Fingerprinting

A fingerprint is an identifier the tracker does not store but derives: from how your browser draws text and shapes, which fonts and graphics hardware it has, how it processes sound, what it says about your screen, languages and processor. Each property alone is shared by many people; together they narrow a browser down to very few, often to one. Nothing is written to your device, so clearing cookies, private windows and storage partitioning change nothing. This area carries of the 100 points.

How unique is a browser?

Eckersley's Panopticlick study (2010) measured 470,161 browsers and found 83.6% unique, rising to 94.2% among those with Flash or Java. The distribution carried at least 18.1 bits of identifying information, enough to single out one browser in 286,777^[1]. AmIUnique (2016) found 89.4% of 118,934 fingerprints unique, 90% on desktop and 81% on mobile, with canvas rendering among the five most discriminating attributes^[2]. These visitors were privacy-curious volunteers, and a later study of 2,067,942 fingerprints from a large French website found only 33.6% unique overall and 18.5% on mobile^[3]. Uniqueness depends on the population and on the attributes collected.

For a tracker, uniqueness in a lab is not the point. What matters is linkability: whether the same browser produces the same value on two sites, or on the same site a week later, so that the value can be joined with an IP address, a login or a cookie that was set before. That is why Bye Spy's heaviest fingerprinting check does not estimate rarity at all. It asks whether your fingerprint came out the same on two different sites.

How common it is

Measurement studies show fingerprinting spreading from a few specialist scripts to a sizeable share of the web. Acar and colleagues found canvas fingerprinting on more than 5.5% of the top 100,000 sites in 2014, 95% of it from one widget provider^[4]. Englehardt and Narayanan found it on 14,371 of the top million sites in 2016^[5]. Using a classifier of script behaviour, Iqbal and colleagues found fingerprinting scripts on 10.18% of the top 100,000 sites and 30.60% of the top 1,000, from 2,349 domains^[6]. Off-the-shelf libraries account for only part of it: the HTTP Archive detects the open-source FingerprintJS library on 0.59% of sites^[7], while commercial services run under their customers' own names.

Fingerprinting is also used to stop fraud and bots: commercial device-intelligence services such as Fingerprint and LexisNexis ThreatMetrix sell recognition of returning devices to banks and shops^[8][9]. The same signals identify a person whatever the purpose. In December 2024, Google told advertisers that from 16 February 2025 its ad platforms policy would no longer prohibit fingerprinting; the UK Information Commissioner's Office called the change "irresponsible"^[10].

The two defences

• Uniformity: make every user report the same values. Tor Browser and Mullvad Browser report UTC, US English, rounded window sizes and fixed hardware values; Firefox's resist fingerprinting mode does the same^[11][12]. It only works if many people look alike.
• Randomisation: add small, seeded noise per site and per session, so the value differs between sites and cannot link them. Brave introduced this as "farbling" in 2020^[13]. Firefox adds canvas noise in private windows and with Strict tracking protection since version 120 (2023), and extended those protections in version 145 (2025)^[14][15]. Safari adds noise to canvas, WebGL and audio readback in Private Browsing since Safari 17^[16], and since Safari 26 restricts what known fingerprinting scripts can read in all browsing^[17].

Bye Spy credits both. A randomised value shows up as different on the two sites or between two identical draws; a uniform value shows up as the values anti-fingerprinting browsers give everyone.

How Bye Spy takes a fingerprint

The same script runs on the test page and, during the cross-site step, on the tracker's own site. It reads eleven components: canvas, WebGL, audio, fonts, screen, hardware, locale, browser details, media (voices, devices, formats), display preferences (CSS media features) and a set of Math results that differ between JavaScript engines. Each component is reduced to the part that stays put between two sites unless the browser changes it on purpose (the window size, for one, is left out, because the tracker's window is smaller) and hashed with SHA-256. The fingerprint ID at the top of your report's file is the hash of all eleven.

