VPN vs Browser Fingerprinting  

Why A VPN Alone Cannot Help

If you browse without a VPN, your IP address is fully exposed, which by itself can make your system uniquely identifiable. Using a VPN is therefore an important first step for protecting your privacy: it masks your IP and shields your activity from your ISP. However, a VPN alone is not enough. Most core browser fingerprinting techniques do not rely on IP addresses, which means that even with a VPN active, your device can still be uniquely identified.

To demonstrate this, we collected fingerprint data using amiunique.org, a service developed by the French National Institute for Research in Digital Science and Technology. These were collected from the same Windows PC while connected through four different VPNs (all set to U.S. West Coast servers) and once without any VPN:

• Mullvad
• NordVPN
• Proton
• TunnelBear Free

In every case, the fingerprint we hashed from the collected data remained completely unchanged.

One noteworthy observation was the timezone code. Even when connected through a VPN endpoint on the U.S. West Coast, the fingerprint still reported our local Eastern North American timezone offset of +240 minutes. This happens because the timezone captured during fingerprinting reflects the system clock, not the IP address.

This discrepancy between system timezone and VPN endpoint location can actually make VPN usage more detectable. While a VPN can successfully conceal your IP address, it does nothing to hide the much richer set of attributes exposed by browser fingerprinting.

How To Make Your Fingerprint Less Unique

If VPNs are only a first step, what else can you do to protect your privacy? The challenge with browser fingerprinting is that it collects far more than just your IP address. Websites can learn details about your device and browser settings that, when combined, make you stand out. You can't completely avoid this because this exchange of information is how the modern web is built, but you can make your fingerprint less unique and therefore harder to track.

Broadly speaking, there are two approaches:

1. Standardize your fingerprint so it looks the same as many others.
2. Randomize your fingerprint so it looks different every time.

There isn't a single best option. As is often the case with privacy protection, it ultimately comes down to striking the right balance for your own privacy needs and tolerance for inconvenience.

Standardizing Your Browser Fingerprint

One way to reduce uniqueness is to standardize your fingerprint so it looks the same as many others. Some privacy-focused browsers, like the Tor Browser and the Mullvad Browser, purport to do exactly this. They attempt to limit the amount of information websites can collect by forcing standardized values, a strategy that can make it much harder to single you out.

To see how this works in practice, we compared fingerprints collected by amiunique.org from Chrome, Mullvad, and Tor running on the same laptop. Even at a glance, you can see how Tor strips away or spoofs many of the attributes that make Chrome look unique:

Attribute	Chrome	Mullvad (Default Settings)	Tor (Default Settings)
Screen Resolution	1280 x 720	1200 x 500 (letterboxed)	1200 x 500 (letterboxed)
User Agent String	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36 Edg/139.0.0.0	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0 (spoofed)	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0 (spoofed)
HTML5 Canvas Fingerprint		(spoofed)	(spoofed)
WebGL Rendering		(blocked)	(blocked)
Languages	en-US,en;q=0.9,fr;q=0.8,en-CA;q=0.7,fr-CA;q=0.6	en-US,en;q=0.5 (standardized)	en-US,en;q=0.5 (standardized)
Timezone Code	+240	+0 (standardized)	+0 (standardized)

What this table shows is the potential power of standardization. Chrome reveals your real setup in detail, while Mullvad and Tor force most users to appear the same. For example, your browser window is letterboxed into fixed sizes, your languages are generic, and WebGL rendering is blocked.

There are trade-offs, however. Using a less common browser like Tor or Mullvad may itself make you stand out if adoption is low. And while default settings allow JavaScript (which most websites need), enabling Tor's highest "Safest" mode blocks JavaScript altogether, giving you stronger privacy at the cost of breaking many modern websites.

Randomizing Your Browser Fingerprint

Another strategy is to randomize your browser fingerprint so it looks different every time you visit a site. The idea is that if your attributes keep changing, it becomes much harder to link your browsing sessions together.

The Brave Browser takes this approach by default. Instead of making every user look the same, it shuffles certain identifying attributes for each session. To see this in action, we collected fingerprints from amiunique.org across two Brave sessions on the same machine.

These results show how Brave alters key attributes from one session to the next. The canvas fingerprint, WebGL rendering details, and installed fonts all shifted between visits, making it theoretically harder for a website to reliably link the two sessions to the same user.

