Device Fingerprinting
Device fingerprinting identifies a device by the combination of characteristics it reveals — browser, operating system, screen dimensions, installed fonts, graphics rendering behavior. No single attribute identifies anything. Enough of them together, in combination, usually do.
| What it produces | A probabilistic identifier for a device, not a certain one |
| Attributes used | User agent, screen and color depth, timezone, language, fonts, plugins, hardware concurrency |
| Canvas fingerprinting | Rendering an image and hashing the result — GPU and driver differences make it distinctive |
| Audio fingerprinting | The same idea applied to audio processing output |
| Why it works | The combination is rare even where each attribute is common |
| Persistence | Survives cookie clearing and private browsing |
| Fraud uses | Linking accounts, detecting emulators, spotting repeat attempts after a block |
| Evasion | Anti-detect browsers, randomized attributes, residential proxies |
| Privacy status | Increasingly restricted — browsers actively reduce available entropy |
How it works
The method rests on entropy. Any one attribute — a common screen resolution, a widely used browser version — identifies nobody. Twenty attributes combined produce a signature that is frequently unique, or rare enough to be useful.
Canvas fingerprinting is the most illustrative technique. The browser is asked to render text or a shape to an off-screen canvas, and the resulting pixels are hashed. Differences in GPU, driver version, font rasterization and anti-aliasing mean the same instruction produces subtly different output across devices. The user sees nothing. Audio fingerprinting applies the identical idea to the audio processing stack.
The property that makes it valuable for fraud work is persistence without storage. A cookie can be cleared; a fingerprint is recomputed from what the device is. Someone who is blocked, clears everything, opens a private window and returns is recognizably the same device.
Evasion has matured in step. Anti-detect browsers exist specifically to present a different, plausible fingerprint per session, paired with residential proxies so the network signal matches. These are commercial products with support and subscriptions, not obscure tooling — which means a serious operation defeats fingerprinting routinely, while a careless one does not.
The privacy direction is also against it. Browsers have been steadily reducing available entropy — capping user agent detail, restricting font enumeration, adding noise to canvas output — because the same technique that catches fraud also enables tracking. Fingerprinting is getting less reliable by design.
Why it matters for identity verification
Device signals are useful and structurally secondary, and conflating the two causes real problems.
A device fingerprint links sessions. It cannot tell you who is using the device, whether they are the account’s owner, or whether the identity behind the account was ever real. It answers “have we seen this device before” — a valuable question, and a different one from “who is this”.
Where it does the most work is linkage. One device behind forty applications is a strong fraud ring signal, and it surfaces coordination that per-application scoring cannot see. But it is also the link a competent operation breaks first and most cheaply, which is why device evidence should be weighted as a supporting signal rather than a determination.
Verified identity attributes are the durable complement. Breaking a device link costs a new browser profile; breaking an identity link costs a genuine document and a real face. Combining device signals with verified identity gives you links at two very different price points, and Microblink’s promo abuse detection uses both because either alone is defeatable.
Device fingerprinting vs cookies
| Device fingerprint | Cookies | |
|---|---|---|
| Stored on the device | No — computed from attributes | Yes |
| User can clear it | Not directly | Yes |
| Survives private browsing | Usually | No |
| Certainty | Probabilistic | Deterministic while present |
| Consent posture | Contested; often requires disclosure | Well-established consent frameworks |
| Defeated by | Anti-detect browsers, attribute randomization | Clearing browser data |
What it can’t do
It cannot identify a person. It identifies a device, probably. Households share devices, people use several, and public machines serve many users. Treating a device match as an identity match produces confident errors.
It is defeated by tooling that is neither rare nor expensive. Anti-detect browsers are commercial products. Any operation running fraud at scale uses them, so fingerprinting catches the opportunistic and misses the organized.
It is getting weaker. Browser vendors are deliberately reducing the entropy fingerprinting depends on. A technique whose accuracy declines with every browser release is not one to build a control around.
It carries privacy exposure. Fingerprinting is designed to work without consent or storage, which is precisely why regulators and browser vendors treat it sceptically. Its legal position varies by jurisdiction and is tightening.
Frequently asked questions
What is canvas fingerprinting?
A technique where the browser renders an image to an off-screen canvas and the result is hashed. Differences in GPU, drivers and font rendering make the output subtly device-specific. The user sees nothing and no data is stored on their machine.
Can device fingerprinting be blocked?
Partially. Privacy-focused browsers add noise or restrict the APIs involved, and mainstream browsers are steadily reducing available entropy. Anti-detect browsers go further, presenting a different plausible fingerprint per session.
Is device fingerprinting the same as identifying a user?
No. It identifies a device with some probability. Devices are shared, people use several, and public machines serve many users. It answers whether this device has been seen before, not who is using it.
Does device fingerprinting work in private browsing mode?
Generally yes, which is a large part of its appeal for fraud detection. It is computed from device characteristics rather than stored data, so clearing cookies or opening a private window does not reset it.
Related reading
- Device risk — how the fingerprint becomes a score
- Fraud ring — what device linkage is usually looking for
- Entity resolution — linking accounts on shared attributes
- Bot — the automation device signals try to catch
