Trackers don't need cookies to recognize you. Your browser exposes dozens of small differences — GPU quirks, font rendering, audio stack — that combine into a near-unique signature.
Plain attributes the browser advertises on every request and via JavaScript. Trackers stitch a handful of these into a stable ID.
Computing…
Even without canvas or audio, a tracker can use this set of attributes as a coarse fingerprint. Tor browser intentionally normalizes most of these fields across users.
Different GPUs, OS font-rendering stacks, and graphics drivers produce subtly different pixel buffers when drawing the same canvas. Hashed for compact identification.
Computing…
Stable across page loads from the same browser+OS+GPU. Differs by browser version, OS, GPU driver, font stack. Tor and Brave can be configured to randomize the canvas readout per session.
GPU vendor and renderer string. Modern Chrome and Firefox usually mask these unless WEBGL_debug_renderer_info is available; behind certain anti-fingerprint extensions they're spoofed.
Computing…
Vendor + renderer often pinpoint the exact graphics card. When masked, the absence of detail is itself a signal that anti-fingerprinting is active.
A tiny offline audio render through a dynamics compressor. Floating-point output diverges by audio stack and CPU enough to identify families of devices.
Computing…
Less variable than canvas but still differs across CPU architectures and audio frameworks. Combined with the other surfaces, narrows you to a small population.
Cookies and IP addresses are the obvious tracking surfaces. Browser fingerprinting is everything else. The combination of fields above — even excluding the more invasive canvas/WebGL/audio readouts — is enough to identify a return visitor with high confidence among the population of users on the same site. The Electronic Frontier Foundation's Panopticlick study (2010) and its modern successor Cover Your Tracks show how many bits of identifying information each surface contributes. Canvas alone reaches 17+ bits — combine three or four surfaces and a unique ID falls out for almost everyone. Defences exist but trade-offs are real. Tor browser normalizes everything but is slow and limits which sites work. Brave randomizes canvas and audio readouts per-session but can't hide CPU/screen/timezone. Firefox's privacy.resistFingerprinting helps but the spoofed values are themselves a signal.
Technical tool for diagnosing the quality of a network connection. Does not provide means of access to information resources whose access is restricted under applicable law.