As with standardization, there are trade-offs. Brave is a less common browser than Chrome or Firefox, which means simply using it may already make you stand out. And in its default mode, Brave's randomization is seeded with your true values. Therefore, while the reported attributes look different from session to session, the underlying originals could still be inferred. Switching to “Maximum” security avoids this by fully randomizing the attributes, but that stronger protection comes at the cost of breaking many websites.

Our Recommendations

Ultimately, digital privacy is always about trade-offs: how much risk you're willing to accept, how much usability you're prepared to give up, and what level of peace of mind you want. There's no single "best" approach, only the balance that works for you. Generally, we suggest using a VPN alongside a privacy-oriented browser (such as Brave, Mullvad, or Tor). You can see our up-to-date list of recommended VPNs here.

If you're extremely privacy-conscious, Tor Browser on the 'Safest' settings may offer the strongest protection, but at the steep cost of breaking many websites. Also, stay mindful that using a VPN along with Tor Browser can break the anonymity provided by the Tor Network if misconfigured. To learn more about how to set it up correctly, we recommend this guide from PrivacyGuides.org. For most people, Brave in its default mode strikes a more practical balance. However, it's worth remembering that Brave's smaller user base may itself make you stand out and that its default randomization is still seeded by your true values.

Another effective strategy is to use more than one browser. For example, you might rely on Mullvad or Tor for everyday browsing where you aren't logging into any website. In this case, you're just a person, part of the masses browsing the web without much personal info attached to you. Use a second browser like Brave or Firefox (with appropriate security settings) to log into your accounts or access trusted websites where you don't mind being identified. Splitting your browsing this way reduces the amount of data any single browser reveals and minimizes data associated with your accounts, giving most users a reasonable balance between privacy and usability.

Fingerprinting Our Colleagues' Browsers

Given how powerful browser fingerprinting can be, we wanted to see just how identifiable we might be when going online using the same small set of Windows work laptops. At RTINGS.com, our laptops are purchased in batches with identical specifications as the company has grown. This means we have anywhere from a single unit of a particular model to more than a dozen of the same model, as illustrated in the histogram below:

For our experiment, each colleague collected information about their laptop and its browser fingerprint. To keep conditions consistent, we asked everyone to unplug peripherals such as external monitors, keyboards, or mice. System-level information was exported directly from Microsoft Windows "System Information."

To capture the kind of data a website can actually observe, participants visited amiunique.org. Each person used their everyday web browser, ensuring the results reflected a realistic, real-world browsing environment.

Once collected, the data was collated and analyzed using Python scripts. For fingerprint attributes that contained multiple values (such as lists of installed fonts or browser permissions), we standardized them by creating ordered, concatenated strings and hashing the result. This gave us single, comparable values for analysis.

The Web Operates On Exchanging A Lot Of Information

Our first surprise came when we looked at the raw data collected from our colleagues. Simply by visiting a single website, each laptop revealed an enormous amount of information. The structured data files returned by amiunique.org contained nearly 1,500 individual system properties per device.

The challenge for personal privacy is that much of this information is exchanged as part of the normal functioning of the web itself. For example, whenever you load a webpage, your browser automatically sends HTTP headers to the server. These headers include the details listed in the following table:

In addition, websites can use JavaScript to request more details about your system. While most JavaScript simply powers normal site features like menus, animations, or interactive buttons, it can also be written to probe attributes of your device for fingerprinting purposes. Because JavaScript is so deeply embedded in the modern web, disabling it for privacy would also disable much of the functionality that makes websites usable. In many cases, it would prevent sites from loading altogether.

JavaScript also enables one of the more striking identification techniques: canvas fingerprinting. Here, your browser is asked to render an image using the HTML5 <canvas> element and WebGL. The resulting output isn’t identical across systems; it depends on the exact combination of OS, GPU, drivers, browser, and even installed fonts. This subtle variability makes the canvas fingerprint highly distinctive, often unique.

Every One Of Our Colleagues Had A Unique Browser Fingerprint

When we first checked our results on amiunique.org, the site reported that every one of our colleagues had a unique fingerprint, even compared against the more than 4 million devices in their database. Impressive as that sounds, their definition of “uniqueness” is a little misleading. The hashes they generate include connection-level details such as IP addresses and battery charge state information. Since IP addresses can be easily hidden behind a VPN and battery information is constantly changing, they fall outside the scope of what’s typically considered core browser fingerprinting.

