How to Reduce Browser Fingerprinting
Check what your browser shares before you change anything. Then change one setting, see if your usual sites still work, and run the same check again. The goal is to make visits harder to link across sessions.
Measure, change, recheck
Run a check before you change settings
- Measure. Open Desk in the browser and profile you normally use. Choose Meet your browser and note a few of the values it shows, such as language, timezone, viewport, and canvas. You can do this without granting camera, microphone, or location access.
- Change. Follow the steps for your browser below. Change one setting at a time, reload when prompted, and try a site you need, such as your email or a video player.
- Recheck. Run the same Desk check in the same profile. Keep the window size, zoom, and device the same if you’re comparing results. If you switched browsers, compare both on the same device. An unchanged value doesn’t prove a defense failed: blocking a tracker on another site may not change anything Desk reads. A different value doesn’t prove you’re harder to identify.
How the defenses work
Can you stop browser fingerprinting?
You can stop some scripts from running and make the signals they read less useful. There’s no setting that stops every site from recognizing a working browser. A page can combine small clues about your screen, graphics, fonts, or language with what it already knows about your visits.
When a tool promises to protect your browser fingerprint, ask what it actually changes. Blocking a script, giving it less information, and changing the answer it gets are different defenses.
- Block the script
- What it doesA tracker blocker stops a known resource from loading.
- What it missesCode the site runs itself, or a script the blocker misses, can still read signals.
- Expose less
- What it doesThe browser withholds or rounds off details, such as a hardware or screen measurement.
- What it missesThe remaining signals may still distinguish your setup.
- Make users look alike
- What it doesThe browser gives many users the same answers. Tor Browser, for example, groups viewport sizes.
- What it missesUnusual customizations can make you stand out from that group.
- Vary selected answers
- What it doesBrave changes some API outputs so a value read in one context is less useful in another.
- What it missesOther signals and account logins can still connect visits.
Everyday browsing
Pick protections you’ll leave on
Firefox: a good everyday choice
On desktop, open Menu → Settings → Privacy & Security → Enhanced Tracking Protection → Strict. Reload your tabs when prompted, then try a familiar sign-in and video. Firefox blocks known fingerprinters and limits what suspected ones can read under stronger protection settings. If a site breaks, use the shield beside its address to review protection for that site before changing your global setting.
Advanced: Resist Fingerprinting. On desktop Firefox, open about:config, search for privacy.resistFingerprinting, and set it to true if you want to test it in a separate profile. It standardizes the reported timezone to UTC, limits font exposure, and changes how sites can read canvas output. That can affect calendar displays, fonts, or web apps that use canvas. If it gets in the way, reset the preference in about:config. Strict tracking protection is the easier place to start.
Review Firefox settings in Desk →
Brave: keep Shields and fingerprinting protection on
Open Settings → Shields → Block fingerprinting and leave it on. On a site, open the lion icon beside the address to check that Shields is up. Older guides call the default fingerprinting protection Standard and describe a separate Strict mode. Brave retired that Strict fingerprinting mode. A stricter setting for blocking trackers and ads is a separate control.
Brave blocks known tracking resources and randomizes selected browser API results, a technique it calls farbling. For example, a site reading back pixels from a canvas can get a slightly altered result. Some changes depend on the site and session, so the same script can’t count on getting the same value across contexts. That doesn’t mean every signal changes or every visit becomes unlinkable. Check the global Shields setting and any exceptions you’ve made for individual sites.
Review Brave settings in Desk →
Safari: check where protection applies
On a Mac, open Safari → Settings → Advanced → Use advanced tracking and fingerprinting protection. Where the menu offers it, choose All browsing to extend protection beyond private windows. Reload and check a familiar site.
Review Safari settings in Desk →
Chrome: use it where you need it
If you can switch, start with Firefox or Brave. Keep Chrome for sites that require it. Open chrome://extensions, remove what you don’t use, and review site access under Details for what remains. A reputable content blocker can stop some known tracking scripts. Incognito separates local session data, but a site can still run scripts and read browser signals.
