A guide to browser fingerprint testing
Understand Canvas, Audio and device characteristics, and distinguish a sample digest from a permanent identity.
What is a browser fingerprint?
A browser fingerprint combines characteristics exposed by a browser and device. Canvas output, audio calculations, fonts, screen properties and platform declarations may help websites distinguish environments.
CHA.LA shows a digest of selected fields and compares repeated samples. Without a cross-user distribution, it cannot produce a reliable uniqueness percentage. The digest is not an identity document, hardware serial number or permanent device ID.
Stable output and resistance to tracking are different properties.
Four things to read separately
Digest, stability and availability have distinct meanings. They are not combined into an unsupported privacy score.
- Fingerprint digest
- SHA-256 summarizes selected fields as a fixed-length string. It helps compare inputs but does not show how unique you are in a population or identify you as a person.
- Samples match
- Canvas or Audio outputs matched during this collection. Stability is not a privacy guarantee: stable characteristics can also help correlate visits.
- Samples differ
- Privacy randomization, extensions, rendering state or environmental changes may explain differences. This does not by itself establish a fault, abuse or successful prevention of tracking.
- Unavailable or limited
- Policy, API support or a collection failure prevented access. Restrictions may be intentional. One missing characteristic does not prove that other signals cannot be correlated.
Make comparisons that mean something
Document the conditions instead of repeatedly chasing a different hash.
Keep a baseline
Record the browser version, configuration, digest and individual sample states. A final hash alone cannot show which characteristics changed later.
Change one factor
When comparing an extension, privacy mode or setting, keep other conditions constant. Updates, installed fonts and screen changes can all affect the output.
Check compatibility
Restricting Canvas, WebGL or audio can affect charts, meetings and web applications. Prefer supported privacy settings and verify that needed features still work.
Inspect network signals too
A VPN usually changes the network exit, not every browser characteristic. Review WebRTC, DNS and device information separately when assessing exposed information.
How does CHA.LA run this check?
The current implementation draws the same Canvas five times and performs three offline audio calculations, comparing available output digests. WebGL exposes rendering details allowed by the browser. Font detection measures text width against a defined candidate list.
Selected browser, device and rendering fields are combined locally into a SHA-256 digest. The detected font list is not a complete system inventory. Audio sampling uses a synthesized offline signal, not microphone recording, and needs no camera access.
Frequently asked questions
Private browsing, VPNs, changing digests and privacy settings.
Is fingerprinting the same as a cookie?
No. A cookie is stored data, while a fingerprint combines observable characteristics. Deleting cookies does not necessarily change fonts, screen properties or rendering output. Whether a site can correlate visits depends on its collection method and other information.
Does the same fingerprint prove it is the same person?
No. Similar configurations can expose the same selected fields. A matching digest only means these inputs were not distinguished. Shared devices, identical configurations and missing fields prevent it from being an identity proof.
Will changing VPNs change the fingerprint?
Not necessarily. This digest does not directly include the public IP, but it includes language, time zone, screen and rendering fields. A network exit change and a browser fingerprint change are separate events.
Does private browsing prevent fingerprinting?
There is no general guarantee. Private browsing primarily changes session storage behavior, while many device and rendering characteristics may remain visible. Anti-fingerprinting behavior varies by browser and must be evaluated separately.
Why did the hash change after a retest?
Updates, screen or window changes, fonts, language settings, extensions and randomization can alter input fields. Compare the original values and stability results before drawing a conclusion. A changed hash alone is neither a failure nor proof of privacy.
Does the Audio test listen to my microphone?
This implementation does not. It synthesizes and processes samples with OfflineAudioContext without recording external sound or requesting microphone access. Other websites may behave differently, so review their permissions and policies separately.