Fingerprinting Technique
Audio Fingerprinting: The Quiet Tracker with 99% Uniqueness
By driving the Web Audio API, sites can generate a unique spectral signature of your device without microphone access. It is highly identifying and often paired with canvas and WebGL to link sessions even when cookies are gone.
No mic permission neededWorks in iframes99.6% uniqueness (research-grade)
How Audio Fingerprinting Works
Trackers create an AudioContext, generate a tone, pass it through filters and compressors, then read the resulting float data from an analyser node. Tiny differences in your sound hardware, drivers, and OS audio stack change the frequency response. Hashing that output yields a stable device signature.
- Oscillator → compressor → analyser chain produces a deterministic signal.
- Sample rate (44.1k vs 48k), channel count, and latency values add entropy.
- Even muted tabs are fingerprintable—the audio never reaches speakers.
Why it is so identifying
- Floating-point quirks in DSP pipelines differ per CPU/GPU/driver.
- Browser normalization is weaker here than in canvas/WebGL.
- Entropy stacks: sample rate + FFT bins + compressor curve.
Common real-world uses
- Fraud scoring on checkout/login flows.
- Ad-tech device graphs to re-link users across sessions.
- Bot detection vendors alongside canvas + JA3/TLS.
Defenses That Actually Work
- Standardize: Tor Browser and Firefox RFP clamp values to common baselines so everyone looks identical.
- Noise/Randomize: Extensions that add tiny random offsets to frequency data. Effective for tracking prevention but can appear suspicious to fraud systems.
- Consistent Spoofing: Anti-detect browsers must align audio output with canvas, WebGL, headers, and fonts. Random audio + stable canvas = bot flag.
- Block: Disable AudioContext APIs entirely; strongest privacy, but may break sites needing audio or WebRTC preflight checks.
Tip: Always test changes. Run the Audio Fingerprint Test after switching browsers or extensions and compare hashes with your Canvas and WebGL outputs for consistency.
Hardening Checklist
- Mute ≠ safe. Use RFP or dedicated spoofing, not just tab mute.
- Keep sample rate consistent with your claimed OS/user-agent.
- Pair audio noise with canvas/WebGL noise to avoid mismatched entropy.
- On headless/VMs, verify no -Infinity bins in analyser output.
- Re-run tests per profile; never share hashes across accounts.
Test your audio fingerprint now
Get a live hash, protection status, and compare against canvas/WebGL in seconds.