How Websites Identify Your Device Without Cookies

Clearing cookies feels like starting over. For a lot of sites it isn't. They never needed to store anything on your device to recognize you, because your browser describes itself in enough detail on every visit that the description works as an ID.

This is browser fingerprinting, and it's how many websites identify your device without cookies.

A fingerprint isn't stored on your device. There is nothing to delete.

The three layers of a fingerprint

A fingerprint is built from three layers. Each one on its own says little. Together they point to one device.

What your browser tells every website

The header layer arrives with every request, before any script on the page runs. Your browser sends its User-Agent, a short line of text with the browser name, version and operating system, and its language preferences. Chrome and other Chromium browsers add client hints on request, down to the exact build and, on Android, the phone model.

This is passive fingerprinting. The site only has to write down what your browser already sends.

What a script on the page can measure

Active fingerprinting goes further. A script asks the browser questions, and the browser answers, because ordinary websites need the same answers to work. A few examples show how much leaks:

• The gap between your full screen and the usable area gives away the size of your taskbar or dock.
• Your time zone gets compared with your IP address. A browser set to Tokyo time behind a German IP is unusual, and unusual is exactly what trackers and fraud systems look for.
• A page can't ask for a list of your fonts, so it tries a few hundred font names and measures how wide the text comes out. Office suites and design apps install fonts most people don't have.
• Through WebGL, the part of the browser that draws 3D graphics, a page can usually read the exact GPU model.

The strongest signal is the way your computer draws. In canvas fingerprinting, the page draws text and shapes on an invisible canvas and reads the pixels back. The result depends on your operating system, fonts, graphics driver and GPU, so the same machine produces the same image every time, down to the pixel. Audio works the same way: a short sound is processed inside the browser with nothing played out loud, and tiny differences in the result are measured.

Why the combination identifies you

Hardly any of these values is rare on its own. Millions of people run Chrome on Windows with English settings and a 1920×1080 screen. Add the time zone, the fonts, the GPU and the canvas result, and that crowd shrinks fast.

A tracker needs exactly two things from the combination:

1. Distinctive. Few other browsers share it.
2. Stable. It stays the same between visits.

Stability doesn't have to be perfect. When a browser update changes a couple of values, the rest stay put, and the new fingerprint is easy to match to the old one. Most defenses are built on the opposite idea: a value that changes on every visit is useless for tracking, however rare it is.

Fingerprints below the browser

The connection layer is the one most people never hear about. When your browser opens an HTTPS connection, its very first message lists the encryption methods it supports. A format called JA4 turns that list into a short code that looks different for Chrome, Firefox, Safari and a Python script. One layer lower, the first network packet carries values set by your operating system, which point to Windows, macOS, Linux or iOS regardless of what the browser says.

No browser setting changes either one. Servers compare both with what the browser claims to be, so an "iPhone" that connects with the handshake of a Python script stands out right away.

Real visitor vs. headless bot

Bot detection relies on exactly these checks. Here is how an ordinary laptop compares with a headless Chrome running on a server, the kind scrapers use:

And this is what the packet.guru scan reports for that headless Chrome:

Trust drops to 45 out of 100: automation detected, a datacenter IP, and a clock that doesn't match the IP's region. The TLS and TCP fingerprints pass, because this really is Chrome on Linux. That's the point. These systems care less about how unique you are than about whether your details agree with each other.

Who uses fingerprinting

• Banks and online shops, against account takeover. A correct password typed on a device they have never seen can trigger an extra check.
• Bot detection, to catch automated browsers like the one above.
• Advertising, to link your visits across sites even when you block or delete cookies. Since February 2025, Google no longer forbids advertisers who use its ad products from fingerprinting, so expect more of it. In the EU, fingerprinting for ads and tracking needs your consent, the same as cookies.

What doesn't protect you

Extensions deserve a closer look. Every extension that changes what pages see is a trait of its own, and changing one value while leaving the rest creates contradictions, like a Windows User-Agent on top of a Mac's graphics hardware. To a fraud system that looks like forgery.

How to avoid browser fingerprinting

The best choice is a browser with protection built in, used with its default settings.

Whatever you use:

• keep extensions to a minimum;
• don't change your User-Agent by hand;
• switch protection off only for the one site that breaks, not globally.

Check your browser in two minutes

1. Open packet.guru/whoami and run the scan.
2. Look at the two scores: Privacy, how hidden you are, and Trust, how genuine you look to a fraud system. The cards below show the reason behind every point.
3. Open a private window or restart the browser, and scan again.
4. Compare. Values that changed between the two runs are being randomized. Values that stayed the same can be used to recognize you.

Browser-by-browser defenses are covered in the guide to browser fingerprinting on the packet.guru blog.