What is audio fingerprinting?
Audio fingerprinting, in the browser-tracking sense this page covers, is a technique that generates a silent, synthetic sound wave inside your browser, runs it through your device's audio processing hardware, and measures the tiny mathematical differences in the output to identify your specific device. It never touches your microphone and triggers no permission prompt — it's a property of your hardware and software stack, not a recording of anything real. (A separate, unrelated use of the same name — Shazam-style song identification — is covered in the FAQ below.)
How it actually works
A fingerprinting script creates an OscillatorNode — a simple sine or triangle
wave generator — and routes its output through a DynamicsCompressorNode, then
reads back the resulting floating-point audio samples using
getChannelData() or getFloatFrequencyData(). The math involved is
identical on paper, but the actual numbers that come out differ slightly from machine to
machine, because floating-point rounding behaves differently depending on the CPU, the
operating system's audio drivers, and the browser's own audio engine implementation. That
small, consistent variation gets hashed into a short string — a fingerprint that's stable
across visits to the same device.
Fingerprinting scripts almost always use OfflineAudioContext rather than a live
audio context specifically because it renders the entire signal silently and near-instantly
in the background, with nothing audible and nothing requiring user interaction to start.
Why it survives defenses built for canvas fingerprinting
Canvas fingerprinting and audio fingerprinting are unrelated techniques exploiting unrelated parts of the browser, so a defense built for one does nothing to the other. Canvas fingerprinting works through the HTML5 rendering pipeline; audio fingerprinting works through the Web Audio API and the device's actual audio processing stack — a lower, separate layer. Blocking or randomizing canvas output has no effect on what an OscillatorNode produces, which is exactly why serious anti-fingerprinting tools (Tor Browser, Firefox's resistFingerprinting mode) treat audio as its own defense target, not something covered automatically by canvas protections. Our own canvas fingerprint test checks the unrelated technique this section is about — worth running separately from the audio one below, since neither result tells you anything about the other.
How much tracking power it actually provides
The technique first drew wide attention after Princeton researchers Steven Englehardt and Arvind Narayanan documented it being used for real-world tracking in their 2016 study of one million websites. Measured on its own, one analysis of roughly 18,000 machines found the AudioContext fingerprint carried about 5.4 bits of entropy — enough to narrow a device down to roughly 1-in-40, not enough on its own to uniquely identify someone. Its real value to trackers comes from combination: commercial fingerprinting vendors now weight audio fingerprints alongside 70 or more other signals (canvas, fonts, WebGL, screen and hardware details), pushing claimed device-identification accuracy above 99%. Unlike a supercookie, a fingerprint stores nothing on your device at all — there's no identifier to clear, because the "identifier" is just how your existing hardware behaves.
How to check your own exposure
Run our browser fingerprint test to see exactly what an audio fingerprint (and the other signals combined with it) currently reveals about your specific browser and device.
Does audio fingerprinting listen to my microphone?
No — this is the most common and most reasonable misconception about it. The technique never requests microphone access and triggers no browser permission prompt at all, because it never records real-world sound. It generates its own inaudible test signal entirely inside the browser and measures how your device's audio processing hardware and software render that signal — a property of your machine, not a recording of your environment.
Can blocking canvas fingerprinting also block audio fingerprinting?
No — they're unrelated defenses. Canvas fingerprinting exploits the HTML5 <canvas> rendering pipeline; audio fingerprinting exploits the separate Web Audio API and the device's audio processing stack underneath it. Security researchers specifically note that audio fingerprinting keeps working even when canvas and WebGL protections are active, since it operates at a lower level of the browser entirely. A defense has to target the Web Audio API specifically to have any effect on it.
Do ad blockers stop audio fingerprinting?
Rarely, and not reliably. Most ad blockers work by blocking known tracker domains or script URLs, not by inspecting what a script does once it runs. A fingerprinting script served from a domain the blocklist hasn't flagged yet will execute the AudioContext code without interference. Blocking this specific technique requires a tool that either restricts the Web Audio API directly or adds noise to its output — a different category of protection than a standard ad blocker.
Does adding random noise via a browser extension fully defeat audio fingerprinting?
Not completely — it can make you more identifiable in a different way. Tools like CreepJS specifically test for this by rendering the same audio fingerprint multiple times in one session: a real, unmodified device produces a consistent result each time, while many noise-injection extensions produce a slightly different result on every render. That inconsistency pattern is itself detectable and can flag you as someone actively spoofing their fingerprint — which some fraud-prevention systems treat as its own distinct signal.
Is "audio fingerprinting" the same thing as Shazam-style song recognition?
No — same name, unrelated technology. Content-identification fingerprinting (Shazam, YouTube's Content ID) analyzes the acoustic properties of an actual audio recording — a song or video's soundtrack — to identify what piece of media it is. The browser-tracking technique this page covers analyzes how your device's audio hardware processes a synthetic test signal to identify which device you are. They share a name purely by coincidence of both involving audio and a "fingerprint."