A component the browser refused to compute (an API that threw an error) is recorded as unreadable and left out of every comparison: a failure is not a different value.

// The shape of every fingerprinting script: read, normalise, hash.
const parts = [canvasHash, webglRenderer, audioSum, fontList, screen.width, screen.height,
               navigator.hardwareConcurrency, Intl.DateTimeFormat().resolvedOptions().timeZone,
               navigator.languages.join(',')];
const id = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(JSON.stringify(parts)));

Same fingerprint on two sites

What Bye Spy measures

The component hashes from the test page and from the tracker's own site are compared one by one. The components are split in two groups:

• Strong: canvas, WebGL, audio and fonts. They vary widely between devices and are the ones anti-fingerprinting browsers randomise.
• Weak: screen, hardware, locale, browser details, media, display preferences and maths. Each is shared by many people, but together they still narrow you down.

Why it matters

This is the end-to-end test of fingerprinting as a tracking technique: one tracker, two sites, the same identifier. Every other check on this page explains one reason why it came out the way it did.

How it is scored

The value is 0.75 × (share of strong components that differed) + 0.25 × (share of weak components that differed), over the components readable on both sites.

Safe

Every strong component differed between the sites. Worth 1 when the weak ones differed too, and at least 0.75 when they stayed the same, as they do for many people.

Partly leaks

Some components changed, but at least one strong component stayed the same.

Leaks

The fingerprint was identical on both sites.

It is the heaviest fingerprinting check, as heavy as third-party cookies are in their area, because it measures the same thing: one identifier readable in two contexts. If none of the strong components could be read on both sites, the check reports Failed rather than comparing weak components alone.

Canvas fingerprint

What Bye Spy measures

The test draws a fixed scene on a hidden 320 × 84 canvas: a coloured rectangle, a line of Arial text with an emoji, the pangram Cwm fjordbank glyphs vext quiz in a translucent serif, three overlapping circles blended with multiply, and a gradient. It reads the image back as PNG, hashes it, and draws it a second time to see if the result is identical. Then it fills an 8 × 8 canvas with one solid colour and reads the pixels: a solid fill has exactly one right answer, so any pixel that deviates is noise the browser added on purpose.

Why it matters

The same drawing commands produce slightly different pixels on different systems: the graphics hardware and driver, the anti-aliasing, the font rasteriser and the installed fonts all leave a trace. The image never appears on screen.

How it is used in the wild

Mowery and Shacham proposed canvas fingerprinting in 2012^[18]. Within two years it was in a widely embedded sharing widget: the script Acar and colleagues documented drew the same pangram Bye Spy uses^[4], and the EFF found it running on the White House website^[19]. The open-source fingerprintjs2 library drew it too:

const canvas = document.createElement('canvas');
const ctx = canvas.getContext('2d');
ctx.textBaseline = 'alphabetic';
ctx.fillStyle = '#f60';
ctx.fillRect(125, 1, 62, 20);
ctx.fillStyle = '#069';
ctx.font = '11pt no-real-font-123';
ctx.fillText('Cwm fjordbank glyphs vext quiz, \u{1F603}', 2, 15);
const canvasId = await sha256(canvas.toDataURL());   // the same on every visit, on every site

Evidence and prevalence

From 5.5% of the top 100,000 sites in 2014^[4] to 14,371 of the top million in 2016, 98% of it from third parties^[5], canvas fingerprinting is the most studied component. It is the main target of randomising defences in Brave, Firefox and Safari.

How it is scored

Safe

The browser refused to hand over pixels, returned a blank image, or added noise: the solid-colour square came back altered, the two draws differed, or the image differed on the tracker's site.

Leaks

The same exact image every time, on both sites.

Graphics card and WebGL

What Bye Spy measures

Two things. First, the graphics renderer string: Chromium and WebKit hide it behind a generic value and hand out the real one through the WEBGL_debug_renderer_info extension, which the test asks for, as trackers do. Second, a rendering: a colour-interpolated triangle drawn twice through a small shader, read back pixel by pixel and hashed, along with a dozen implementation limits and the list of supported extensions.

