Browser Fingerprinting

Exploits subtle rendering differences in the HTML5 Canvas API. By instructing the browser to draw a hidden graphic and then hashing the resulting pixel data, a highly unique identifier is generated. Variations in GPU drivers, OS font rendering, and anti-aliasing algorithms produce a consistent signature across sessions.

• Mechanism: toDataURL() on a hidden <canvas> element
• Entropy: Very high due to hardware-level GPU and driver variations
• Resilience: Survives cookie clearing and incognito mode

Leverages the WebGL API to probe the device's GPU hardware and driver stack. The WEBGL_debug_renderer_info extension exposes the exact GPU model and vendor, while rendering a scene and hashing the output captures driver-specific shader precision and optimization artifacts.

• Exposed Data: GPU vendor, model, and driver version
• Sub-signals: Supported extensions, max texture size, and shader precision
• Use Case: Distinguishing identical OS/browser combos on different hardware

Detects the set of installed system fonts by measuring the rendered dimensions of text strings in various typefaces. A list of available fonts is highly distinctive, especially on enterprise machines with custom or licensed font packages installed alongside standard OS defaults.

• Method: DOM-based width comparison against a baseline font
• Entropy Source: Corporate fonts, design software suites, and locale-specific typefaces
• Countermeasure: Browser vendors are restricting font enumeration APIs

Exploits minute variations in the Web Audio API's signal processing chain. An inaudible oscillator signal is processed through the AudioContext, and the resulting waveform is hashed. Differences in hardware sample-rate conversion and browser audio stack implementations produce a stable, unique signature.

• Signal: Compressed hash of an audio processing pipeline output
• Stability: Highly consistent across browser restarts
• Detection: Often bypasses standard fingerprinting blockers that focus on visual APIs

Aggregates static browser and OS attributes exposed via the window.navigator object. While individual properties like userAgent or platform are low-entropy, the combined hash of dozens of properties—including hardwareConcurrency, deviceMemory, and languages—creates a highly discriminative identifier.

• Key Properties: userAgent, platform, language, hardwareConcurrency, deviceMemory
• Entropy: Moderate individually, high in combination
• Spoofing Risk: Commonly randomized by anti-fingerprinting extensions

Captures the exact pixel dimensions of the user's display viewport and the color bit depth. Multi-monitor setups, zoom levels, and taskbar configurations create a unique screen fingerprint that complements other hardware signals. This data is accessed via screen.width, screen.height, and screen.colorDepth.

• Data Points: Viewport dimensions, device pixel ratio, color depth
• Distinctiveness: High for non-standard or multi-monitor configurations
• Limitation: Less stable on devices with frequently changing external displays

A specific browser fingerprinting technique that exploits subtle rendering differences in the HTML5 Canvas API. By instructing the browser to draw a hidden graphic and then hashing the pixel output, servers can identify unique GPU and driver combinations. This method is highly effective because the same canvas text rendered on different operating systems, graphics cards, and installed font sets produces slightly different anti-aliasing artifacts. It is a passive, stateless identification mechanism that requires no cookies.

A sub-technique that probes the WebGL API to extract the precise model and vendor of a device's GPU. The renderer string and supported extensions provide a highly granular hardware signature. Key attributes collected include:

• UNMASKED_VENDOR_WEBGL: The GPU manufacturer (e.g., NVIDIA, Apple)
• UNMASKED_RENDERER_WEBGL: The exact GPU model string
• Supported WebGL extensions list This is particularly useful for detecting headless browsers, which often emulate or lack a physical GPU, exposing a mismatch between the user-agent and the hardware layer.

A method that exploits minute variations in the Web Audio API signal processing chain. A script generates a low-frequency oscillator signal and processes it through a dynamics compressor. The resulting audio buffer hash is determined by the specific floating-point arithmetic and hardware-level sound stack of the device. Key differentiators include:

• Sample rate precision
• Oscillator implementation drift
• Dynamics compressor curve variations This technique is highly stable across sessions and is effective even when other fingerprinting vectors are blocked.

A passive technique that detects the list of system-installed fonts to build a unique device profile. By measuring the width of rendered text strings in various fallback fonts, a script can determine which fonts are present without requiring elevated permissions. The combination of installed fonts is highly individual, especially in enterprise environments with proprietary typefaces. This vector is often combined with canvas fingerprinting to amplify entropy, as the specific glyph rendering of installed fonts further differentiates the canvas hash.

A dynamic layer that augments static fingerprinting by analyzing human interaction patterns in real-time. While browser fingerprinting identifies the device, behavioral biometrics verifies the user. Signals analyzed include:

• Mouse movement trajectories: Curvature, velocity, and acceleration profiles
• Keystroke dynamics: Dwell time and flight time between key presses
• Touch pressure and gesture patterns on mobile devices
• Scroll behavior and pause cadence Automated scripts typically produce linear, instantaneous, or perfectly uniform interactions that diverge statistically from organic human motor control, triggering a high-risk classification.