How to browse without being fingerprinted

Clearing cookies doesn’t stop tracking anymore. Sites and ad networks moved past cookies years ago because fingerprinting works without them: your screen resolution, installed fonts, GPU rendering quirks, timezone, and a dozen other signals combine into a value that’s unique enough to re-identify you across sessions, even in incognito mode, even with a VPN. The EFF’s original Panopticlick research demonstrated this over a decade ago and the technique has only gotten more precise since.

This tutorial is for two kinds of readers: people who want to stop being tracked for ordinary privacy reasons, and operators who need to run multiple browser identities for legitimate work like ad verification, competitive research, QA testing across regions, or OSINT. I run infrastructure for a living and this is the same setup I use before I recommend any tool on this site. Nothing here involves bypassing authentication, impersonating another real person, or defeating KYC, if that’s what you’re after, this isn’t the tutorial and I won’t point you to one.

By the end you’ll have a browser configuration that scores as “not unique” on standard fingerprint testing tools, know how to isolate identities so they don’t cross-contaminate, and understand what breaks when you try to run this at scale.

what you need

A browser built for anti-fingerprinting: Tor Browser (free, tor project), Mullvad Browser (free, built by the Mullvad and Tor teams), or stock Firefox with privacy.resistFingerprinting enabled
20-30 minutes for initial setup and testing
Optional: a VPN or proxy if you’re also masking IP (fingerprinting and IP masking are separate problems, don’t confuse them)
A testing account you don’t mind using for verification, don’t test on your real logged-in accounts
For multi-identity work: an antidetect browser like Multilogin, GoLogin, or Incogniton (paid, roughly $20-100/month depending on profile count), plus proxies if you’re separating by IP too
No illegal use case. Fingerprint resistance is legal everywhere I know of; using it to defeat KYC checks, evade bans tied to fraud, or impersonate someone is not something I’ll help with

step by step

1. Understand what’s actually being measured

Before configuring anything, know what a fingerprint is built from: user agent string, screen resolution and color depth, installed fonts, canvas rendering output, WebGL renderer string, audio context output, timezone, language, and installed extensions. Canvas and WebGL are the most damaging because they expose GPU and driver-level rendering differences that are nearly impossible to fake convincingly without a purpose-built browser.

Expected output: you understand why “just use a VPN” doesn’t solve this, a VPN changes your IP, not your rendering signature.

If it breaks: if this doesn’t click yet, run the test in step 4 first and come back. Seeing your own fingerprint makes the abstract concrete fast.

2. Pick your browser baseline

Three real options, ranked by how much they fight you on usability:

Tor Browser: strongest resistance, every install looks identical by design, but slow and blocks a lot of JS-heavy sites by default at higher security levels
Mullvad Browser: same anti-fingerprinting engine as Tor Browser (it’s a collaboration between Mullvad and the Tor Project) but meant to be paired with a regular VPN instead of the Tor network, faster for daily use
Firefox with resistFingerprinting: most flexible, but the flag is not the default and Mozilla itself documents that it can break site functionality if you’re not careful with other settings

For daily browsing I run Mullvad Browser. For anything sensitive I use Tor Browser unmodified.

Expected output: a browser downloaded and installed, not yet configured.

If it breaks: don’t download from a mirror or search result. Get Tor Browser only from torproject.org and verify the signature if you’re on Linux.

3. Install with signature verification (Linux/CLI users)

If you’re setting this up on a server or Linux box rather than clicking through a GUI installer:

# download the Tor Browser Linux bundle and its signature from torproject.org
wget https://www.torproject.org/dist/torbrowser/13.5.6/tor-browser-linux-x86_64-13.5.6.tar.xz
wget https://www.torproject.org/dist/torbrowser/13.5.6/tor-browser-linux-x86_64-13.5.6.tar.xz.asc

# import the Tor Browser developers signing key, then verify
gpg --auto-key-locate nodefault,wkd --locate-keys [email protected]
gpg --verify tor-browser-linux-x86_64-13.5.6.tar.xz.asc tor-browser-linux-x86_64-13.5.6.tar.xz

Check the version number against the current release listed on torproject.org before you run this, version strings age fast.

Expected output: gpg reports a “Good signature” line.

If it breaks: a bad signature means don’t run the file. Re-download from the official site directly, not a cached link.

4. Test your baseline fingerprint

Open your new browser and go to EFF’s Cover Your Tracks, the modern successor to Panopticlick. Run the test unmodified, before installing any extensions.

Expected output: for Tor Browser or Mullvad Browser, you should see a result indicating your browser blends in with a large set of other users tested recently, often phrased as your fingerprint appearing “not unique” or matching a large crowd. Stock Firefox or Chrome will usually score as unique.

If it breaks: if a hardened browser still scores as unique, check whether you’ve resized the window (see pitfalls below) or added extensions before testing.

5. Lock down WebRTC and canvas leaks

WebRTC can leak your real IP even through a VPN or Tor, and canvas/WebGL are the highest-signal fingerprint vectors. In Tor Browser and Mullvad Browser these are handled for you at the default security level. In stock Firefox, go to about:config and set:

privacy.resistFingerprinting = true
media.peerconnection.enabled = false   # disables WebRTC entirely
privacy.firstparty.isolate = true

Expected output: re-run Cover Your Tracks, WebRTC leak indicators should show blocked or not detected.

