Back to Glossary 
5 min read Hardware Fingerprinting
Hardware fingerprinting is a technique that identifies a device from the characteristics of its physical components, such as the processor, graphics chip, memory, screen and, on phones, sensors and device identifiers. Because these traits rarely change, a hardware fingerprint stays the same even after cookies are cleared or the browser is switched.
What is hardware fingerprinting?
Hardware fingerprinting is the process of collecting hardware-level signals from a device and combining them into an identifier that websites, apps and anti-fraud systems can recognize on later visits. It is one layer of device fingerprinting. Browser fingerprinting focuses on software settings like fonts, extensions and the user agent, while hardware fingerprinting looks at the physical device underneath. That makes it the most persistent part of a device’s identity: it survives cleared cookies, private browsing and, in many cases, a switch to a different browser on the same machine.
How does hardware fingerprinting work?
Hardware fingerprinting works in three steps. First, a script on a website or code inside an app collects hardware signals from the device. Next, those signals are combined, often with a hashing algorithm, into a single fingerprint. Finally, the fingerprint is compared with ones seen before, so the service can tell whether a returning visitor is on a known device, a new device, or a device already linked to other accounts.
Which hardware signals are collected?
What a service can read depends on whether it runs in a browser or as an installed app.
| Signal | On websites (browser) | In mobile apps (Android) |
|---|---|---|
| Processor | Number of CPU cores | CPU architecture and model |
| Graphics | GPU vendor and renderer via WebGL, plus small differences in how canvas and WebGL images render | GPU model and graphics capabilities |
| Memory | Approximate RAM, in Chromium-based browsers | Total RAM |
| Screen | Resolution, pixel density and color depth | Display specs |
| Audio | Small differences in how the audio stack processes sound | Audio hardware details |
| Device identity | Not available | Device model, manufacturer, build properties and the Android ID |
| Sensors and battery | Limited and often permission-gated | Accelerometer, gyroscope, other sensors and battery data |
Websites cannot read hardware serial numbers, MAC addresses or BIOS data, because browsers do not expose them. Instead, websites infer hardware indirectly, for example from how a specific graphics chip renders a test image.
Installed apps have more access, but modern operating systems limit it. Since Android 10, regular apps cannot read a phone’s IMEI or hardware serial number. Since Android 8, the Android ID is different for each app signing key on the same device.
What is hardware fingerprinting used for?
The most common use is fraud prevention and account security. Banks, payment providers and online platforms recognize trusted devices at login, and they ask for extra verification when an account is suddenly accessed from unfamiliar hardware.
The same signals help platforms detect bots and ad fraud, since automated traffic often runs on hardware that looks nothing like a real person’s phone or laptop.
Social and e-commerce platforms also use hardware fingerprints to see when several accounts run from the same device. That is why operating multiple accounts from one phone or laptop often leads to those accounts being linked.
Outside consumer platforms, hardware fingerprinting supports software licensing, by tying a license to a specific machine, and enterprise security, where IT teams use device identity to keep unknown hardware off company networks.
Hardware fingerprinting on mobile apps
Mobile apps such as TikTok, Instagram and WhatsApp can collect far more hardware detail than a website can, so hardware fingerprinting carries more weight on mobile.
This is also why Android emulators are easy to tell apart from real phones. Emulators often report generic device models, missing or simulated sensors, and processor or graphics details that no real smartphone has. A real device produces a consistent, complete set of hardware signals.
Limitations and privacy concerns
Hardware fingerprinting raises privacy concerns because it can track people without their knowledge, and unlike cookies, users cannot clear it. In the EU, data protection guidance treats device fingerprinting much like cookies, which generally means sites need user consent before using it for tracking.
Hardware fingerprinting is also less precise than it seems:
- Identical devices look alike. Thousands of identical phone or laptop models in the same configuration produce very similar hardware fingerprints, so services usually combine them with browser, network and behavioral signals.
- Upgrades change the fingerprint. Replacing a component such as a graphics card can change it and trigger a false “new device” alert.
- Privacy features reduce accuracy. Browsers like Firefox and Safari add fingerprinting protection that limits or blurs some of these signals.
How to manage hardware fingerprinting
For everyday privacy, the most practical step is a browser with built-in fingerprinting protection, kept up to date. Disabling JavaScript entirely blocks most fingerprinting scripts, but it also breaks most modern websites.
For teams that manage multiple accounts, such as agencies, social media managers and e-commerce sellers, the goal is not to hide hardware signals but to keep them separate and consistent. Each account should run on its own device environment that stays the same over time. Randomizing hardware details on every session tends to make an account look less trustworthy, not more.
Multilogin Cloud Phones give each mobile account its own Android environment. They run on real smartphone hardware rather than an emulator, with their own device parameters, apps, saved sessions and built-in proxies. For web-based accounts, Multilogin browser profiles keep each account’s browser and device signals isolated in the same dashboard. No tool removes the need to follow each platform’s rules on multiple accounts, but separating devices keeps accounts from being linked through shared hardware.
Key takeaway
Hardware fingerprinting identifies a device by its physical components, which makes it the most persistent layer of device identity and one users cannot simply reset. Websites infer hardware indirectly through signals like graphics rendering, while mobile apps read much more detail directly. For anyone running multiple accounts, the answer is a separate, consistent device environment for each account, such as one Android cloud phone per mobile account.
People Also Ask
How does hardware fingerprinting differ from browser fingerprinting?
Hardware fingerprinting identifies a device by its physical components, such as the processor, graphics chip, memory and screen. Browser fingerprinting focuses on software settings like fonts, extensions, language and the user agent. Most tracking systems combine both, but the hardware layer is harder to change.
Can hardware fingerprinting track users across multiple browsers?
Often, yes. Hardware signals come from the device itself, so they usually stay the same when you switch browsers on the same computer or phone. Browsers with built-in fingerprinting protection, such as Firefox and Safari, can limit or blur some of these signals.
Can you change your hardware fingerprint?
Not easily, because a hardware fingerprint is built from the device's physical components. Upgrading a part like the graphics card can change it, but that isn't practical as a privacy measure. For managing multiple accounts, the better approach is to give each account its own separate, consistent device environment, such as one Android cloud phone per mobile account.
Is hardware fingerprinting legal?
It depends on the region and how it is used. In the EU, regulators treat device fingerprinting much like cookies under the ePrivacy Directive, which generally means sites need user consent before using it for tracking. In California, the CCPA requires businesses to disclose this kind of data collection and let users opt out of its sale or sharing. Using fingerprinting for fraud prevention and security is widely accepted.
Does using a VPN prevent hardware fingerprinting?
No. A VPN changes your IP address, but hardware fingerprinting reads signals from the device itself, like graphics rendering, screen and processor details, which stay the same with or without a VPN.
How can you reduce hardware fingerprinting?
For everyday privacy, use an up-to-date browser with built-in fingerprinting protection, such as Firefox or Safari. For teams managing multiple accounts, the goal is separation rather than hiding: run each account in its own consistent environment, such as a Multilogin cloud phone for mobile apps or a browser profile for web accounts, so accounts aren't linked through shared hardware.
