Each trait alone is ordinary; together they single you out among millions. That is why a site "recognizes" you after you switched IP with a VPN and cleared cookies: the address changed, the device did not.

What goes into it

Roughly in order of how much each one distinguishes you:

• Canvas and WebGL. The site has your browser quietly draw an image or a 3D scene. Different GPUs, drivers and systems produce slightly different output, and a hash of it is a stable, unique identifier.
• Fonts. Which fonts are installed, inferred by measuring text widths. A machine with office and design software has a rare combination.
• Audio. The AudioContext API processes a signal; the result depends on hardware.
• Screen and window: resolution, color depth, pixel ratio, window size.
• Language, time zone, OS, browser version. A time zone that does not match the IP is itself a notable combination.
• Extensions: an ad blocker changes the page structure and reveals itself.
• Hardware: CPU cores, memory, touch points, battery API.

None of this is related to your IP. That single fact drives every conclusion below.

Why a VPN does not hide it

A VPN works at the network layer: the site sees the server's address instead of yours. The fingerprint is produced at the application layer: the browser itself reports these traits.

The site sees "a new IP, but the same fingerprint as yesterday's visitor" and links the visits. This is not a flaw in the VPN; it is a division of labor. The VPN handles where you come from, the fingerprint handles which device this is. What the VPN does cover is in what can my ISP see.

How to check yours

• Our tool. The Privacy Checker lists what your browser reveals without looking at the IP, and which traits make you stand out.
• Third-party tests. EFF's Cover Your Tracks tells you how unique you are among recent visitors; AmIUnique and BrowserLeaks show the value of each trait. Try more than one; their sample sets differ.
• A comparison. Test in normal mode, in a private window, and with the VPN on. If the fingerprint hash is identical in all three, you have seen the problem: private mode and VPN do not affect it.

How to be less recognizable

Two approaches: look like everyone else, or look different every time.

• A mainstream configuration. Current Chrome or Safari, default window size, system and browser language matching, few extensions. The more ordinary, the safer, which runs against intuition.
• A browser that resists fingerprinting. Firefox with strict tracking protection and privacy.resistFingerprinting returns uniform values for canvas, time zone and fonts; Brave adds random noise to canvas and audio so each site sees a different fingerprint; Safari reports a simplified configuration to all sites.
• Tor Browser: every user looks the same. The most thorough option, at the cost of speed and compatibility.
• Separate identities. For anything that should stay unlinked, use a separate browser or profile with no logins to personal accounts. A unique fingerprint is useless if it is not tied to a name.
• Fewer permissions. Location, camera, notifications, Bluetooth: each grant is a new trait.
• Do not overdo it. Disabling JavaScript or faking a rare user agent makes you more unique, not less. The goal is to disappear into the crowd.

IP, cookies, fingerprint: three independent layers

Sites use all three: if the IP changed, they check cookies; if cookies are gone, they check the fingerprint. Handling one layer alone does little.

When it matters

For everyday browsing, it is not a reason to panic: fingerprints are mostly used by ad networks for cross-site tracking, and the effect is which ads you see.

Take it seriously when two accounts must not be linked, when you use a shared or work computer for private matters, or when research needs it. Then "VPN + resistant browser + separate identity" work together. What your IP alone reveals is in what can someone do with my IP address.

We're the team behind 404 VPN. It covers the network layer (VLESS or WireGuard tunnel, DNS inside it, kill switch); the browser layer is yours. The free Privacy Checker and What Is My IP are there to check against, no sign-up.

Originally published on the 404 VPN blog.