Back to Glossary 
5 min read Hardware Fingerprinting
Hardware fingerprinting identifies a computing device from technical signals. It is different from biometric fingerprint recognition, which uses a sensor to identify a person from their fingerprint. It is a technique that identifies a device from the characteristics of its physical components, such as the processor, graphics chip, memory, screen, and, on phones, sensors and device identifiers. Because these traits rarely change, hardware-derived signals can remain stable after cookies are cleared, although the resulting fingerprint may vary with browser settings, privacy protections, and device changes.
What is hardware fingerprinting?
Hardware fingerprinting is the process of collecting hardware-level signals from a device and combining them into an identifier that websites, apps and anti-fraud systems can recognize on later visits. It is one layer of device fingerprinting. Browser fingerprints can also include hardware-derived signals, such as screen and graphics characteristics. The two techniques overlap rather than being completely separate.
How does hardware fingerprinting work?
Hardware fingerprinting works in three steps. First, a script on a website or code inside an app collects hardware signals from the device. Next, those signals are combined, often with a hashing algorithm, into a single fingerprint. Finally, the fingerprint is compared with ones seen before, so the service can tell whether a returning visitor is on a known device, a new device, or a device already linked to other accounts.
Which hardware signals are collected?
What a service can read depends on whether it runs in a browser or as an installed app.
| Signal | On websites (browser) | In mobile apps (Android) |
|---|---|---|
| Processor | Reported logical processor count, which the browser may limit | CPU architecture and model |
| Graphics | GPU vendor and renderer via WebGL, plus small differences in how canvas and WebGL images render | GPU model and graphics capabilities |
| Memory | Approximate RAM, in Chromium-based browsers | Total RAM |
| Screen | Resolution, pixel density and color depth | Display specs |
| Audio | Small differences in how the audio stack processes sound | Audio hardware details |
| Device identity | Not available | Device model, manufacturer, build properties and the Android ID |
| Sensors and battery | Limited and often permission-gated | Accelerometer, gyroscope, other sensors and battery data |
Websites cannot read hardware serial numbers, MAC addresses or BIOS data, because browsers do not expose them. Instead, websites infer hardware indirectly, for example from how a specific graphics chip renders a test image.
Installed apps have more access, but modern operating systems limit it. Since Android 10, regular apps cannot read a phone’s IMEI or hardware serial number. On Android 8.0 and later, Android ID is scoped to each combination of app-signing key, user, and device
What is hardware fingerprinting used for?
The most common use is fraud prevention and account security. Banks, payment providers and online platforms recognize trusted devices at login, and they ask for extra verification when an account is suddenly accessed from unfamiliar hardware.
The same signals help platforms detect bots and ad fraud, since automated traffic often runs on hardware that looks nothing like a real person’s phone or laptop.
Social and e-commerce platforms also use hardware fingerprints to see when several accounts run from the same device. Shared device signals may be one factor in how platforms assess related account activity, but they do not determine the outcome on their own.
Outside consumer platforms, hardware fingerprinting supports software licensing, by tying a license to a specific machine, and enterprise security, where IT teams use device identity to keep unknown hardware off company networks.
Hardware fingerprinting on mobile apps
Mobile apps such as TikTok, Instagram and WhatsApp can collect far more hardware detail than a website can, so hardware fingerprinting carries more weight on mobile.
This is also why Android emulators are easy to tell apart from real phones. Emulators often report generic device models, missing or simulated sensors, and processor or graphics details that no real smartphone has. A real device produces a consistent, complete set of hardware signals.
Limitations and privacy concerns
Hardware fingerprinting raises privacy concerns because it can track people without their knowledge, and unlike cookies, users cannot clear it. In the EU, data protection guidance treats device fingerprinting much like cookies, which generally means sites need user consent before using it for tracking.
