how to actually stop browser fingerprinting

The defenses that work aren't the ones in the marketing. Incognito doesn't help. A VPN barely helps. The things that collapse you from uniquely identifiable to blandly anonymous are a short list of specific browser settings and two specific extensions. Here's the complete list, in order of effort vs. payoff, plus what to expect to break.

01the honest cost/benefit

Every defense on this page costs something. Some cost speed. Some break sites. Some cost convenience. The goal isn't "maximum paranoia." The goal is shedding uniqueness — moving your browser from a snowflake that can be identified across sessions to a flake that looks like everyone else in its bucket. You can keep shopping, streaming, banking, and watching YouTube while doing this. You just stop being a person-shaped dossier.

02seal the webrtc leak first

This is the single most important fix, because it's the one that leaks your real IP while your VPN is on. If you're on a VPN and your WebRTC Local IP row in SNITCHTEST shows your actual LAN or public IP, everything else on this list is secondary.

chrome, edge, brave, opera, arc (chromium family)

Install the WebRTC Network Limiter extension published by Google itself. Open its options and pick "Use my proxy server (if present); otherwise use any other routes". That setting forces Chrome to route WebRTC through your VPN or not at all, which eliminates the leak without breaking video calls.

firefox

Visit about:config, accept the warning, and set:

media.peerconnection.ice.default_address_only = true
media.peerconnection.ice.no_host = true

The first setting makes WebRTC use only the default route (the VPN, if active). The second stops WebRTC from enumerating local interfaces at all. Together they close the leak without disabling video calls.

safari

Safari disables the leak by default for non-HTTPS origins and routes conservatively on HTTPS. There's no knob. Verify with a leak test.

03enable browser-level fingerprint protection

brave (easiest)

Settings → Shields → Block fingerprinting: Strict. That's it. Brave randomizes canvas, audio, WebGL, and font enumeration per site per session, which breaks cross-site tracking without breaking the sites themselves. The default is "Standard," which is good enough for most users; Strict is better.

firefox

Visit about:config, set privacy.resistFingerprinting = true. This activates Mozilla's Tor-derived anti-fingerprinting code, which standardizes values (screen size, fonts, timezone, more) so that every user with the setting on looks like every other user with the setting on.

Cost: timezone reports as UTC, your window is forced into discrete sizes on resize, some fonts appear as "missing." A handful of sites will render slightly wrong. Most won't notice. If you want the anti-fingerprint protection without the timezone spoof (the most annoying part), use privacy.fingerprintingProtection = true in recent Firefox builds, which is a softer variant.

chrome and edge

Chrome has no built-in anti-fingerprinting and no roadmap for one. Edge has a few heuristic defenses under Tracking Prevention → Strict, but they don't rival Brave or Firefox. If you want Chromium's compatibility with real anti-fingerprinting, use Brave. This is the actual answer.

safari

Settings → Advanced → Show Develop menu. Turn on Intelligent Tracking Prevention (it's on by default since Safari 13). Turn on "Hide IP address from trackers" (Safari 15+). Safari's fingerprint defense is weaker than Brave's but it's built in and on by default, which is not nothing.

04install ublock origin (still)

uBlock Origin is the single highest-leverage privacy extension. Most fingerprinting happens inside third-party scripts loaded by tracking SDKs. Stop the scripts from loading and the fingerprinting doesn't run.

Default mode is fine. Medium mode is better. Open uBlock → Dashboard → Settings → "I am an advanced user." Back on the main popup, click the padlock next to "3rd-party scripts" and "3rd-party frames" and set both to globally blocked. Use the per-site padlocks to allow scripts on sites that actually need them. This breaks things until you adjust, then it settles into a much cleaner browsing experience.

05the firefox power-user path: arkenfox

Arkenfox user.js is a community-maintained set of about:config overrides that turn a stock Firefox into something approaching Tor Browser's protection, without the network anonymization. It's overkill for most people and it costs real convenience (you'll log into some sites every day, because it clears cookies on close). For the right user, it's the best non-Tor option that exists.

06what about a different browser entirely?

brave

The practical recommendation for most users. Chromium-compatible (extensions work, sites work) but with real fingerprint defenses on by default. Pick Strict shields and you're ahead of 99% of the internet without doing anything else.

librewolf / mullvad browser

Firefox forks with Arkenfox-level defenses baked in. LibreWolf is general-purpose; Mullvad Browser is a Tor-Project-collaborated build specifically aimed at non-Tor users who want Tor-style fingerprint protection.

tor browser

The gold standard. Every user looks identical by design. Use it for the specific sessions that need it, not for everything, because pages are slower and a lot of sites challenge Tor traffic.

safari on iPhone

Under-rated. iCloud Private Relay, if enabled, is effectively a lightweight Apple-run proxy that strips your IP from the first hop. Safari's default tracking prevention is solid. The iPhone's narrow hardware variety means your canvas/WebGL hash is already shared with millions of other iPhones.

07what doesn't work

• Incognito / InPrivate mode. Hides cookies from the local disk. Changes nothing about the network or the fingerprint. Most useful trick is testing a site while signed out.
• "Privacy-focused" search engines. Valuable for search history, irrelevant for fingerprinting.
• Consumer VPNs alone. They change your IP. The fingerprint is still yours.
• Deleting cookies every session. Cookies are the least interesting part of the dossier. The fingerprint re-identifies you inside a second.
• Fake User-Agent extensions. They change one field that servers compare against twelve other fields. Most just make you weirder and thus more unique.

08verify with a leak test

After any change, confirm it actually took effect. Run SNITCHTEST (you're on the site), EFF's Cover Your Tracks, or creepjs. The specific rows to watch for improvement:

• WebRTC local IP — should show blocked / default route only.
• Canvas / WebGL / Audio fingerprint — should change between sessions on Brave (randomized) or show standardized values on Firefox RFP.
• Timezone + language — should no longer disagree with your VPN exit country if you enabled resistFingerprinting.
• Installed fonts — the detected count should drop sharply. Full list should not be exposed.

Re-run after each change, one at a time, so you know which defense did what. When you're done, your SNITCHTEST grade should shift noticeably from red toward green.

09faq