ENBrowser audio fingerprinting uses the Web Audio API to process a synthetic signal and read the numerical result. A website can turn those values into an AudioContext hash. It may then combine the hash with Canvas, WebGL, and other signals as part of a broader browser fingerprint.
This process does not usually access your microphone or record microphone input. It is also different from the acoustic fingerprinting used to recognize songs. The target is the browser environment, not the audio content or the person speaking.
In simple terms, a page gives browsers the same audio processing task and compares their answers.
Browser Audio Fingerprinting vs. Acoustic Fingerprinting
The term has two established meanings. Browser audio fingerprinting measures an audio processing environment. Acoustic fingerprinting extracts features from a recording so services such as Shazam can identify the content.
| Area | Browser Audio Fingerprinting | Acoustic Fingerprinting |
|---|---|---|
| Target | Browser and Processing Environment | Song, Clip, or Recording |
| Typical Input | Synthetic Signal or API Properties | Recorded Audio Content |
| Common Use | Browser Recognition, Risk Analysis, Tracking | Music Recognition, Copyright Matching |
| Microphone | Usually Not Needed | Depends on How the Sample Is Captured |
| Result | Browser Signal or Tool-Specific Hash | Content Signature Matched Against a Database |
A voiceprint is also different. It analyzes traits in a person's voice for speaker recognition.
How Does AudioContext Fingerprinting Work?
A common test gives browsers the same predictable audio graph. Small output differences can reveal details about the processing environment.
The basic process has five steps:
- The page creates an
OfflineAudioContextor anAudioContext. - It generates a waveform with an
OscillatorNodeor another source. - It passes the signal through nodes such as
DynamicsCompressorNodeorAnalyserNode. - It reads rendered samples, frequency data, properties, or timing values.
- It sums or hashes selected values and combines them with other browser signals.
Offline Rendering to an AudioBuffer
Many tests use OfflineAudioContext. According to MDN, it renders an audio graph into an AudioBuffer in memory. It does not send the result to physical audio hardware. The script reads the buffer directly. Its values may vary with the browser, operating system, CPU architecture, math library, and digital signal processing implementation.
Properties and Timing Signals
A page may also inspect the sample rate, channel count, latency, analyser timing, or render quantum size. The Web Audio specification lists several of these fields as possible fingerprinting surfaces. Browsers may round, limit, or standardize them.
What Audio Signals Can a Website Read?
| Signal | What It May Indicate | Important Limit |
|---|---|---|
| Buffer Samples | Browser, OS, CPU, and DSP Differences | Not a Hardware Serial Number |
| FFT Values | Frequency Output from the Chosen Graph | Depends on the Graph and Analyser Settings |
| Sample Rate | Audio Context Configuration | Usually Comes from a Small Set of Common Rates |
| Channel Count | Output Configuration | Browsers May Cap or Standardize It |
| Latency and Timing | Implementation or Hardware-Related Behavior | May Vary with System Load and Browser Policy |
| Hash or Sample Sum | A Summary of Selected Values | Not a Universal ID Used by Every Site |
The hash belongs to the test that created it. One tool may hash a full buffer. Another may add a short range of samples or use FFT bins. Their results do not need to match. None of these outputs normally reveals a person's name, microphone content, or sound card serial number.
Is an Audio Fingerprint Unique or Stable?
An audio fingerprint can be stable enough to add useful information. It is not guaranteed to be unique or permanent.
A 2022 study of Web Audio browser fingerprints tested 2,093 users and observed 95 distinct audio fingerprints. Audio results were less diverse than several other fingerprint surfaces in that sample. They still added information when combined with other signals.
This is the practical way to judge AudioContext data. A match narrows the possibilities but does not prove that two visits came from one device. A changed result does not prove that a new device appeared.
The value may change after:
- Browser, operating system, or math library updates
- Audio configuration or CPU architecture changes
- Privacy settings or fingerprinting protections
- A different graph, sample range, timing method, or hash algorithm
Use the same test in the same profile when checking stability.
Does Audio Fingerprinting Use Your Microphone or Play Sound?
The usual AudioContext fingerprint does not need microphone permission. It creates its own synthetic signal rather than recording sound from the room.
An offline test also does not need audible playback. It renders data into memory and reads the resulting buffer. Muting the tab or turning down speaker volume will not usually change that calculation.
Microphone capture uses a different browser path, commonly through getUserMedia, and normally requires permission. A live audio graph is not proof that a page is recording a microphone.