To get a clearer picture, we dug into the raw data collected and created our own set of fingerprint hashes. We restricted the attributes used in these hashes to 28 fields, deliberately removing those that didn't meaningfully differentiate devices in our dataset. For example:

• Browser plugins are largely deprecated, and Chrome, Edge, and Firefox all reported only the same built-in PDF viewers (with Brave returning a randomized string).
• Every participant had cookies enabled.
• None of the laptops reported an accelerometer or proximity sensor.
• All systems were running Windows.

Even after narrowing the scope, the results were striking: 83 out of 83 colleagues had a unique browser fingerprint hash. Admittedly, with a relatively small dataset and a fairly large set of attributes, uniqueness is easier to achieve. But the finding is still noteworthy given that so many of us were using nearly identical hardware.

We Didn't Need A Long List Of Attributes To Uniquely Identify Our Colleagues

To better understand which attributes contribute most to our identifiability online, we analyzed the results using Shannon entropy (H) for each fingerprint attribute:

where the pᵢ is the probability of the ith outcome:

Entropy measures the amount of uncertainty, or unpredictability, in a dataset. Attributes with low entropy are highly predictable, with few unique values, making them less useful for distinguishing individuals. Attributes with high entropy, by contrast, are unpredictable with many unique values, making them far more powerful for identification.

When sorted by Shannon entropy, the browser fingerprint attributes in our dataset ranked as follows:

Unsurprisingly, the attributes with the highest entropy were the HTML5 canvas and WebGL rendering fingerprints. Across our group, the HTML5 element produced 31 distinct renderings, while WebGL produced 21 distinct renderings. When grouped by laptop model, browser, and graphics driver, there were at most two fingerprints per combination. This shows just how tightly these rendering fingerprints are linked to the underlying hardware and software, making them highly effective identifiers. However, they are not perfectly stable: changes to graphics drivers or browser versions can alter the fingerprint over time.

Another notable finding was the large number of unique screen resolution combinations. Resolution is affected both by a laptop's native display size and by user-set pixel scaling in Windows. "Available resolution" values varied depending on the size of the taskbar set by the user, further increasing uniqueness.

We also found 20 distinct font combinations and 17 distinct language configurations. As a bilingual French-English workplace, this was expected. Though interestingly, we observed multiple regional variants (e.g., Canadian vs. American English, and Canadian vs. metropolitan French).

To test the necessity of individual attributes, we recreated the fingerprint hashes while removing one attribute at a time. In every case, all fingerprints remained unique meaning no single attribute was solely responsible for uniqueness.

Next, we wanted to see how much entropy could be removed before uniqueness broke down. We successively removed attributes with the highest entropy and tracked the number of unique fingerprints remaining. Even after discarding all attributes with entropy greater than 2.0, we could still uniquely identify 62 out of 83 colleagues.

The table below lists the attributes with entropy less than 2. Note how few unique values each contains. This highlights the core insight: it is not any single attribute that makes a browser fingerprint unique, but rather the intersection of many otherwise mundane attributes.

Using Only "Stable" Attributes Still Allows For Identification

As noted earlier, some attributes, like the HTML5 canvas and WebGL rendering fingerprints, have very high Shannon entropy and therefore strong identification power. However, they are also relatively unstable since they can change whenever graphics drivers or browsers are updated.

To focus on attributes that better reflect the long-term identity of a system, we narrowed the list down to those that are not expected to change frequently:

• Physical system attributes (e.g., screen resolution, memory)
• OS-level settings that are usually configured once and rarely altered (e.g., pixel ratio, language packs, keyboard layout)

Even with this much shorter list of stable attributes, we were still able to uniquely identify 68 out of 83 devices in our dataset. This highlights how persistent uniqueness can be, even without relying on more volatile attributes.

Conclusion

Our small experiment highlights just how much identifying information your browser reveals whenever you visit a website. Browser fingerprinting is not inherently good or bad; it can enable important security checks, but it can also be used for invasive tracking. The reality is that simply running a "stock" browser to blend in or relying on a VPN alone won't make you anonymous. Fingerprinting works by combining a wide range of attributes, far beyond just your browser settings or IP address.

Instead, protecting your privacy online means choosing the right balance of tools for your needs. To reduce your uniqueness, you may need to consider browsers that standardize or randomize fingerprints, or even split your activity across multiple browsers. Absolute anonymity is unrealistic, but with the right strategies, you can make tracking harder and keep your browsing more private.

Recent Updates

09/12/2025: Updated the "Our Recommendations" section with further information.