Why it matters

The renderer string can name the exact graphics card. The rendering adds the subtle numeric differences of the GPU, driver and shader compiler.

const gl = document.createElement('canvas').getContext('webgl');
const info = gl.getExtension('WEBGL_debug_renderer_info');
gl.getParameter(info.UNMASKED_RENDERER_WEBGL);
// "ANGLE (NVIDIA, NVIDIA GeForce RTX 3070 (0x00002484) Direct3D11 vs_5_0 ps_5_0, D3D11)"

Evidence and prevalence

Cao and colleagues used WebGL rendering tasks to identify 99.24% of users within one browser and 83.24% across different browsers on the same machine^[21]. DRAWNAPART (2022) went further, telling apart devices with identical hardware by timing GPU execution units, which extended the median time a browser could be tracked by up to 67%^[22]. Browsers now coarsen the string: Firefox reports a bucketed GPU family ending in , or similar since version 91^[23], Safari reports Apple GPU for every device, and Brave substitutes generic values.

How it is scored

Two halves, each worth 0.5: a generic renderer name (no model number, or Firefox's or similar) earns one, a randomised rendering (different on the second draw, or on the tracker's site) earns the other.

Safe

Generic name and randomised rendering, or WebGL turned off.

Partly leaks (0.5)

One of the two.

Leaks

The exact graphics hardware, and a rendering identical every time.

Audio fingerprint

What Bye Spy measures

An OfflineAudioContext renders 5,000 samples of a 10 kHz triangle wave through a dynamics compressor (threshold −50 dB, knee 40, ratio 12, attack 0, release 0.25) without playing anything, and sums the absolute values of the last 500 samples. It does this twice, and the result is compared between the two draws and between the two sites. These are the parameters the widely used open-source FingerprintJS library uses, so the check measures what that code would see^[24].

Why it matters

Floating-point details of the audio stack differ between browsers, operating systems and processors, and the compressor amplifies them. The sum is stable on one machine and varies across machines: a small but steady addition to a fingerprint.

const ctx = new OfflineAudioContext(1, 5000, 44100);
const osc = ctx.createOscillator();
osc.type = 'triangle';
osc.frequency.value = 10000;
const comp = ctx.createDynamicsCompressor();
comp.threshold.value = -50;
comp.knee.value = 40;
comp.ratio.value = 12;
comp.attack.value = 0;
comp.release.value = 0.25;
osc.connect(comp).connect(ctx.destination);
osc.start(0);
const samples = (await ctx.startRendering()).getChannelData(0);
const audioId = samples.subarray(4500).reduce((sum, s) => sum + Math.abs(s), 0);   // e.g. 124.04347527516074

Evidence and prevalence

Englehardt and Narayanan discovered audio fingerprinting in the wild in 2016, in three scripts present on 67 sites^[5]; it has since become a standard component of fingerprinting libraries. Safari 17 and later add noise to audio sample reads, and FingerprintJS now skips the audio signal entirely on those versions, a sign the defence works^[24].

How it is scored

Safe

The two draws differed or the value changed on the tracker's site (noise), or Web Audio is unavailable.

Leaks

The same value every time, on both sites.

If audio processing throws an error or times out, the check reports Failed rather than Safe: an error is not a protection the test can verify. Lighter than canvas and WebGL, because the value separates fewer machines.

Installed fonts

What Bye Spy measures

Browsers do not list your fonts, but they reveal them: text drawn in a font you have is a different width from the fallback. The test measures a 72-pixel sample string in each of 189 candidate fonts, with monospace, sans-serif and serif fallbacks, and counts a font as present when any width differs from the fallback alone. The candidates are the fonts that ship with Windows, macOS, iOS, Linux and Android, plus fonts people commonly add: office suites, design tools, programming fonts, popular web fonts installed locally. Fonts beyond what your operating system ships with are listed as added.

