Antifraud systems combine browser measurements into a fingerprint that can outlast cookies and IP changes. This guide explains the most distinctive signals and why changing Canvas alone is not enough.
A website sees a collection of measurements, not one browser label. Each signal is weak on its own; together they form a fingerprint that survives cleared cookies and a new IP address. The main signals are:
| Channel | What is being measured | Typical distinguishing value |
|---|---|---|
| List of fonts | what fonts are installed on the system | highest entropy: 9.45 bits, 35% of machines are unique |
| WebGL | video card line, rendering parameters | high, hardware-dependent |
| Canvas | hash of the rendered image | high |
| Audio | signal hash via Web Audio | high on different machines |
| Screen and DPR | resolution and pixel density | average |
| Time zone, language | system settings | low individually, consistency is important |
Fonts come first because they carried the most entropy in our measurements. The installed-font list alone made 35% of machines unique in the sample.
Our first measurement exposed a serious issue. Two profiles on one machine without separate device sets produced identical results on font metrics, WebGL parameters, clientRects and audio in every configuration. A website could link those accounts regardless of cookies or IP address. That result shaped the product architecture.
The answer was a coherent device configuration taken from a real computer, not arbitrary noise. Once each profile received its own device set, the same signals became distinct. We verified the result in live browsers:
| Surface | Varies between the two profiles |
|---|---|
| WebGL vendor and renderer | Yes |
| Parameters WebGL | Yes |
| Screen geometry and DPR | Yes |
| Number of cores and memory | Yes |
| List of fonts | Yes |
| Speech synthesis voices | Yes |
| Web Audio Constant Table | Yes |
| Canvas | yes, the noise is from the profile seed |
Changing Canvas while leaving the real font list untouched does not prevent linking: the remaining signals still match. Some signals should not be altered at all.
The engine deliberately leaves common-font text metrics unchanged. Detectors use measuretext-grid, which is designed to detect distortion; changing the value would expose the browser. The same applies to clientRects (see bcr-vs-range). These signals are not expected to differ: on two physical machines with the same OS and DPR, Arial has the same width because the font file and system define it.
Verify it yourself. Create two profiles on the free plan, open the test page in each one and compare the raw values:
Canvas and WebGL differ, while the profile signals remain coherent. You can verify that in the raw values, not in our description. Or open the fingerprint test: it measures your browser and places a NimbusX profile next to it for comparison.
One signal still links profiles running on the same machine: the rendered-audio hash. Engine noise varies by domain, not by profile. Two physical computers produce different hashes, but profiles on the same machine currently share one. The dashboard shows this openly in each profile's AUD cell. Until NimbusX ships its own engine build, keep profiles for the same platform on separate machines.
Audio fingerprints and device signals · Consistency matters more than variety