What is browser fingerprinting?

Cookies come off. Fingerprints don't.

A web server doesn't know who visits. So it sticks a name tag on each visitor. That is a cookie. But a name tag can be peeled off. Clear cookies, go private, or switch browsers and the tag is gone.

So fingerprinting arrived. Instead of a tag, it collects traits your device already has and recognizes the combination: screen size, time zone, installed fonts, graphics card name, CPU core count. Each is common alone. Stack several and you get narrowed down fast.

Why sound can be a fingerprint

In August 2026 a developer noticed something odd. He was listening to music from his phone on Bluetooth headphones, and the music cut out whenever he opened AliExpress. Yet no tag on the page played any sound.

Digging in, he found the page was running a sawtooth waveform at volume zero. You can't hear it, but it occupies the audio device, and headphones that prefer the computer's sound pushed the phone out. That accident is the only reason anyone noticed.

Why do it? Because the same waveform comes out slightly different, past the decimal point, depending on the CPU and browser. That difference is the fingerprint. A 2016 Princeton study of the top million sites had already reported the technique. It isn't new.

Browsers that block it, and browsers that don't

Once this was public, a Firefox engineer said they had pinned the audio value to a constant three years earlier. Brave had blocked it for six years, and said it blocks the script AliExpress used outright. Safari appears to have fixed it quietly.

Chrome does not add noise here. Many read this as a business matter: Google sells ads, and fingerprint protection would hit that directly. Convenient and leak-proof usually sit on opposite sides.

That is why the result on the measurement page differs from browser to browser. If many places show as blocked, your browser is protecting you.

The other side has a point

Sites that have to filter bots and fake accounts find fingerprints useful. With one, they can show you fewer CAPTCHAs, the traffic-light and motorbike screens everyone hates.

So the problem isn't collecting. It's hiding. If it was legitimate, why obfuscate it, and why not say what was being taken? Nobody answered. When you sign up and type your name, you know what you gave. A fingerprint leaves without you knowing.

How to reduce it yourself

Use Brave or Firefox. They block these places by default, as above. Nothing makes you fully leak-proof, but the number of readable places drops a lot.

Avoid standing out. A fingerprint recognizes you better the more you differ from everyone else. An odd window size or a pile of rare fonts narrows you down more. So does installing many extensions.

A VPN alone is not enough. It hides your address, but the 10 places go out as they are. If your time zone and address disagree, that becomes one more mark.

There is no complete block. Block the audio fingerprint and the next place shows up. One survey found over thirty techniques already running in Chrome. The difference is only what you know about.

So what do we count?

It wouldn't be fair to point at others and not say about ourselves. We want to know how many people came today. To decide what to build next, we need people, not visits.

So we use only four common values: screen size, time zone, first language, and touch input. The strong ones measured above, audio, canvas, graphics card, are not used at all.

Those four are mixed with today's date and this app's name and reduced so they can't be reversed. When the day changes the value changes completely, so yesterday can't be linked, and our other apps can't be linked either. It isn't that tracking is hard. We built it so it can't be done.

We put a test on that. If the date or the app name is removed, the test goes red, and we removed them to check that it does.