"Ships with your system" means the fonts a fresh installation has, not what an app, an office suite or an update put there later. Each system's list is made by a script from that system's own fonts, not typed: for Windows from Microsoft's published font lists for Windows 10 and 11, base fonts only, without the optional language packs^[34]; for macOS from its font files, the interface fonts included but not the ones it downloads on demand; for iOS from the font files of its current releases; for Linux from the font packages the default desktops of Ubuntu LTS, Debian stable and Fedora Workstation install; for Android from the system fonts of Android 16. Where a system has more than one version or distribution, a font that any of them ships counts.

A font name is not always the font it says. When a font is missing, browsers and systems answer with a similar one: Chrome answers Helvetica with Arial and Times with Times New Roman^[35], Safari and every iPhone browser answer Microsoft JhengHei and SimSun with Apple's own Chinese fonts^[36], Android answers Arial, Georgia, Times and others with its sans and serif fonts^[37], and Linux answers Arial with Liberation Sans, Times New Roman with Liberation Serif and Courier New with Liberation Mono^[38]. These answers are read from the browsers' and systems' own tables, and the names count as shipped. A font that measures exactly like a shipped font found in the same run, at all three fallbacks, is not counted as added either: it is the same font under another name, and a tracker cannot tell the two apart.

Two decoy names no computer has are measured too. If either "exists", the browser is randomising text measurements and the list means nothing.

Why it matters

The fonts that come with an operating system are shared by everyone on it. The fonts you or your software installed are not: a design tool, a programming font or an office suite each adds a recognisable set.

const ctx = document.createElement('canvas').getContext('2d');
const width = (font) => { ctx.font = `72px ${font}`; return ctx.measureText('mmmmmmmmmmlli1|WwQ').width; };
const base = width('monospace');
const hasFont = (name) => width(`"${name}", monospace`) !== base;
['Fira Code', 'JetBrains Mono', 'Myriad Pro', 'Calibri'].filter(hasFont);   // ["Fira Code", "Calibri"]

Evidence and prevalence

Fifield and Egelman showed that the rendered size of text alone identified 34% of 1,016 browsers uniquely^[25]. Englehardt and Narayanan found canvas-based font enumeration on 3,250 sites in 2016^[5]. Safari, and Firefox in private windows or with Strict tracking protection, show pages only the fonts that come with the system; Brave hides most others.

How it is scored

Safe

No added fonts visible, or measurements randomised (a decoy font "exists"), or a different set of fonts on the tracker's site.

Partly leaks

One or two added fonts (0.6), or three to five (0.3).

Leaks

Six or more added fonts.

The steps follow how quickly added fonts narrow a population: one common addition says little, a handful of unusual ones are close to unique.

Detailed device hints

What Bye Spy measures

Chromium-based browsers send a short description of themselves in User-Agent Client Hints headers (Sec-CH-UA, -Mobile, -Platform), and hand out more when a site asks. The test page asks, as any site can, with an Accept-CH header listing the high-entropy hints, then checks which arrived on its next request. It also calls navigator.userAgentData.getHighEntropyValues(), which returns the same details to scripts.

HTTP/1.1 200 OK
Accept-CH: Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Model

await navigator.userAgentData.getHighEntropyValues(['platformVersion', 'architecture', 'bitness', 'model', 'fullVersionList']);
// { platform: "Windows", platformVersion: "15.0.0", architecture: "x86", bitness: "64", model: "",
//   fullVersionList: [{ brand: "Google Chrome", version: "141.0.7390.66" }, …] }

Why it matters

Chrome reduced the User-Agent string between versions 101 and 116 (2022–2023), freezing the operating system version and the browser's minor version, precisely because they add identifying detail to every request^[26]. The same details remain available on request, without a prompt. The only gate is a Permissions Policy that allows every site by default^[27].

