Every browser leaks a surprising amount of identifying information: canvas and WebGL rendering, installed fonts, screen metrics, timezone and dozens of other signals. Combined, they are often unique enough to track you without a single cookie.
This lab makes that visible. It collects the signals your browser exposes, shows each one individually, and combines them into a single SHA-256 fingerprint — all locally, with nothing sent anywhere. It is equal parts privacy demonstration and research tool.
Why fingerprinting deserves attention
Cookie-based tracking is at least visible and controllable: it stores something on your device, and you can inspect or delete it. Fingerprinting is stateless. It writes nothing, so clearing cookies achieves nothing, private browsing achieves nothing, and it works across sites that never set an identifier at all.
That combination makes it uniquely difficult to reason about as a user, which is precisely why demonstrating it matters more than describing it. Reading that a canvas hash is stable is abstract; seeing your own fingerprint stay identical after clearing every cookie and opening a private window is not.
What the lab measures
- Canvas rendering: text and shapes drawn offscreen and hashed, where GPU, driver and font rasterisation differences produce a remarkably stable per-device value.
- WebGL: the graphics renderer string, which frequently names the exact GPU.
- Display and locale: resolution, colour depth, timezone and language.
- Hardware hints: logical processor count and available device memory.
- Browser surface: user agent, platform and supported APIs.
Entropy, not identity
The important insight is that no single value identifies anyone. Millions of people share a screen resolution. Identification is the product of combination: each additional attribute multiplies the number of distinguishable configurations, and the useful measure is how many bits of entropy a signal contributes. Roughly thirty-three bits would suffice to distinguish every person alive, and an ordinary browser leaks well past that.
The lab also demonstrates a counter-intuitive consequence: an unusual configuration makes you more identifiable, not less. A rare font set, an exotic window size or an extension that modifies pages all add entropy. This is why Tor Browser standardises values to make users look identical rather than trying to make them look random.
Run it yourself in the browser fingerprint tool, or compare what your request headers alone reveal with the user-agent parser.