Hardware fingerprinting is also less precise than it seems:
- Identical devices look alike. Thousands of identical phone or laptop models in the same configuration produce very similar hardware fingerprints, so services usually combine them with browser, network and behavioral signals.
- Upgrades change the fingerprint. Replacing a component such as a graphics card can change it and trigger a false “new device” alert.
- Privacy features reduce accuracy. Browsers like Firefox and Safari add fingerprinting protection that limits or blurs some of these signals.
How to manage hardware fingerprinting
For everyday privacy, the most practical step is a browser with built-in fingerprinting protection, kept up to date. Disabling JavaScript entirely blocks most fingerprinting scripts, but it also breaks most modern websites.
For people who manage multiple accounts across apps and websites, separate and consistent device environments can make account workflows easier to organize. Each account should run on its own device environment that stays the same over time. Randomizing hardware details on every session tends to make an account look less trustworthy, not more.
Multilogin Cloud Phones give each mobile account its own Android environment. They run on real smartphone hardware rather than an emulator, with their own device parameters, apps, saved sessions and built-in proxies. For web-based accounts, Multilogin browser profiles keep each account’s browser and device signals isolated in the same dashboard. No tool removes the need to follow each platform’s rules on multiple accounts. Separate environments reduce shared device-level signals, but platforms may still associate accounts using other information or behavior.
Key takeaway
Hardware fingerprinting identifies a device by its physical components, which makes it the most persistent layer of device identity and one users cannot simply reset. Websites infer hardware indirectly through signals like graphics rendering, while mobile apps read much more detail directly. For anyone running multiple accounts, the answer is a separate, consistent device environment for each account, such as one Android cloud phone per mobile account.
People Also Ask
How does hardware fingerprinting differ from browser fingerprinting?
Hardware fingerprinting identifies a device by its physical components, such as the processor, graphics chip, memory and screen. Browser fingerprinting focuses on software settings like fonts, extensions, language and the user agent. Most tracking systems combine both, but the hardware layer is harder to change.
Can hardware fingerprinting track users across multiple browsers?
Often, yes. Hardware signals come from the device itself, so they usually stay the same when you switch browsers on the same computer or phone. Browsers with built-in fingerprinting protection, such as Firefox and Safari, can limit or blur some of these signals.
Can you change your hardware fingerprint?
Not easily, because a hardware fingerprint is built from the device's physical components. Upgrading a part like the graphics card can change it, but that isn't practical as a privacy measure. For managing multiple accounts, the better approach is to give each account its own separate, consistent device environment, such as one Android cloud phone per mobile account.
Is hardware fingerprinting legal?
It depends on the region and how it is used. In the EU, regulators treat device fingerprinting much like cookies under the ePrivacy Directive, which generally means sites need user consent before using it for tracking. In California, the CCPA requires businesses to disclose this kind of data collection and let users opt out of its sale or sharing. Requirements depend on the jurisdiction, purpose, and applicable exceptions. Security-related uses should be assessed separately from advertising or tracking.
Does using a VPN prevent hardware fingerprinting?
No. A VPN changes your IP address, but hardware fingerprinting reads signals from the device itself, like graphics rendering, screen and processor details, which stay the same with or without a VPN.
How can you reduce hardware fingerprinting?
For everyday privacy, use an up-to-date browser with built-in fingerprinting protection, such as Firefox or Safari. For teams managing multiple accounts, the goal is separation rather than hiding: run each account in its own consistent environment, such as a Multilogin cloud phone for mobile apps or a browser profile for web accounts, so accounts aren't linked through shared hardware.
Is hardware fingerprinting the same as fingerprint recognition?
No. Hardware fingerprinting identifies a device using technical characteristics, while biometric fingerprint recognition checks a person's fingerprint through a sensor. They are different technologies.
Can hardware fingerprinting uniquely identify every device?
No. Devices with similar hardware can expose similar signals, and browser protections can limit the information collected. Fingerprinting systems may combine hardware, software, and network signals, but identification is not always reliable.