Evidence and prevalence

In the HTTP Archive's 2025 crawl, sites requesting the platform version hint appeared on 4.28% of pages and the device model on 4.25%^[7]. Scripts can read the same values with no header at all, which crawls of headers do not count. Firefox and Safari do not implement client hints.

How it is scored

Safe

No extra hints sent when asked, and none readable by scripts.

Leaks

The operating-system version, architecture, model or full browser version was handed out.

Battery, network and keyboard

What Bye Spy measures

Three APIs that describe your device's state rather than its make: the battery level and charging state (navigator.getBattery()), the estimated network round-trip time and bandwidth (navigator.connection), and the keyboard layout (navigator.keyboard.getLayoutMap(), read for seven keys whose characters differ between layouts). The answers to four permission queries are listed as facts but not scored.

Why it matters

Battery level and network estimates change slowly. Two visits to different sites within minutes report nearly the same values, a short-lived identifier that bridges the gap until something more durable links the visits. A keyboard layout points to a country and language.

const battery = await navigator.getBattery();
[battery.level, battery.chargingTime, battery.dischargingTime];   // [0.43, Infinity, 8940]
navigator.connection.rtt;                                          // 50
(await navigator.keyboard.getLayoutMap()).get('KeyY');             // "z" on a German keyboard

Evidence and prevalence

Olejnik and colleagues showed in 2015 that battery readings could serve as a short-term identifier across sites^[28], and Englehardt and Narayanan found scripts reading the battery as part of fingerprinting the following year^[5]. Firefox removed the Battery Status API from web pages in version 52 (2017), and Safari never shipped it. Today all three APIs are available only in Chromium-based browsers^[29], and Brave disables or fakes them.

How it is scored

Safe

None of the three is available.

Partly leaks

One or two of them: each available API takes away a third.

Leaks

All three.

Time zone and languages

What Bye Spy measures

The time zone and locale from Intl.DateTimeFormat().resolvedOptions(), and the ordered list of preferred languages from navigator.languages.

Why it matters

A time zone narrows you to a region; a list of languages, especially more than one and in an unusual order, narrows you much further. Both are also sent or exposed by default, so every script reads them.

Intl.DateTimeFormat().resolvedOptions().timeZone;   // "America/Chicago"
navigator.languages;                                // ["en-GB", "et", "de"]

Evidence and prevalence

Both are standard parts of every fingerprinting library. Tor Browser, Mullvad Browser and Firefox's resist-fingerprinting mode report UTC and US English to every site, so that their users look alike^[11][12].

How it is scored

Safe

UTC and a single en or en-US: the values anti-fingerprinting browsers give everyone.

Leaks

Anything else.

Low weight: most people share a time zone with millions of others, and changing it breaks the times websites show. It counts mainly as part of the cross-site comparison above.

Screen size

What Bye Spy measures

The screen's width, height, available area (what the taskbar or dock leaves), colour depth and pixel ratio, compared with the window's size and with the values on the tracker's site.

[screen.width, screen.height, screen.availWidth, screen.availHeight, devicePixelRatio];
// [1512, 982, 1512, 944, 2]  ← the 38-pixel difference is the menu bar

Why it matters

Common laptop sizes are shared by millions. Unusual monitors, multi-monitor setups, scaling factors and the exact space a taskbar takes narrow you down.

Evidence and prevalence

Tor Browser 9.0 (2019) introduced letterboxing, which keeps the page area at rounded sizes in steps of 200 × 100 pixels however the window is resized^[30]. Safari's advanced fingerprinting protection reports fixed screen values instead of noise^[16].

How it is scored

Safe

The browser reported the window's size as the screen size, or a different screen to each site.

Leaks

The real screen, the same on both sites.

Processor and memory

What Bye Spy measures

The number of logical processor cores (navigator.hardwareConcurrency), the approximate memory (navigator.deviceMemory, Chromium only), the number of touch points and the platform string, compared with the values on the tracker's site.

