I’ve been experimenting with ways to reduce my browser fingerprint and exploring techniques to anonymize fingerprint data.
So I built this.
This is kind of like a lighter, more thorough version of CreepJS but entirely client side. I don’t maintain massive lists of time zones or do server-side comparisons to calculate uniqueness. Instead, it automatically surfaces everything a browser exposes, explaining each item in detail.
Hi, thank you for going through the trouble of putting this together. This sort of service is invaluable as it allows us clueless people to be mindful about something that negatively impacts our life.
Here's a suggestion: it's important to show us that our browser footprint allows us to be positively identified and tracked, but it only alerts us to a problem. It would be very useful if the site also provided some tips to improve anonymity, particularly if it's low-effort changes such as tweaking a couple of config changes.
It's not zero pieces of info but it's also not close to as bad as it looks. Effectively, everyone who has, say an NVidia GPU, will likely have the same list of features and limits.
As a more general example: The number is just a flat out wrong
> Unique to 1 in 2,147,483,648+ devices.
No, I have an iPhone Pro and am in the PST time zone, set to English. It has the exact same finger print as millions of other devices among the 40 million people in the PST time zone. In general, The only things different between 2 iPhones of the same model are time-zone, laguange setting, and font size.
> No, I have an iPhone Pro and am in the PST time zone, set to English. It has the exact same finger print as millions of other devices among the 40 million people in the PST time zone.
Your IP address, ASN, and location make this not true.
Beyond the obvious IP address difference, there are other way to fingerprint you, see
https://coveryourtracks.eff.org/
which will actually provide details about how you're a special snowflake, tracked by advertisers.
Is it possible and cost-covering to create an ad-sponsored service that discloses what ad networks collect about users - i.e. age, location, preferences, interests, pregnancy, illnesses etc?
Because let’s be honest - all of us know that a lot of data points are being collected about us, countless articles have been written about the insanity of cookie and user-data monetization networks - still it appears to be a privilege to few to tap into that data trove.
I personally haven’t seen an effort to try and make this transparent. Efforts like this page are commendable and informative, much like amiunique or other services - still they lack the tangible information that sharing this information with “the world” reveals about an affected individual.
Why hasn’t this been done yet? Why is this seemingly not trivial?
I'm not sure how that would work from an ad-buying perspective, from what I understand you essentially choose which buckets you'd like to show ads to? Like I don't think ad-buyers get the whole dossier for the person they're showing ads to, the platform just decides "from what you've told us, this person seems likely to like your ads"
If you reload the page a few times, and you're using a modern browser, you'll almost certainly find it's a different fingerprint every time. Most modern browsers add in a randomization so that fingerprinting cannot be used for tracking.
So yes, your fingerprint is unique, but it's a different unique every time, making it pretty useless for anything.
Seems right, I'm on "Mozilla/5.0 (X11; Linux x86_64; rv:145.0) Gecko/20100101 Firefox/145.0" and reloading the page I get a new fingerprint each time. "Unique Fingerprint ID" seems to be the only attribute that changes each reload, but it isn't clear how that's derived.
Edit: Ah, turns out "Unique Fingerprint ID" is just the same fingerprint ID printed at the top, it isn't one of the attribute used for calculating the ID, it is the ID. Guess I got confused by the placement of it.
It's highly unlikely they obtained 17 billion samples, so they're likely guesstimating it by assuming each attribute is independent, and summing the entropy of all attributes. That's obviously incorrect, both because attributes are inevitably going to be correlated (eg. ip geolocation correlated with time zone), and that two identical devices (eg. 2 iPhones) will have identical fingerprints.
I would love to be able to toggle an attribute off/on to see what affect each has on the uniqueness of my fingerprint. My guess is that there are a handful of _very_ unique things, that if obscured, would make one less recognisable.
that site has the same issue. It will give ridiculous and easily provably false results for iPhones.
There are ~40 million in the PST time-zone. Some percent have smartphones (80%+), ~50% of those are iPhones (16 million). Of those, the majority are set it English (80%+), and are divided into screen sizes. But basically, if you have an iPhone, you have the same fingerprint has at least a million other other people in the PST time size. You are at best, 1 of 100, not 1 of x,xxx,xxx,xxx.
