Browser Fingerprinting
Browser fingerprinting is the practice of collecting and combining many observable attributes of a web browser and its environment into a single identifier that can recognize a device without cookies or local storage. Because each attribute carries a little information, the combination is often distinctive enough to single out one browser among millions.
How Browser Fingerprinting works
A fingerprinting script queries the browser for dozens of attributes that are exposed through standard web APIs. These include the user agent string, list of installed fonts, screen resolution and color depth, timezone, language preferences, available plugins, and properties of the navigator and window objects. Individually most of these values are shared by large groups of users, but together they form a high-dimensional profile.
The technique also draws on rendering-based probes such as canvas and WebGL, which expose subtle differences in the GPU, graphics driver, and font rasterizer. Audio processing, media codec support, and hardware concurrency add further dimensions. The script serializes all collected values and typically hashes them into a compact identifier that can be compared against previously seen fingerprints.
Unlike cookies, a fingerprint is not stored on the client and cannot simply be deleted by the user. It is recomputed on each visit from properties the browser must reveal to render pages correctly. This makes fingerprinting resilient to cookie clearing and private-browsing modes, though individual signals can shift when the browser, operating system, or hardware changes.
Robust implementations do not rely on an exact match of the whole fingerprint. They weigh signals by stability and distinctiveness and apply tolerant matching so that a single upgraded component does not break recognition of a returning device.
Why Browser Fingerprinting matters for fraud prevention
Browser fingerprinting is a foundational technique for fraud prevention because it links activity back to a physical device even when attackers rotate cookies, IP addresses, and accounts. It underpins detection of multi-accounting, account takeover, promo abuse, and bot traffic, where the same device repeatedly appears behind different identities. Without a durable device signal, defenders are left trusting easily forged or discarded identifiers.
How TRACIO handles it
TRACIO's Identification product builds a stable visitor ID from 130+ device signals, combining browser attributes with server-side and network signals rather than relying on any single value. The approach is tuned for accuracy against internal benchmarks (99.5% identification accuracy) while running with low overhead (<50ms P95 latency). TRACIO treats fingerprinting as one input to a probabilistic identity, not a standalone tracking mechanism, and pairs it with Smart Signals for context.
Explore further
Frequently asked questions
Identify every device with confidence
Start with a free plan of 2,500 API calls per month. No credit card required.