[navigator.hardwareConcurrency, navigator.deviceMemory, navigator.maxTouchPoints];   // [12, 16, 0]

Why it matters

Each value has few possible answers, but they are stable for the life of the machine and combine with everything else.

Evidence and prevalence

Every browser exposes the core count; Safari clamps it to a few values. Chromium rounds memory to a power of two and caps it; since Chrome 147 (2026) the values on desktop run from 2 to 32 GB^[31]. Brave reports a different core count to each site.

How it is scored

Safe

The values differed on the tracker's site.

Leaks

The same values on both sites.

Voices, devices and video formats

What Bye Spy measures

The installed speech-synthesis voices (speechSynthesis.getVoices()), the number of cameras, microphones and speakers (navigator.mediaDevices.enumerateDevices(), and whether they come with names, which only happens after you have granted access), and which of twelve audio and video formats the browser can play.

Why it matters

Installed voices reflect the operating system, its version and the language packs you added; media devices and formats reflect hardware and system codecs. The values vary between computers and add to the cross-site comparison.

Evidence and prevalence

Voice lists are a known fingerprinting surface: Firefox's resist-fingerprinting mode returns no voices^[32], Brave randomises the list^[33], and Safari 26 restricts it for known fingerprinting scripts.

How it is scored

It is not scored on its own. These values differ by system far more than by any browser setting, so a verdict on them would judge your computer rather than your browser. They do count in the cross-site comparison, as one of the weak components.

