Skip to contentExploitQuest
Join free
LearnAnonymity & OpSec

How a Browser Recognises You Without Cookies

You cleared your cookies and went incognito. A tracker still knows it is you. Here is how — and why "more privacy tools" can make it easier, not harder.

4 min readNot yet reviewed
Wrenlearner

I delete my cookies, I use private mode, and I still see adverts for the thing I searched once. How?

Magpieadversary

Because I was never relying on the cookie. Your browser introduces itself in enough small ways that I do not need one.

Rookmentor

This is browser fingerprintingBrowser fingerprintA near-unique profile of your device built from the small ways your browser differs from everyone else's — no cookies required., and it is the reason "just clear your cookies" stopped being real advice about a decade ago.

The introduction you did not know you were making

Every request your browser makes carries a crowd of small details: the exact version, your screen size, your timezone, your language, your fonts, how your graphics card draws a shape. Any one is common. Combined, they are often unique — a fingerprint that needs nothing stored on your device.

User-Agent      : Firefox 128 on Windows 11
Screen          : 2560 x 1440, 150% scale
Timezone        : Europe/London
Language        : en-GB, then fr-FR
Fonts           : 214 installed, including three unusual ones
Canvas render   : hash a1b2... (how your GPU drew a test image)
  1. Line 4en-GB then fr-FR is already uncommon. Each "normal" detail narrows the crowd you are hiding in.
  2. Line 5Those three unusual fonts might be installed by one piece of software almost nobody else runs. Rarity is what identifies you.
  3. Line 6The same drawing instructions produce a subtly different image on different hardware. That difference is stable, and it is you.

If none of this is stored on your machine, why does deleting cookies and using private mode not help?

Two people want to be hard to fingerprint. One installs twelve privacy extensions and a custom font pack. The other uses a stock browser exactly as it shipped. Who is more identifiable?

What actually reduces it

Looking armoured

- A dozen privacy extensions, each subtly changing your signals
- A hardened, exotic configuration nobody else runs
- Constantly toggling settings, so you look different every visit

Looking ordinary

- A browser many other people use, left close to default
- The anti-fingerprinting mode its makers built and tested (e.g. Tor Browser,
  which makes users look identical on purpose)
- Changing as little as possible, so you blend into the largest crowd

The goal is not zero signals — that is impossible. It is to share your signals with as many other people as you can, so "you" is not a group of one.

Wrenlearner

So the privacy-extension shopping spree was making it worse.

Rookmentor

For fingerprinting, often yes. A single good ad-and-tracker blocker helps by cutting the number of parties measuring you. A pile of niche tools mostly makes you rarer.

Magpieadversary

From my side: give me a plain browser in a crowd of millions and I struggle. Give me the "privacy enthusiast" with the unique stack and I have you on sight.

A rough sense of how rare you are
# tools like the EFF's "Cover Your Courses" estimate your uniqueness
Your browser fingerprint appears to be unique among the sample tested.
One in 250,000 browsers share your combination of values.
# "unique" is bad here: it means you can be followed across sites

Legal

Understanding fingerprinting protects you and helps you test systems you are authorised to. Using these techniques to deanonymise or course other people is surveillance and outside the bounds of this course.

So the browser recognises you not by what it stored, but by how your device is shaped. Match this to your threat modelThreat modelFour honest answers: what you are protecting, from whom, what happens if it fails, and how much trouble you will go to.: against advertisers, a good blocker and a common browser go a long way; against a serious adversary, you want a browser built so everyone looks the same, and — when it truly matters — TorTorA network that bounces your traffic through three volunteer relays so no single one knows both who you are and what you are visiting. over the plain network. Next: cookies, storage, and the other half of tracking that does live on your machine.