Extension checkup
Before you give an extension access to a page
Extensions can help by stopping trackers. They can also read or modify pages if you grant access, and some leave detectable traces. Start by removing extensions you don’t use. For the ones you want to keep, check the following:
- Find the real publisher. Start from the project’s own website or repository and follow its store link. Check that the maintainer is identifiable and still publishes fixes. A high install count doesn’t tell you who controls the next update.
- Match permissions to the job. A blocker may need broad access to work everywhere. A tool for one website usually doesn’t. Read the requested permissions, then restrict site access to specific sites or on click where your browser supports it and the extension still works.
- Check what leaves the device. Look for a plain explanation of what the extension collects, why it needs it, and where it sends it. Check whether telemetry is optional. Open source is useful for inspection, but it doesn’t guarantee that someone has reviewed the version you installed.
- Be skeptical of a stack of spoofers. A canvas spoofer, a user-agent switcher, and a font blocker can each change a value while leaving the rest of the browser inconsistent. Start with the browser’s protections and add a tool only when you can explain what gap it fills. Review new permission requests after updates.
Separate your browsing
Give each kind of browsing its own place
- Everyday: Use your default Firefox or Brave profile for reading, searching, and ordinary browsing. Keep built-in protections on.
- Accounts: Put email, work tools, banking, and social accounts in a separate browser or profile. Give it a name and distinct icon so you can tell where a link opened. Firefox containers can help separate sign-ins within one profile.
- Sensitive activity: Use Mullvad Browser or Tor Browser with its defaults. Keep sync, personal logins, and everyday extensions out of this context. Open links there intentionally instead of letting a messaging app pick a browser for you.
Signing into the same account gives that service a direct way to link the contexts, even if your IP and browser signals differ. Separate profiles isolate cookies and sign-ins. They don’t necessarily change the underlying fingerprint.
What still connects visits
Change the setup as a whole
Keep the signals coherent. A VPN exit in Germany doesn’t change your Denver timezone or en-US locale. That combination can be perfectly normal, but it doesn’t make the browser look like a different device. Similarly, claiming to be Safari on a Mac while exposing graphics behavior and fonts from a Windows Chrome setup can make a spoofed profile easier to flag. Prefer coordinated browser protections over manually forcing signals to match an exit country.
Connection: A VPN changes the public IP seen by the sites whose traffic it carries. It doesn’t change the canvas, fonts, graphics, or other browser APIs a page reads. See what a VPN does and doesn’t hide.
Scripts: On a site you only need to read, blocking JavaScript can stop many browser API probes. It can also break navigation, forms, and media, and the server still receives your request headers and network traffic. Start with a site-specific rule so you can undo it when you need the site to work.
Don’t bother with: User-agent switchers as a standalone defense, stacks of randomizers, or antidetect tools that sell a rare custom setup as anonymity. Changing one label leaves other clues intact, and a unique profile can still be recognized. Skip anything that promises invisibility. Use local demos to inspect specific changes, not to certify the whole setup.
These steps address browsing. They won’t change identifiers available to a native app, what a service already knows about your account, or the profile it built before you made the change.
On your phone
Most iPhone browsers use WebKit; alternative engines are permitted in some regions under specific conditions. Don’t assume the desktop version’s protections are there just because the app has the same name. In Safari, look under Settings → Apps → Safari → Advanced → Advanced Tracking and Fingerprinting Protection and choose All Browsing if offered. On Android, start with Brave or Firefox and check their tracking settings. Open links from social or messaging apps in your chosen browser when you want its protections; an in-app browser may have different settings and storage.
When you need more separation
When to use Mullvad Browser or Tor Browser
For everyday browsing, start with Firefox or Brave and keep the setup simple. If you want a separate desktop browser designed to make many users look alike, use Mullvad Browser with its defaults. It doesn’t require a Mullvad VPN account and doesn’t route through Tor. Use a VPN separately if you want sites to see a VPN exit address instead of your own.
If you also want sites to see a Tor exit instead of your source IP, use Tor Browser. Keep its defaults, skip extra extensions, and avoid personal sign-ins for activity you want to keep separate. Some sites challenge or block Tor traffic. Tor Browser covers its own traffic, not your other apps.