Your Tracks in your normal browser. Note your bits of identifying information and which attributes contribute most.
2. Minute 3–5: Open BrowserLeaks. Check the canvas, WebGL and WebRTC pages. Record the canvas hash and the WebGL renderer string somewhere you can find again.
3. Minute 6–7: Run CreepJS. Look at the trust score and read every lie flag. A clean stock browser should have essentially none.
4. Minute 8: Open DevTools and spot-check navigator.webdriver, your timezone, and your screen values.
5. Minute 9: Reload the canvas and audio tests. Confirm the hashes did not change.
6. Minute 10: If you use a proxy or VPN, rerun the timezone and WebRTC checks through it and look for the mismatches described above.

Repeat after every major browser update — Chromium updates routinely shift canvas and WebGL output, which means your fingerprint quietly changed even though you did nothing.

FAQ

Can I completely block browser fingerprinting?

Not while keeping a normal browsing experience. Fingerprinting reads capabilities the web platform must expose for pages to render correctly. You can reduce entropy (Tor Browser standardizes users into one crowd) or present a controlled, consistent fingerprint per identity, but total invisibility is not on the menu — and aggressive blocking often makes you more distinctive, not less.

Does incognito mode change my browser fingerprint?

No, and this surprises almost everyone. Incognito gives you a fresh cookie jar and leaves no local history, but your canvas hash, GPU string, fonts, screen and timezone are identical to your normal window. A fingerprint checker will read you the same either way — try it and see.

How often does my browser fingerprint change?

Whenever the underlying inputs change: a browser update (the version string and often the canvas/WebGL output shift), a graphics driver update, installing software that adds fonts, a new monitor, or an OS upgrade. In practice, expect meaningful drift every few weeks on an actively updated machine — which is why trackers use fuzzy matching rather than exact hashes, and why you should recheck periodically.

Is browser fingerprinting legal?

Broadly, yes, though regulation is tightening. In the EU, GDPR and the ePrivacy rules treat fingerprinting as processing of personal data that generally requires a lawful basis, and regulators have said consent rules apply to it just as they do to cookies. Enforcement lags the law, however, and fingerprinting remains widespread for both ad tracking and fraud prevention.

Why does my fingerprint show a different GPU than my PC actually has?

Usually because the value passes through a translation layer. Chromium renders WebGL through ANGLE, so you see strings like Direct3D11 wrapped around your GPU name; on machines without usable GPU drivers, you may see SwiftShader, a software renderer. If you are inside a VM, remote desktop, or an antidetect profile, the reported GPU is whatever that environment presents — which is exactly why you check.

Do VPNs hide my browser fingerprint?

No. A VPN replaces your IP address and encrypts traffic in transit — the network layer only. Your canvas hash, WebGL string, fonts, screen and timezone pass through unchanged, and a timezone that no longer matches your new VPN location actually makes you easier to flag. Fingerprint control requires changing what the browser itself reports, which is a different tool for a different layer.

Check it, then check it again

Knowing how to check your browser fingerprint is a small skill with outsized returns. Ten minutes with the right tools tells you exactly what every website already knows about your machine, which attributes give you away, and — if you operate multiple accounts — whether your profiles would survive cross-examination. The habit matters more than the first result: fingerprints drift with every update, so put the routine above on a recurring reminder.

And if the multi-profile audit exposed collisions, drift, or mismatches you cannot fix by hand — that is not a discipline problem, it is a tooling problem. Dual Login runs each account in its own isolated profile with a natively applied, internally consistent fingerprint, a dedicated data directory and per-profile proxy, so the checks in this guide come back clean by design. See what to test during an antidetect browser free trial and run this exact audit against it — the tools above don't care whose software they are grading, which is precisely why they are worth trusting.