You might be x,xxx,xxx,xxx of people who visited that unpopular site but no one needs tracking on an unpopular site. On a popular site you will not have a unique finger print.
What we need is VPB. Virtual Private Browser like VPNs. Essentially standardised cloud browsers that can execute your requests and send you back the result as bitmap buffers.
Not all websites work well, and you get a lot of captchas last time I tried it. From memory the way they make this work is pretty cool though, they capture Skia draw commands and send those over the network and use a wasm library to replay them.
Great idea! How to make sure that the users data stays private without the cloud knowing where the user is surfing. And I wonder how to monetise it? Subscription?
I get a new fingerprint id everytime I refresh the page (firefox, linux) -- so that might be sampling a tiny bit too much.
audio and canvas fingerprint are constant though so it's probably plenty enough...
Yet on the flip side, if I’m trying to auto identify my own phone for a login-less private app i tried to build I couldn’t get to reliably generate a consistent fingerprint on safari private mode, it regenerates 50% of the time, I’ve tried several libraries like fingerprintjs and co..
Fwiw, I use Tailscale/wireguard and take care to ensure the source IP gets fed to apps properly. This makes it easy to guarantee I have a reliable way to identify myself on my webapps and auto-auth.
The currency and telephone number prefix info is highly misleading. Those are being assumed based on my IP, not being reported by the browser. Knowing some of this data is fabricated like this makes the site seem less credible.
I tried with Windows 7 (Firefox 115) and it reports Windows 7.
It seems though that it cannot distinguish between Windows 10 and Windows 11, so, without looking further, I suppose the detection is based on the User-Agent string? (The OS version browsers report on Windows is frozen, so Windows 10 and Windows 11 have the same version there.)
The main "Fingerprint ID" on this site seems to be a direct combination of all values, so if even a single one changes it'll act like the only conclusion is this is an entirely different fingerprint. Actual fingerprinting is a bit smarter, but it's not really possible to demonstrate that in a single clientside scripted static web page.
The more important bit to see from this tool is probably "this is an example of how much information which can aid in identification your browser exposes".
Yeah but several of those will also be the same if you have the same iPhone model and iOS. Safari browser updates are installed as part of iOS update. So anyone with the same iOS version has the same version of Safari.
this seems incredibly variable as to be almost useless as any type of "fingerprint" - running the latest version of Chrome on Android, the ID at the top of the page changes each reload.
For example, in the DRM section, they extract the Security Level, like L3 – Software Decode (SW_SECURE_DECODE).
Their WebRTC test is also unique: they utilize a TURN server as a feedback mechanism. That means even if you tamper with WebRTC JS in the browser (like some extensions do), it can still expose your real IP by leveraging UDP and bypassing the proxy altogether.
https://scrapfly.io/web-scraping-tools/webrtc-leak
But to what extent should we care for such a small website? The AI witch hunt won't get us too far, and this new way of producing is only getting started. The loss of control to a non-deterministic black box is worrysome, but at some point non-vibe coded (hard coded? brain coded?) software might become less error-prone that vibe-coded
This is useless. I think you misunderstand the point of fingerprinting. A powerful fingerprinting algo should strive to detect you as the same person (aprox) while you use two different browsers. A more powerful one will detect you while you use another device. This only detect your current refresh.
I’ve been experimenting with ways to reduce my browser fingerprint and exploring techniques to anonymize fingerprint data.
So I built this.
This is kind of like a lighter, more thorough version of CreepJS but entirely client side. I don’t maintain massive lists of time zones or do server-side comparisons to calculate uniqueness. Instead, it automatically surfaces everything a browser exposes, explaining each item in detail.
Here's a suggestion: it's important to show us that our browser footprint allows us to be positively identified and tracked, but it only alerts us to a problem. It would be very useful if the site also provided some tips to improve anonymity, particularly if it's low-effort changes such as tweaking a couple of config changes.
https://webgpureport.org/
But, they are bucketed
https://www.w3.org/TR/webgpu/#privacy-considerations
It's not zero pieces of info but it's also not close to as bad as it looks. Effectively, everyone who has, say an NVidia GPU, will likely have the same list of features and limits.
As a more general example: The number is just a flat out wrong
> Unique to 1 in 2,147,483,648+ devices.