If it breaks: disabling WebRTC entirely breaks video calling sites (Meet, Discord voice-in-browser). If you need WebRTC for a specific site, whitelist it there rather than flipping the global flag back.

6. Isolate identities so they don’t cross-contaminate

One hardened browser used for five different accounts is not five identities, it’s one fingerprint linked to five accounts through shared cookies, cache, and session storage. Use separate browser profiles (firefox -P to open the profile manager) or Firefox Multi-Account Containers for lightweight separation, or fully separate browser installs for anything higher stakes.

firefox -P
# opens the Profile Manager, create a new named profile per identity

Expected output: each identity has its own cookie jar, local storage, and extension set.

If it breaks: if sites still correlate your profiles, check that you’re not reusing the same VPN exit IP across sessions you’re trying to keep separate, IP is a correlation vector even when the browser fingerprint differs.

7. Pair with network-level separation if you need it

Fingerprint resistance and IP masking solve different problems and you often need both. A VPN gives you a shared exit IP with other users. A residential or mobile proxy gives you an IP that looks like an individual home or phone connection. I’ve written about the tradeoffs between mobile proxies and VPNs separately if you need to go deeper here.

Expected output: your browser fingerprint and your IP no longer both point uniquely back to you.

If it breaks: a common failure is a VPN exit node in one timezone while your OS clock and browser locale say another. That mismatch is itself a fingerprint signal, so match your VPN region to your system locale when it matters.

8. For managing many identities, use a purpose-built tool

Past a handful of identities, manually managing browser profiles doesn’t scale. This is where antidetect browsers come in, tools like Multilogin, GoLogin, and Incogniton generate distinct, consistent, plausible fingerprints per profile and keep cookies, storage, and canvas/WebGL output isolated per identity. I keep a running set of reviews on these at antidetectreview.org/blog if you’re evaluating which one fits your case.

Expected output: each managed profile passes fingerprint testing independently and doesn’t share storage with any other profile.

If it breaks: cheap or free antidetect tools often generate fingerprints that are internally inconsistent, for example a WebGL renderer string that doesn’t match the claimed OS. That inconsistency is itself detectable. Test each profile individually rather than trusting the tool’s marketing.

9. Re-test on a schedule, not once

Fingerprinting defenses degrade as browsers update and detection scripts improve. Re-run Cover Your Tracks monthly, and any time you update your browser or add an extension.

Expected output: consistent “not unique” results over time, not a one-time pass.

If it breaks: a sudden drop in fingerprint uniqueness score after a browser update usually means a new API was exposed. Check the browser’s release notes and the anti-fingerprinting project’s changelog before assuming your setup is fine.

common pitfalls

Resizing the browser window. Tor Browser and Mullvad Browser intentionally serve a small set of standard window sizes and pad the rest with letterboxing. Maximizing the window defeats this and makes you unique again.
Installing extensions on a hardened profile. Every extension adds an enumerable signal. An ad blocker you installed to “improve privacy” can make you more identifiable, not less, because few other users have that exact combination.
Logging into real accounts on a test identity, or vice versa. One login event permanently links a profile to your real identity in that site’s records, no fingerprint defense undoes that.
Ignoring timezone and locale consistency. A browser fingerprint that claims US English but a system clock set to Singapore time is a mismatch flag, not a hidden identity.
Assuming Incognito/Private mode does this for you. Private browsing clears local storage on close, it does nothing to your canvas, WebGL, font, or hardware signals. This is the single most common misunderstanding I run into.

scaling this

At 10 identities, manual profiles (Firefox Multi-Account Containers or separate profile folders) plus a VPN are enough. Cost is near zero beyond a VPN subscription.

At 100 identities, manual profile management breaks down, you need an antidetect browser with profile templates and a proxy provider that can assign a distinct IP per profile. Budget realistically for both, proxy costs typically dominate over the antidetect tool license at this scale.

At 1000 identities, you’re running infrastructure, not a workflow. This means API-driven profile creation and rotation, a proxy pool large enough that IPs aren’t reused across unrelated identities, and monitoring for fingerprint drift across your whole fleet rather than spot-checking individually. This is legitimate territory for ad verification firms, web scraping operations, and QA testing across regions, it is not a shortcut around platform rules, and most platforms’ terms of service explicitly prohibit using this scale to evade account limits or manipulate metrics. Read the terms of whatever platform you’re interacting with before you build toward this number.

where to go next

If you landed here because a VPN alone didn’t feel like enough, read how mobile proxies improve privacy versus a VPN for the IP side of this problem. If you want the full picture of what “private” actually means in practice, how to actually stay private online in 2026 covers the ground this tutorial doesn’t. And if your threat model includes message content, not just browsing, end-to-end encryption explained is the natural next read. For everything else, the full archive is at /blog/.

Written by Xavier Fok

disclosure: this article may contain affiliate links. if you buy through them we may earn a commission at no extra cost to you. verdicts are independent of payouts. last reviewed by Xavier Fok on 2026-07-17.