What is Browser Fingerprinting?

Browser fingerprinting is identification of users based on unique device/browser characteristics, without cookies. Sites collect 50+ signals and hash them into a 32-128 bit identifier. Libraries: FingerprintJS, Sannysoft fingerprinter.

Entropy (uniqueness): Single User-Agent = low entropy (millions share Chrome on Windows). User-Agent + screen resolution + plugins + Canvas output = high entropy (99%+ of users unique).

50+ Fingerprint Signals

JavaScript-Based

User-Agent string: OS, browser, version. Easy to spoof.

Canvas fingerprinting: Render text + shapes on hidden canvas. Read pixels. Antialiasing differs by GPU/OS. Hard to spoof without GPU emulation.

WebGL: GPU model, driver, rendering pipeline details. Very high entropy.

Fonts installed: List system fonts. Varies by OS + user customization.

Screen: Resolution, color depth, pixel depth, DPI. Hard to spoof without VM adjustments.

Timezone, language, plugins, audio context.

Network-Based (TLS Fingerprinting)

JA3: Hash of TLS ClientHello: SSL version, accepted ciphers, extensions, elliptic curve formats, signature algorithms. Each browser/OS combo has distinct JA3 hash. Proxies leak non-matching JA3.

JA4: Updated JA3 (2023) using QUIC + TLS. More robust.

JA3/JA4 Deep Dive

TLS ClientHello contains 15+ fields. Browser concatenates them in specific order. Example:

771,4865-4866-4867-49195...,0-23-65281...,23-24,0

This is hashed to JA3 fingerprint. Real Chrome on Windows = consistent hash across sessions. A proxy rotating through different server configurations or using generic TLS libraries = different JA3 each time = detected.

// Mobile proxies vs Datacenter

Mobile proxies route through real phone OS, which has real TLS stack (BoringSSL on Android, Security.framework on iOS). JA3 matches real phone fingerprint. Datacenter proxies often use OpenSSL or custom stacks, creating detectable TLS mismatch.

Evasion Techniques

Headless Browser Hardening

Playwright/Puppeteer leak signals like "headless" in User-Agent. Stealth plugins modify Chrome flags, remove headless indicators, randomize Canvas output.

Randomization

Randomize User-Agent, Canvas, WebGL per request. But randomize consistently: if you're on Chrome, stay Chrome. If Windows 10, stay Windows 10 (don't jump to macOS).

Real Browsers

Use actual Chrome/Firefox instead of headless. Slower but defeats most detection.

Antidetect Browsers (2026)

Multilogin, Hidemyacc, FingerTips: Spoof all 50+ signals consistently. Assign per-profile: unique User-Agent, Canvas hash, WebGL, etc. Prevent fingerprint cross-matching across profiles.

Cost: $50-200/month per profile. Used by affiliate marketers, fraud (account farming). Effective against most detection, but high-entropy signals still leak.