No, I have an iPhone Pro and am in the PST time zone, set to English. It has the exact same finger print as millions of other devices among the 40 million people in the PST time zone. In general, The only things different between 2 iPhones of the same model are time-zone, laguange setting, and font size.
Please STOP EXAGGERATING!
Your IP address, ASN, and location make this not true.
you walked right by the chance to call it WeirdoJS
Because let’s be honest - all of us know that a lot of data points are being collected about us, countless articles have been written about the insanity of cookie and user-data monetization networks - still it appears to be a privilege to few to tap into that data trove.
I personally haven’t seen an effort to try and make this transparent. Efforts like this page are commendable and informative, much like amiunique or other services - still they lack the tangible information that sharing this information with “the world” reveals about an affected individual.
Why hasn’t this been done yet? Why is this seemingly not trivial?
https://myadcenter.google.com/controls
I'm not sure how that would work from an ad-buying perspective, from what I understand you essentially choose which buckets you'd like to show ads to? Like I don't think ad-buyers get the whole dossier for the person they're showing ads to, the platform just decides "from what you've told us, this person seems likely to like your ads"
Or more like "on ad network X you match for keywords A, B, F, G"?
So yes, your fingerprint is unique, but it's a different unique every time, making it pretty useless for anything.
Edit: Ah, turns out "Unique Fingerprint ID" is just the same fingerprint ID printed at the top, it isn't one of the attribute used for calculating the ID, it is the ID. Guess I got confused by the placement of it.
For me it says 1 in 17,179,869,184+, but scrolling through all the variables, the vast majority should be the same for any MacBook Chrome user.
It would be great to see the stats of each individual characteristic.
There are ~40 million in the PST time-zone. Some percent have smartphones (80%+), ~50% of those are iPhones (16 million). Of those, the majority are set it English (80%+), and are divided into screen sizes. But basically, if you have an iPhone, you have the same fingerprint has at least a million other other people in the PST time size. You are at best, 1 of 100, not 1 of x,xxx,xxx,xxx.
You might be x,xxx,xxx,xxx of people who visited that unpopular site but no one needs tracking on an unpopular site. On a popular site you will not have a unique finger print.
No idea how representative either tool is.
If the fingerprint ID is unique every time, there is zero possibility of using it for identification.
Or did I misunderstand you?
I tried with Windows 7 (Firefox 115) and it reports Windows 7.
It seems though that it cannot distinguish between Windows 10 and Windows 11, so, without looking further, I suppose the detection is based on the User-Agent string? (The OS version browsers report on Windows is frozen, so Windows 10 and Windows 11 have the same version there.)
The more important bit to see from this tool is probably "this is an example of how much information which can aid in identification your browser exposes".
Also I think somebody on HN recently pointed out that the language accept header can be used to fingerprint chromium users.
My iPhone is allegedly unique to 1 in 2,147,483,648+ devices.
But I wonder how true that is, given how many people use the same model and iOS version as me.
And if every option cuts the user base in half, becoming unque is a matter of 33 such options.
Browser type and version
Screen resolution
Installed fonts
Browser plugins and extensions
Canvas fingerprinting data
WebGL (graphics hardware info)
Time zone
Language settings
IP address
HTTP headers
Touch support
Device type
AudioContext
For example, in the DRM section, they extract the Security Level, like L3 – Software Decode (SW_SECURE_DECODE).
Their WebRTC test is also unique: they utilize a TURN server as a feedback mechanism. That means even if you tamper with WebRTC JS in the browser (like some extensions do), it can still expose your real IP by leveraging UDP and bypassing the proxy altogether. https://scrapfly.io/web-scraping-tools/webrtc-leak
But to what extent should we care for such a small website? The AI witch hunt won't get us too far, and this new way of producing is only getting started. The loss of control to a non-deterministic black box is worrysome, but at some point non-vibe coded (hard coded? brain coded?) software might become less error-prone that vibe-coded
Did you mean more instead of less?
> Impossible to "expose"
The perks of disabling JS on every site!
So instead I wonder if we could build an open database of “identities” that our browsers could clone.
That is your browser deliberately reports the whatever is currently the most popular of a set of general identities.
It's important to point out fingerprinting, yet no ordinary user cares.