Fingerprint Lab · Encyclopedia

Every fingerprint, explained

What each signal is, how sites read it, how risk engines cross-check it — and how Mango Browser handles it.

Identity

3 entries
User-AgentThe oldest identity string — sent as a header and readable from JavaScript, and cross-checked against everything else.Client HintsThe structured successor of the UA string: platform, version, architecture, bitness — sent as headers and readable from script.Operating systemClaimed in three places and implied by a dozen more: fonts, GPU names, voices, touch, platform strings.

Network

2 entries
IP addressWhere your traffic comes from — geolocated, scored by ISP type and compared with every locale signal.WebRTC leakUDP candidate gathering bypasses HTTP proxies and can reveal your real public and local IP.

Locale

2 entries
TimezoneThe single most-used proxy detector: does the browser's clock live where the IP lives?LanguageThree language declarations that must describe the same person, and should be plausible for the IP country.

Hardware

6 entries
ScreenResolution, available area, pixel ratio and colour depth — cheap entropy with strict internal rules.CPU coresLogical core count. Small entropy, but implausible values are an instant flag.Device memoryRAM rounded by the browser to a tiny set of values — any other number was typed by a human.WebGLGPU vendor and renderer names plus ~60 capability parameters and a rendered image hash.WebGPUThe newer GPU API exposes vendor, architecture and hundreds of limits — and must agree with WebGL.Media devicesHow many cameras, microphones and speakers exist — countable without permission.

Rendering

5 entries
Canvas fingerprintA hidden drawing hashed into an ID — one of the most stable signals a site can get without asking.AudioContextAn oscillator rendered offline yields samples that differ by audio stack — and a silent one must yield exact zeros.Client rectsSub-pixel layout of a transformed element — a font-and-engine signature that must be stable.FontsInstalled fonts are probed by measuring text. The set says a lot about the OS and the person.Speech voicesText-to-speech voices carry OS-specific names and counts.

Privacy

3 entries
Do Not TrackA tiny privacy flag that is itself a bit of entropy — few people turn it on.Cookies & storageNot a fingerprint but the thing fingerprints replace — and the reason profiles must be isolated.Automation signalsWebDriver flags, framework globals and DevTools-protocol tells that mark a driven browser.