A fingerprint is an identity assembled from things you did not choose to send
Screen size, fonts, timezone, graphics rendering, audio processing. Individually unremarkable, collectively distinctive enough to recognise the same browser again without storing anything on it.
Where the identifying power comes from
Configuration you can observe
Screen dimensions, colour depth, timezone, language, platform, installed fonts, hardware concurrency. Each is low-entropy on its own; the combination is what carries information, which is why blocking any one attribute changes little.
Rendering differences
Drawing the same shape or text to a canvas, or through the graphics stack, produces subtly different pixels on different hardware and driver combinations. The output hashes to a stable value that is far more distinctive than any configuration field.
Processing differences
The same idea applied to audio: process a known signal and the floating-point result varies by implementation. It is a small amount of entropy, but it is stable and hard to change without changing the machine.
Protocol-level shape
The ordering and content of a TLS handshake and the HTTP/2 settings a client sends are characteristic of the library that sent them. These are visible before any JavaScript runs, which is what makes them useful to a network layer.
Fingerprinting compared with the alternatives
| How it identifies | Its main weakness | |
|---|---|---|
| Cookies | Something stored on the client | Cleared, blocked, or refused |
| Login | A declared, verified identity | Requires an account |
| IP address | Network origin | Shared, dynamic, easily changed |
| Fingerprinting | Emergent properties of the client | Drifts as software updates |
| Signed agent identity | Cryptographic proof of who you are | Both sides must implement it |
| Behavioural analysis | Patterns over a session | Needs time before it decides |
As of 2026-08-31 · Competitor details come from each vendor's published pricing page on that date.
What this means if you run automation
The practical consequences, none of which involve disguise.
-
Expect to be identifiable
A datacentre browser with no window manager and a default font set is distinguishable from a desktop install. Plan on the assumption that you are recognisable, because you are.
-
Value consistency over plausibility
An inconsistent client scores worse than an obviously automated one. A stable, honest configuration is both simpler to operate and less likely to trip a check than a partially disguised one.
-
Keep a profile rather than resetting it
A browser that arrives with the same storage, cookies and history each run looks like a returning user because it is one. Discarding state every run is itself a distinctive pattern.
-
Prefer declaring to hiding
For anything you have a relationship with, an allowlist entry or a signed agent identity is durable. Evasion is a maintenance commitment that only ever gets more expensive.
-
Treat privacy law as applying to you too
Fingerprinting for identification purposes has been treated as within scope of European consent rules. If you build any of this into your own product, that applies to you as much as to the sites you visit.
Common questions
Is fingerprinting legal?
It depends on purpose and jurisdiction. European regulators have consistently taken the position that reading device characteristics for identification falls within the same consent regime as cookies, regardless of the technique. That the data was not stored on the device has not been accepted as making it exempt.
Can I stop being fingerprinted?
Not reliably, and partial attempts often make you more identifiable rather than less. Anti-fingerprinting works by making many users look identical, which is a property of a large shared population and not something an individual automation setup can produce for itself.
Is a headless browser a different fingerprint?
Yes, measurably, in the absence of a window manager, in font availability and in the graphics path. This is one reason why the answer to being blocked is usually a lower request rate or a real relationship with the site rather than a more convincing disguise.
Do you spoof fingerprints?
No. It is on the short list of things this product deliberately does not do, alongside proxy rotation and CAPTCHA solving, and that is a positioning decision rather than a gap in the roadmap.
Built for automation that has permission
Authenticated portals, supplier systems and your own applications, from sessions that run in the EU.