Browser fingerprinting in 2026: JavaScript signals fade, TLS and WebGL endure

A technical audit published on dev.to concludes that browser fingerprinting still functions in 2026, but the techniques that yield usable signal have shifted almost entirely. According to the author, Chrome's Privacy Sandbox has frozen or removed around half the signals fingerprinting libraries once relied on, Firefox and Safari now inject noise or restrict APIs, and Brave blocks fingerprinting attempts outright — all while headless automation frameworks have become far better at faking what survives. The audit opens with a caveat worth repeating: a fingerprint is not a durable cross-browser identity, and no single fingerprint proves whether a visitor is human or automated.

The signals that died

The user-agent string leads the list. Since Chrome 107 arrived in late 2022, the string has been effectively frozen, the author writes: the version number still increments, but OS data is pinned to a generic Windows NT 10.0 value and platform details no longer track minor releases. Firefox and Safari followed suit, leaving a string that separates browser families and little else — and one that automation frameworks can set arbitrarily, which makes it a liability for bot detection.

Plugin and MIME-type enumeration is equally finished. Where browsers once reported installed plugins such as Flash or Java, Chrome and Firefox now return a fixed generic array. navigator.platform has likewise been pinned to values such as Win32 regardless of real architecture, and its intended replacement, navigator.userAgentData.platform, was deliberately built to carry less information and to place detailed values behind a permission request.

Degraded but usable

Canvas fingerprinting — drawing a complex scene, reading back pixel data and hashing it — still works on roughly 80% of browsers by the author's estimate, but with sharp per-browser differences. Chrome returns stable, device-specific output. Firefox has injected noise since version 113 through its privacy.resistFingerprinting setting, which is off by default but active in strict mode and private windows, producing a different hash on every page load when enabled. Safari offers minimal canvas protection. Brave randomizes aggressively by default, which defeats the technique against its users entirely.

Font enumeration has weakened as operating systems ship increasingly similar default font sets, web fonts displace system font rendering, and privacy settings return fixed lists; it can still separate Windows from macOS from Linux, but not much beyond that. Screen and display properties are now low-value: per the audit, a 1920×1080 display at 1× scale describes tens of millions of devices, and viewport size can be spoofed by Playwright or Puppeteer in a single line.

What still works

WebGL receives the strongest endorsement of any JavaScript-accessible technique. Unmasked renderer strings identify specific GPU models, and rendering a 3D scene produces pixel output that varies across graphics architectures. The author argues vendors hesitate to restrict WebGL because doing so breaks games, data visualization and mapping applications, and visible noise injection would break them outright. For bot detection the technique is especially effective: headless Chrome in a cloud VM typically reports a virtual GPU such as SwiftShader or llvmpipe, which stands out immediately from genuine consumer hardware, and spoofing services struggle to reproduce the complete set of parameters a real GPU exposes.

AudioContext fingerprinting also holds up, exploiting floating-point sample differences that stem from audio hardware and driver stacks.

The shift to the network layer

The audit's clearest trend is that durability is migrating below the browser's API surface. TLS fingerprinting with JA4 is rated the strongest signal of all — high in entropy and effectively unspoofable from JavaScript, invisible to privacy extensions and stealth tooling. HTTP/2 settings frames provide medium entropy with high durability and remain underused, while TCP/IP stack characteristics occupy a niche but durable position.

Why it matters

For teams building fraud or bot mitigation, the practical takeaway is that guidance from even two years ago is now unreliable: the cheap JavaScript signals are dead or noisy, and the survivors must be combined into composite scores rather than trusted individually. For privacy engineering, the audit points to an uncomfortable conclusion — client-side mitigations, however aggressive, cannot reach network-layer fingerprints, so the next phase of the arms race will play out over TLS and HTTP/2 characteristics rather than canvas pixels. The piece is a single practitioner-authored post on dev.to, so its percentage estimates should be read as the author's assessment rather than independently measured data.