Academy
The fingerprint part by part
Lesson 3 of 14
The parts a page reads
A page does not read a fingerprint. It reads a set of answers and compares them, and the parts differ in how much each one narrows the crowd.
The free check on this site reads 12 of them in your own browser. Here is what each part is worth.
| The part | What the page gets | How much it separates |
|---|---|---|
| Canvas | A hidden drawing as a hash | High. Outlives cleared storage |
| WebGL | Two names and a rendered frame | High. The frame narrows further |
| Audio | A tone rendered offline and summed | High. Nothing is heard |
| Fonts | Which families answer a width test | High on a stocked desktop |
| Devices | Microphones speakers and cameras counted | Moderate on its own |
| Cores and memory | Two rounded numbers | Low alone strong beside the card |
| Clock and language | The zone and language stack | Decisive beside the address |
| Screen | Size and pixel ratio | Moderate and easy to contradict |
Canvas and the two readings
A site draws text into a canvas nobody sees and reads the pixels back. The same graphics stack and the same fonts give the same bytes on every visit.
In a profile the shift on those pixels follows the seed, the pixel coordinate and the colour of that pixel.
Two rectangles agree
One pixel read inside two different rectangles comes back the same both times.
Transparency stays transparent
A clear pixel keeps no colour, which is a state no real browser reaches.
A learned mask does not transfer
The shift depends on the colour underneath, so a pattern taken from one drawing misses the next.
Nothing is fresh per call
Two reads in one profile match, because a value that changes each time is a signal itself.
The card name and its limits
The graphics card answers with a vendor name and a renderer name, and a profile takes both from a pool of cards that were manufactured. The cores the memory and the system version follow that choice.
The frame it draws is read back through more than one road, and the roads have to agree. The picture taken straight out of the graphics buffer and the same picture copied onto a canvas come back identical.
What is not rewritten is what the card says about itself. Texture limits and the list of extensions belong to the machine running the browser.
The audio path
An audio fingerprint is a tone rendered offline through a compressor and summed into one number. Nothing plays and no permission is asked.
In a profile that sum moves by an amount derived from the seed and from each sample. Silence is left alone and the same profile sums to the same number twice.
Fonts and the width test
A page renders a string in a family it names and compares the width with the fallback. Equal width means the font is absent, and the installed set says a great deal about the owner.
A profile claims the families its platform always ships plus a seeded part of the optional ones.
The generic families are backed
Cursive fantasy math and monospace each resolve to a real face, because a machine where they collapse into one does not exist.
The set varies and the order does not
Order follows the platform list, so what differs between profiles is which families answer.
Second names are covered
The same font file answers to an internal name as well, and hiding one of the two would be visible.
Devices and voices
Cameras microphones and speakers answer with a count long before permission is granted. Speech voices are an inventory of the system and carry its languages.
A profile reports its own counts and only the voices of its own language. Nothing is added to the machine: a device that is listed and then fails to open is worse than one never listed.
Hardware counts and the screen
Cores and memory are coarse numbers that the browser rounds before any page sees them. Alone they say little, and beside the graphics card they say whether such a machine could exist.
So a profile draws them from the set the chosen card ships with, and the memory limit a page can measure follows the declared memory rather than yours.
Screen size and pixel ratio are checked against panels that exist. A pair that implies a monitor nobody makes is neither offered nor generated.
The clock and the language
These two are the cheapest parts to read and the most decisive beside an address. A Berlin exit with a Moscow clock is a mismatch no device value can cover.
When a profile has a proxy the exit country decides both, and a country with several zones spreads them so a hundred addresses do not read as one city.
Pick one by hand and the other follows: a hand chosen Tokyo clock pulls the Japanese language stack with it.
Why the parts agree
None of this is kept as a stored list of values. Every part is worked out again from the profile and its template at each start, so there is no second copy to fall out of step.
The self test inside the app reads 29 answers back from a real page. Some of its lines look for the machine and some for the substitution itself.
What this lesson does not claim
- It does not list every reading a page can take. It names the parts that separate one machine from another.
- The graphics limits and the extension list are not rewritten. Those numbers belong to the machine running the browser, so a card name far from the installed one is the weaker choice.
- Media devices are trimmed and never invented. A computer without a camera still reports none.
- None of this touches behaviour or account history. Accounts that act alike are linked without the device being read.
Where you can see this yourself
Each claim here is one place in the code and one stand you can run.
- Every part is derived from the profile and the parts agree with each other
- packages/shared/src/index.js · apps/desktop/test/fingerprint-consistency.js
- The 29 answers the app reads back inside a profile
- apps/desktop/src/lib/fpAudit.js · apps/desktop/test/fp-audit.js
- The picture noise sits after the real pixel read and carries the buffer height
- apps/desktop/test/engine-patches-real.js
- The free check that reads 12 values in your browser
- apps/web/components/tools/FingerprintCheck.tsx
Questions
- Does the canvas noise change on every read?
- No. Two reads in one profile return the same bytes: a value that is fresh each time proves the browser is altering it.
- Can I set a part by hand?
- Yes, from lists rather than a text box. Values that depend on your choice follow it, so a card brings its own cores and memory.
- Why does my profile name a card I do not own?
- Because the name has to belong to a card that exists, and yours is one of many. The frame it draws is covered separately.
- Will the same profile answer the same on my second computer?
- Yes. The answers are derived from the profile instead of stored beside it, so the machine travels with the profile.
- Why do older profiles keep the older rules?
- A change in the rules would hand a profile warmed for months a different machine, which reads like a takeover. Each profile keeps the generation it was created with.
See every value of one profile
The fingerprint page names each part and shows what you may change.