Browser fingerprinting is the process of identifying a browser based on its unique characteristics. Every browser installation has a slightly different combination of screen resolution, installed plugins, WebGL renderer, canvas output, audio context characteristics, and dozens of other signals. Together, these signals form a fingerprint that can uniquely identify a browser across sessions.
Anti-bot systems use fingerprinting to detect automated browsers. A real Chrome installation has a specific set of characteristics that differ from a Playwright-controlled browser. Fingerprint-oss is the open source library that captures these characteristics, and understanding what it collects is essential for building effective anti detection scrapers.
What fingerprint-oss collects
Fingerprint-oss collects signals from multiple browser APIs. The screen API provides resolution, color depth, and pixel ratio. The navigator API provides the user agent, language, platform, hardware concurrency (CPU cores), device memory, and the list of installed plugins. The WebGL API provides the GPU vendor and renderer string. The Canvas API renders a specific image and hashes the output. The AudioContext API generates an audio signal and hashes the result.
Each of these signals is collected independently and hashed together into a composite fingerprint. The hash is designed to be stable across sessions (the same browser produces the same fingerprint) but sensitive to changes (different browsers produce different fingerprints).
Canvas fingerprinting
Canvas fingerprinting works by drawing a specific image on an HTML5 canvas and extracting the pixel data. The exact output depends on the GPU, the graphics driver, the font rendering engine, and the browser's canvas implementation. Even two identical machines with the same hardware can produce different canvas fingerprints due to driver differences.
Anti-bot systems use canvas fingerprinting because it's hard to fake consistently. Spoofing the canvas hash is easy. Making sure the canvas hash is consistent with the GPU information from WebGL is harder. Making sure both are consistent with the font rendering characteristics is harder still. Fingerprint-oss captures all three to check for consistency.
WebGL fingerprinting
WebGL fingerprinting extracts the GPU vendor and renderer string from the WebGL API. This tells anti bot systems what graphics hardware the browser is running on. A Playwright-controlled browser typically reports 'SwiftShader' (a software renderer), which is a dead giveaway for automation. Real browsers report the actual GPU hardware.
Fingerprint-oss captures the WebGL vendor and renderer string and compares them against known GPU profiles. If the reported GPU doesn't match the expected capabilities (for example, reporting a high-end GPU but producing canvas output that looks like a software renderer), the fingerprint is flagged as inconsistent.
Audio fingerprinting
Audio fingerprinting generates a specific audio signal using the Web Audio API and hashes the output. The exact output depends on the audio processing pipeline, which varies between browsers and operating systems. This signal is harder to spoof than canvas or WebGL because the audio processing pipeline is less well understood.
Fingerprint-oss collects the audio context sample rate, the oscillator output, and the analyser node characteristics. Together, these form an audio fingerprint that's unique to the browser's audio processing stack. Anti-bot systems use this as a secondary signal to verify consistency with the canvas and WebGL fingerprints.
How IntelliScrape uses fingerprint data
IntelliScrape uses fingerprint-oss to generate consistent fingerprints for its browser engines. When the playwright stealth engine (tier 2) connects to a target, it captures the fingerprint and ensures all signals are internally consistent. If the canvas hash suggests a specific GPU, the WebGL renderer string matches. If the screen resolution suggests a specific display, the font list matches.
The camoufox engine (tier 4) goes further by rewriting the browser's fingerprint at the C level. It modifies the canvas rendering pipeline, the WebGL implementation, and the audio processing stack to produce fingerprints that are consistent with a real Firefox installation. This is much more effective than JavaScript-level spoofing because it can't be detected by checking for patched APIs.
Privacy implications
Browser fingerprinting raises legitimate privacy concerns. The same technology that helps anti bot systems detect automation can be used to track users across websites. Fingerprint-oss is designed to be used defensively, for anti detection scraping, not for tracking users.
The library runs locally and doesn't send fingerprint data to any external service. When used with IntelliScrape, fingerprint data is generated, used for the current session, and discarded. It's not stored in the operational logs. This is consistent with IntelliScrape's overall approach to privacy: collect what's necessary for the task, use it locally, and don't retain it.