References

1. P. Eckersley. "How Unique Is Your Web Browser?" Privacy Enhancing Technologies Symposium (PETS), 2010. coveryourtracks.eff.org/static/browser-uniqueness.pdf
2. P. Laperdrix, W. Rudametkin, B. Baudry. "Beauty and the Beast: Diverting modern web browsers to build unique browser fingerprints." IEEE Symposium on Security and Privacy, 2016. inria.hal.science/hal-01285470
3. A. Gómez-Boix, P. Laperdrix, B. Baudry. "Hiding in the Crowd: an Analysis of the Effectiveness of Browser Fingerprinting at Large Scale." The Web Conference (WWW), 2018. hal.science/hal-01718234
4. G. Acar, C. Eubank, S. Englehardt, M. Juarez, A. Narayanan, C. Diaz. "The Web Never Forgets: Persistent Tracking Mechanisms in the Wild." ACM CCS, 2014. mjuarezm.github.io/assets/pdf/never-ccs14.pdf
5. S. Englehardt and A. Narayanan. "Online Tracking: A 1-million-site Measurement and Analysis." ACM CCS, 2016. webtransparency.cs.princeton.edu/webcensus
6. U. Iqbal, S. Englehardt, Z. Shafiq. "Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors." IEEE Symposium on Security and Privacy, 2021. arXiv:2008.04480
7. HTTP Archive. Web Almanac 2025, Privacy chapter. almanac.httparchive.org/en/2025/privacy
8. Fingerprint. "Fingerprint launches Smart Signals to fight and prevent fraud." Press release, 6 June 2023. prnewswire.com/news-releases/…
9. LexisNexis Risk Solutions. ThreatMetrix. risk.lexisnexis.com/products/threatmetrix
10. S. Almond. "Our response to Google's policy change on fingerprinting." Information Commissioner's Office, 19 December 2024. ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/12/…
11. Mozilla Wiki. "Security/Fingerprinting." wiki.mozilla.org/Security/Fingerprinting
12. Tor Project. "Fingerprinting protections"; Mullvad, "Mullvad Browser: hard facts." support.torproject.org/…/fingerprinting-protections, mullvad.net/en/browser/hard-facts
13. Brave. "Fingerprinting defenses 2.0." 18 May 2020. brave.com/privacy-updates/4-fingerprinting-defenses-2.0
14. Mozilla. Firefox 120.0 release notes, November 2023. firefox.com/en-US/firefox/120.0/releasenotes
15. Mozilla. "Firefox expands fingerprint protections." 10 November 2025. blog.mozilla.org/en/firefox/fingerprinting-protections
16. WebKit. "Private Browsing 2.0." July 2024. webkit.org/blog/15697
17. WebKit. "WebKit Features in Safari 26.0." September 2025. webkit.org/blog/17333
18. K. Mowery and H. Shacham. "Pixel Perfect: Fingerprinting Canvas in HTML5." Web 2.0 Security & Privacy (W2SP), 2012. ieee-security.org/TC/W2SP/2012/papers/w2sp12-final4.pdf
19. EFF. "White House Website Includes Unique Non-Cookie Tracker, Despite Privacy Policy." July 2014. eff.org/deeplinks/2014/07/…
20. FingerprintJS. Canvas source, src/sources/canvas.ts. github.com/fingerprintjs/fingerprintjs/…/canvas.ts
21. Y. Cao, S. Li, E. Wijmans. "(Cross-)Browser Fingerprinting via OS and Hardware Level Features." NDSS, 2017. ndss-symposium.org/…/ndss2017_02B-3_Cao_paper.pdf
22. T. Laor et al. "DRAWNAPART: A Device Identification Technique based on Remote GPU Fingerprinting." NDSS, 2022. arXiv:2201.09956
23. Mozilla Bugzilla. Bug 1715690, "Bucket WebGL RENDERER strings." bugzilla.mozilla.org/show_bug.cgi?id=1715690
24. FingerprintJS. Audio source, src/sources/audio.ts. github.com/fingerprintjs/fingerprintjs/…/audio.ts
25. D. Fifield and S. Egelman. "Fingerprinting web users through font metrics." Financial Cryptography and Data Security, 2015. fc15.ifca.ai/preproceedings/paper_83.pdf
26. The Chromium Projects. "User-Agent Reduction." chromium.org/updates/ua-reduction
27. WICG. "User-Agent Client Hints"; MDN, NavigatorUAData.getHighEntropyValues(). wicg.github.io/ua-client-hints, developer.mozilla.org/…/getHighEntropyValues
28. Ł. Olejnik, G. Acar, C. Castelluccia, C. Diaz. "The leaking battery: A privacy analysis of the HTML5 Battery Status API." DPM 2015, LNCS 9481. eprint.iacr.org/2015/616
29. MDN. Navigator.connection; Navigator.keyboard; Firefox 52 release notes. developer.mozilla.org/…/Navigator/connection, …/Navigator/keyboard, …/Firefox/Releases/52
30. Tor Project. "New Release: Tor Browser 9.0." 22 October 2019. blog.torproject.org/new-release-tor-browser-90
31. MDN. Navigator.deviceMemory; Chrome 147 release notes. developer.mozilla.org/…/deviceMemory, developer.chrome.com/release-notes/147
32. Mozilla Bugzilla. Bug 1233846, "WebSpeech Synthesis API mustn't allow fingerprinting." bugzilla.mozilla.org/show_bug.cgi?id=1233846
33. Brave. "Farbling" (fingerprinting protections list). dev-pages.bravesoftware.com/fingerprinting/farbling.html
34. Microsoft. "Font list, Windows 11" and "Font list, Windows 10", Typography. learn.microsoft.com/…/windows_11_font_list, windows_10_font_list
35. The Chromium Projects. Blink, alternate_font_family.h (AlternateFamilyName). chromium.googlesource.com/…/alternate_font_family.h
36. WebKit. FontCache::alternateFamilyName and FontCache::platformAlternateFamilyName. github.com/WebKit/WebKit/…/FontCache.cpp, cocoa/FontCacheCoreText.cpp
37. Android Open Source Project. System font configuration, fonts.xml. android.googlesource.com/…/data/fonts/fonts.xml
38. fontconfig. 30-metric-aliases.conf, "Set substitutions for similar/metric-compatible families." gitlab.freedesktop.org/fontconfig/…/30-metric-aliases.conf