Fingerprinting · August 2026

Browsers are closing the fingerprint. This never opened it.

Brave now de-identifies WebGL and WebGPU by default. Safari and Firefox have been narrowing the same APIs for years. If what you bought identifies a visitor by reading their device, it gets weaker every time a browser ships a privacy release, and nobody sends you a notice.

What Brave actually changed.

From version 1.93, Brave replaces the WebGL vendor and renderer strings with a single generic value, so every Brave user reports the same one. It empties the WebGPU adapter descriptors, and injects noise into the list of supported WebGL extensions so that a fingerprinter hashing that list gets a different answer each time.

On by default, on desktop and on Android.

Source: Brave, improving protections against GPU fingerprinting

A signal that a browser vendor can switch off is a signal you are renting, not one you own.

This is not one release. It is a direction, and it only goes one way: every year there is less about a device that a page is allowed to read. Anything built on top of that surface gets quietly worse, and the first time you find out is when your block rate moves.

What this snippet never reads.

Not a promise about intent. A list you can check yourself, in the browser, in under a minute.

Canvas
No 2D canvas rendering, no readback, no toDataURL.
WebGL and WebGPU
The APIs Brave just de-identified. Never queried, so nothing to de-identify.
Audio
No AudioContext, no oscillator, no offline rendering.
Fonts
No enumeration, no measurement of installed families.
Hardware profile
Not the core count, not the memory, not the GPU, not the screen.
Time zone and locale
Not read, not sent, not stored.
Cookies and storage
The snippet sets none and writes nothing. There is no identifier to set.

There is nothing here for Brave to de-identify, because none of it is read in the first place. The protections that landed this month change nothing about how this works, which is the entire point of the page.

Open humaverify.com/demo, then devtools: Network tab one request, to humaverify.com. No third party. Application no cookies set, localStorage and sessionStorage empty. Console search humaverify.com/huma.js for canvas, webgl, webgpu, AudioContext or document.fonts. Every one of them: zero hits. The whole snippet is 8 KB. It is minified, and it is short enough to read.

What it reads instead.

How the session behaves over time, scored on the server. Behavior is not an attribute of a device: there is no vendor string to blank out, no adapter to empty, no list to add noise to. A browser hardening its privacy does not narrow it.

Every field the snippet sends is named in the API reference. Which of them carry weight, and how they are combined, is the one thing kept private, and the reasoning for that is its own page.

The part a vendor page would leave out.

Brave closing the GPU fingerprint does not make this better at catching bots. It makes the device-based approaches worse. Those are different sentences and only the second one is about Brave.

Reading behavior has its own limits, and they are written down rather than buried: what it misses, where the signal does not exist, and the cases where the honest recommendation is a competitor. That page is linked from the pricing page on purpose, so you read it before you pay rather than after.

One script tag, one call from your server.

14 days free, full API access, no credit card. Nothing to configure in a privacy console, because there is nothing being collected that would need one.

Get your API key
Help