What is Browser Fingerprinting?
Browser fingerprinting is identification of users based on unique device/browser characteristics, without cookies. Sites collect 50+ signals and hash them into a 32-128 bit identifier. Libraries: FingerprintJS, Sannysoft fingerprinter.
Entropy (uniqueness): Single User-Agent = low entropy (millions share Chrome on Windows). User-Agent + screen resolution + plugins + Canvas output = high entropy (99%+ of users unique).
50+ Fingerprint Signals
JavaScript-Based
User-Agent string: OS, browser, version. Easy to spoof.
Canvas fingerprinting: Render text + shapes on hidden canvas. Read pixels. Antialiasing differs by GPU/OS. Hard to spoof without GPU emulation.
WebGL: GPU model, driver, rendering pipeline details. Very high entropy.
Fonts installed: List system fonts. Varies by OS + user customization.
Screen: Resolution, color depth, pixel depth, DPI. Hard to spoof without VM adjustments.
Timezone, language, plugins, audio context.
Network-Based (TLS Fingerprinting)
JA3: Hash of TLS ClientHello: SSL version, accepted ciphers, extensions, elliptic curve formats, signature algorithms. Each browser/OS combo has distinct JA3 hash. Proxies leak non-matching JA3.
JA4: Updated JA3 (2023) using QUIC + TLS. More robust.
JA3/JA4 Deep Dive
TLS ClientHello contains 15+ fields. Browser concatenates them in specific order. Example:
771,4865-4866-4867-49195...,0-23-65281...,23-24,0
This is hashed to JA3 fingerprint. Real Chrome on Windows = consistent hash across sessions. A proxy rotating through different server configurations or using generic TLS libraries = different JA3 each time = detected.
Mobile proxies route through real phone OS, which has real TLS stack (BoringSSL on Android, Security.framework on iOS). JA3 matches real phone fingerprint. Datacenter proxies often use OpenSSL or custom stacks, creating detectable TLS mismatch.
Evasion Techniques
Headless Browser Hardening
Playwright/Puppeteer leak signals like "headless" in User-Agent. Stealth plugins modify Chrome flags, remove headless indicators, randomize Canvas output.
Randomization
Randomize User-Agent, Canvas, WebGL per request. But randomize consistently: if you're on Chrome, stay Chrome. If Windows 10, stay Windows 10 (don't jump to macOS).
Real Browsers
Use actual Chrome/Firefox instead of headless. Slower but defeats most detection.
Antidetect Browsers (2026)
Multilogin, Hidemyacc, FingerTips: Spoof all 50+ signals consistently. Assign per-profile: unique User-Agent, Canvas hash, WebGL, etc. Prevent fingerprint cross-matching across profiles.
Cost: $50-200/month per profile. Used by affiliate marketers, fraud (account farming). Effective against most detection, but high-entropy signals still leak.