Chrome kept one fingerprint ID across five cookie-free sessions; Brave produced five different ones

The test

A hands-on experiment published on dev.to asked a narrow question: if you delete every cookie and start from a blank profile, can a website still recognise you? The author built a small page that gathers seven properties from the browser — a hash of a canvas drawing, the output of an OfflineAudioContext render, screen dimensions with colour depth and pixel ratio, timezone, the language list, the reported CPU core count, and the WebGL renderer string. The values are joined, hashed with SHA-256, and the first eight hexadecimal characters become a short ID, which the page also displays as a two-word nickname for readability.

Each visit ran through Playwright using a persistent-context launch pointed at a freshly created temporary profile directory that was deleted afterwards, with the page served from localhost. The hardware was an Apple M1 Pro with 16 GB of RAM on macOS 26.6.2; the tested builds were Chrome 155.0.8059.40 and Brave 155.1.97.56, both running headless.

The result

Chrome returned the identical ID — e08e953c, shown as "Bold Llama" — on five of five visits, each starting from an empty profile with no stored data. Brave, with default settings, produced five different IDs across five fresh-profile visits, and five more when the same profile was reused but the browser was restarted each time. The author also checked Brave's Shields settings in a clean profile and found the "Block fingerprinting" toggle already on.

The per-part breakdown explains the gap. In Chrome, all seven inputs held a single value across every run. In Brave, three inputs varied — the canvas hash, the audio sum, and the CPU core count, reported as 7, 4, 8, 7 and 7 — while the other four stayed fixed.

Why the browsers differ

None of the seven values lives in the browser profile, as the write-up points out. They describe the hardware and system underneath, so a brand-new profile reads them exactly as an old one does. A cookie is data a site writes to your disk; a fingerprint is an answer your machine gives when a site asks.

Brave's defence, according to its fingerprinting documentation cited in the post, is not to block the reads but to add small random perturbations, seeded separately for each session, site (eTLD+1) and storage area. Because the ID is a hash over seven parts, one moving input breaks it — and three moved. Consistent with the per-session seed, reloading the page inside a single Brave session kept the same ID every time; only a browser start produced a new one.

The post also connects the finding to the consent debate. Mozilla's Tom Ritter wrote in a November 2025 piece that fingerprinting "lets websites identify you even when cookies are blocked or you're in private browsing", and the UK regulator ICO noted in December 2024 that from 16 February 2025 Google no longer prohibits fingerprinting in its advertising products — Google having earlier said users "cannot easily consent to it as they would cookies".

Caveats

The author is upfront about the limits: one machine, five measured visits per run, headless mode with default launch flags (which led both browsers to report screen sizes that did not match the physical display), and a seven-signal toy page rather than a real ad tracker. Real trackers fold in more signals, including the IP address, which Brave does not hide. The test shows Chrome's ID is stable, not that it is unique — two identical Macs could produce the same value. Firefox with Strict protection was not tested. Planned follow-ups include a visible-window run and a second identical Mac to check for collisions.

Why it matters

The experiment turns an abstract privacy argument into something reproducible: on this setup, clearing cookies, using a fresh profile or wiping storage changed nothing about what the page could see in Chrome. Cookie-focused consent flows and cookie-clearing habits simply do not address this channel, which is why regulators have flagged it. Brave demonstrates the alternative — randomising enough inputs that the hash collapses each session — though that buys untraceability across sessions, not anonymity, since signals like the IP address remain. For anyone evaluating a browser's privacy claims, a localhost page and five visits are enough to measure what it actually reveals.