Browser fingerprinting: what 12 check groups read from a browser

A page that wants to know who is visiting does not need a cookie. It can read the graphics card, the fonts, the screen and the language settings, and in most cases the combination is enough to recognise a browser again. For an AI agent the more urgent question is the reverse one: whether those values describe a machine that could exist. This guide walks through what a fingerprint reads and which values have to agree with each other.

What is browser fingerprinting?

Browser fingerprinting is the practice of reading values a web page can query, without asking and without storing anything, and combining them into a description of the device. Two things carry the name: the activity of reading and comparing, and the set of values that comes out of it. The research project AmIUnique, maintained at Inria by "a team of researchers, who investigates the software monocultures and software diversity on the web", shows visitors their own fingerprint; companies such as Fingerprint sell the same reading as a service for fraud and bot detection.

Which values does a fingerprint read?

A fingerprint reads values from the drawing stack, the operating system and the network, and each of them has to agree with at least one other value. The table lists the eight surfaces a checker compares most directly.

Why does coherence matter more than uniqueness?

Coherence matters more because a value shared with many machines is ordinary, while a value that contradicts another one exists on no machine at all. We learned this on canvas. We gave each profile its own canvas by adding a small seeded offset to every pixel read back, and five of five profiles on one machine got distinct hashes. A public checker flagged the canvas as manipulated anyway, because no graphics card draws a flat region with that kind of variation. The honest value, shared by every machine with the same card and driver, drew no flag. The guide to canvas fingerprinting shows both readings side by side.

A checker therefore does not need to know what your values should be. It only needs to put two of them side by side, and that is also how a fingerprint feeds bot detection: it is one of four detection layers, and a contradiction on it adds to a score that the connection, the control plane and the input feed as well.

What does a graphics card give away?

A graphics card gives away its name through WebGL and its identity through the pixels it draws, and a checker compares the two. A browser without a graphics card draws in software, and Kernel's own bot detection documentation describes the result: "Software-rendered browsers produce pixel hashes that don't match any real consumer GPU, which is a strong bot signal on sites with rendering-based fingerprinting." A renderer string that names a real card over software-rendered pixels is a contradiction of the same kind.

What do fonts and voices give away?

Fonts give away the machine through two separate readings: the list a page can enumerate and the fonts it can draw with. On 12 September 2026 we compared both on one Windows machine for four browsers.

The persona list claimed one set of fonts while the renderer drew from another, and a page that measures both sees it in a single comparison. We withdrew the list; the engine now lists the machine's own fonts. Speech voices follow the same logic over time: real Chrome on Windows reports 0 voices when the page loads, then 40, of which 21 come from the operating system and 19 are Google's network voices. A list that is complete at page load, or that lacks the local voices, describes no real Chrome.

What does the user agent give away?

The user agent gives away the browser version, and a version can be wrong in two directions: spoofed away from the engine, or frozen while real Chrome moves on. On 10 September 2026 our newest engine was Chrome 151 while real Chrome on the same machine was already 153.0.8010.37. The version string, the client hints and the TLS handshake all come from the engine, so changing one of them alone creates a contradiction with the others.

Where can you test a fingerprint?

Test a fingerprint by comparing it with a browser you trust on the same machine, not by reading a score from one of the fingerprint test sites in isolation. Open our account-free check page once in the browser your agent uses and once in your everyday Chrome: it reads 12 check groups and marks every group in which two values contradict each other. The test your setup page of the documentation lists the other ways to measure, including an audit that runs a profile against real detector sites.