Audio vs. Canvas vs. WebGL Fingerprinting
Audio, Canvas, and WebGL tests follow a similar pattern. A page assigns a fixed task, reads the output, and compares it with other results. The APIs and sources of variation are different.
| Surface | Main API | Typical Result | Main Influences |
|---|---|---|---|
| Audio | Web Audio | Samples, FFT Values, Properties, Hash | Browser, OS Audio Implementation, CPU, Math, DSP |
| Canvas | Canvas 2D | Pixel Buffer or Image Hash | Fonts, Browser, OS, 2D Rendering |
| WebGL | WebGL | GPU Metadata, Capabilities, Rendered Pixels | GPU, Driver, Graphics Stack, Browser |
A WebGL fingerprint may reveal graphics vendor information and rendering behavior. AudioContext focuses on audio processing output and related properties. Canvas often reflects fonts and 2D rendering.
A risk system may collect all three alongside headers, network data, account history, and behavior. In bot detection, the relationship between signals is more useful than one audio hash.
What Is Browser Audio Fingerprinting Used For?
Security systems can use AudioContext data in fraud checks, account takeover detection, browser recognition, or automation analysis. A familiar combination may support a returning session. A sudden change may lead to another verification step.
Tracking systems can use the same signal without relying only on cookies. Cookie isolation controls stored data, not values that a page can calculate again.
AudioContext code alone does not prove fingerprinting. Games, music tools, visualizers, meeting software, and sound effects also use the API. A script that reads a buffer, creates a hash, and sends it for comparison is stronger evidence of fingerprinting.
How to Test an Audio Fingerprint
The Princeton AudioContext Fingerprint Test shows AudioContext properties, compressor output, oscillator results, sample sums, and hashes. It is useful for checking what remains stable in one browser setup.
Use a controlled comparison:
- Run the test twice in the same browser profile.
- Record the properties, sample sum, and hash.
- Close the browser completely, reopen the profile, and test again.
- Repeat with the same page after an update or privacy setting change.
Keep the browser version, operating system, profile, and test tool with your notes. Do not compare hashes from unrelated sites as if they followed one standard.
| Result | What It Usually Means | What It Does Not Prove |
|---|---|---|
| Same Hash on Repeat Tests | The Selected Output Was Stable in That Setup | The Device Is Globally Unique |
| Different Hash after Restart | Protection or Environment Changed the Output | Tracking Is Impossible |
| Same Hash Across Profiles | The Test Saw the Same Selected Values | The Profiles Are Certainly Linked |
| AudioContext Unavailable | The API Is Blocked, Disabled, or Unsupported | Other Fingerprinting Surfaces Are Gone |
A test page is a visibility and repeatability check. It is not an anonymity score or proof that the browser cannot be recognized.
How Can Browsers Reduce Audio Fingerprinting?
- Standardization makes more users return similar values.
- Deterministic randomization changes selected output across sites or sessions.
- Tracker blocking stops requests from known fingerprinting services.
- Restricting Web Audio removes part of the surface but can break useful applications.
Brave describes a randomization method called farbling for Web Audio output. Firefox 118 moved Web Audio calculations to the same math library across systems to improve anonymity under Fingerprint Protection, as noted in the Firefox release notes.
Private browsing mainly changes storage and local history. AudioContext protection depends on the browser and its current settings.
A VPN or proxy changes the network route and public IP, not an audio buffer calculation. Check network exposure separately with a WebRTC leak test.
AudioContext Settings in MoreLogin
MoreLogin provides Noise and Authentic options at the profile level. The current profile settings documentation says that Noise generates different audio contexts for profiles on the same computer. Authentic uses the computer's actual audio context.
Disabling audio playback is a separate control. It does not mean that the Web Audio API is unavailable, and it should not be treated as an AudioContext fingerprinting defense.
Review AudioContext values together with the operating system, user agent, Canvas, WebGL, and media devices. One setting cannot guarantee the same result across every checker.
Audio Fingerprinting FAQ
Does AudioContext fingerprinting record my microphone?
The common method does not. It generates a synthetic signal inside an AudioContext and reads the output. Microphone capture uses a separate API and normally requires permission from the user.
Is an audio fingerprint unique to one device?
Not necessarily. Many environments can return the same value. Audio data becomes more useful when a system combines it with Canvas, WebGL, browser properties, network details, and behavior.
Can an AudioContext fingerprint change?
Yes. Browser and operating system updates, privacy protections, audio configuration, CPU or math changes, and the design of the test can all affect the output.
Does incognito mode stop audio fingerprinting?
Not by itself. Incognito mode limits saved history and site storage. It does not automatically change every Web Audio result. The outcome depends on the fingerprinting protections built into the browser.
Why do two audio fingerprint tests show different hashes?
Each test can use a different waveform, audio graph, node settings, sample range, normalization rule, or hash algorithm. Compare repeated results from the same tool rather than matching unrelated hashes.
Key Takeaway
An audio fingerprint is a browser signal, not a recording or permanent hardware ID. Read it beside other browser signals, keep network checks separate, and compare results with the same method. That tells you more than a single hash.
