Audio Fingerprint

Audio fingerprinting is a browser-based tracking technique that leverages the Web Audio API to create a unique identifier. Unlike cookies or IP-based tracking, it does not rely on stored client data. Instead, it exploits subtle differences in how each device processes sound.

The Web Audio API Architecture

The Web Audio API is a powerful system for handling audio operations. It works inside an AudioContext by linking together audio nodes and building an audio graph. A source can be an audio element, a stream, or an in-memory source generated mathematically with an OscillatorNode.

Step-by-Step Process

1. Create an OfflineAudioContext - Unlike a regular AudioContext, the OfflineAudioContext does not render audio to device hardware. Instead, it generates the audio as fast as possible and saves it into an AudioBuffer.
2. Generate a signal with OscillatorNode - An oscillator is an ideal candidate because it generates samples mathematically, producing a periodic signal represented as 32-bit floating-point values between -1.0 and 1.0.
3. Process through DynamicsCompressorNode - This node applies gain reduction through parameters like threshold, knee, ratio, attack, and release - introducing browser-specific variations.
4. Analyze with Fast Fourier Transform (FFT) - The AnalyserNode provides access to an FFT of the audio signal, capturing frequency-domain data.
5. Hash the result - The processed signal values are summed and hashed to create a unique fingerprint.

Why It's So Effective

Audio fingerprinting contributes only slightly to uniqueness but is highly stable - the same device produces the same fingerprint across sessions, even in incognito mode. Combined with other fingerprinting techniques, it creates a powerful identifier.

Research shows audio fingerprints can be 99.6% unique, making them one of the most effective fingerprinting techniques.

Audio fingerprints vary due to a fascinating combination of software and hardware factors. Here's what makes each device unique:

Browser Engine Evolution

All major browser engines (Blink, WebKit, Gecko) descend from Google's 2011-2012 WebKit contributions, which included the creation of OfflineAudioContext, OscillatorNode, and DynamicsCompressorNode. Since then, browser developers have made many small changes. These changes, compounded by the large number of mathematical operations involved, lead to fingerprinting differences.

CPU Architecture & SIMD Optimizations

Browsers implement platform-specific code paths to leverage hardware features:

• SIMD (Single Instruction, Multiple Data) - Different vector operation implementations across ARM and x86 architectures produce different results
• macOS - Chrome uses a dedicated Fast Fourier Transform implementation that differs from other platforms
• Architecture-specific DSP - Chrome's dynamics compressor uses different optimizations depending on CPU architecture

Floating-Point Arithmetic Precision

Audio signal processing uses floating-point arithmetic extensively. The IEEE 754 standard allows for implementation-specific rounding behavior, and:

• Different CPUs have subtly different floating-point units (FPUs)
• Compiler optimizations can reorder operations, affecting precision
• These tiny variations compound across thousands of samples

Operating System Effects

Even the same browser on different OS versions produces different fingerprints:

• Android 9 vs Android 10 show measurable differences
• macOS versions affect audio processing pipelines
• OS-level audio drivers and middleware add their own signatures

Hardware Differences

• Audio chipsets - Different DACs and audio codecs process signals differently
• Sample rate conversion - Hardware-specific resampling algorithms
• DSP implementations - Dedicated audio processing hardware varies by manufacturer

Audio fingerprinting is difficult to prevent without breaking legitimate audio functionality. Different privacy-focused browsers take different approaches:

Tor Browser - Complete Blocking

The Tor Browser takes the most aggressive approach: the Web Audio API is disabled entirely. This makes audio fingerprinting impossible but breaks websites that legitimately use audio features like video conferencing or music players.

Brave Browser - Farbling

Brave implements a clever technique called "farbling" - deterministic randomization of audio output that varies per-domain per-session. Research shows that with standard-level farbling, differences from original fingerprints range from 0.00000014% – 0.00000214%. However, this small variation still allows fuzzy matching algorithms to potentially re-identify devices.

Firefox - Resist Fingerprinting

With privacy.resistFingerprinting = true, Firefox adds noise to audio output. This is effective but can cause audio quality issues on some websites.

Other Protection Methods

• Browser extensions:
  • AudioContext Fingerprint Defender - Adds randomization to audio output
  • Canvas Defender - Also protects audio fingerprinting
  • Privacy Badger - Blocks known tracking scripts
• NoScript / uBlock Origin - Block JavaScript on untrusted sites entirely
• Virtual machines - Different virtualized hardware = different fingerprint each time

Here's the core fingerprinting code used by this tool. The implementation creates an audio processing graph and captures the subtle variations:

const audioFingerprint = async (oscillatorType = 'triangle') => {
    // Use OfflineAudioContext - renders to memory, not speakers
    // Parameters: channels (1), samples (5000), sample rate (44100 Hz)
    const AudioContext = window.OfflineAudioContext || window.webkitOfflineAudioContext;
    const context = new AudioContext(1, 5000, 44100);

    // OscillatorNode generates samples mathematically
    // Output: periodic signal as 32-bit floats between -1.0 and 1.0
    const oscillator = context.createOscillator();
    oscillator.type = oscillatorType;  // triangle, sine, square, or sawtooth
    oscillator.frequency.value = 10000; // 10 kHz

    // DynamicsCompressorNode applies gain reduction
    // These parameters create device-specific processing variations
    const compressor = context.createDynamicsCompressor();
    compressor.threshold.value = -50;  // dB above which compression starts
    compressor.knee.value = 40;        // dB range for soft knee
    compressor.ratio.value = 12;       // compression ratio (12:1)
    compressor.attack.value = 0;       // seconds to reduce gain
    compressor.release.value = 0.25;   // seconds to increase gain

    // Build the audio processing graph
    oscillator.connect(compressor);
    compressor.connect(context.destination);
    oscillator.start(0);

    // Render audio as fast as possible into AudioBuffer
    const buffer = await context.startRendering();

    // Extract samples after initial transient (4500-5000)
    const signals = buffer.getChannelData(0).subarray(4500);

    // Sum absolute values and hash
    let hash = 0;
    for (let i = 0; i < signals.length; i++) {
        hash += Math.abs(signals[i]);
    }
    return sha1(hash);
};

Performance Characteristics

Audio fingerprinting is remarkably fast. The browser delegates work to the OfflineAudioRender thread, freeing the main thread. Typical execution times:

• Safari 14: ~5ms
• Chrome 89: ~10ms
• Firefox 86: ~50ms

Why This Works

The subtle differences in the output signal come from:

• Floating-point arithmetic variations (IEEE 754 rounding differences)
• SIMD optimizations that differ by CPU architecture
• Browser-specific DSP implementations
• OS-level audio middleware processing

An oscillator is an ideal candidate for fingerprinting because it generates samples mathematically, rather than playing an audio file. This ensures consistency and reveals how your browser computes audio signals.

Waveform Types and Their Characteristics

• Triangle wave (Default) - Contains only odd harmonics that decrease in amplitude following a 1/n² pattern. Provides a good balance of simplicity and complexity for fingerprinting. Most commonly used in production fingerprinting libraries.
• Sine wave - Pure tone with only the fundamental frequency and no harmonics. Reveals basic DSP precision and floating-point handling with minimal complexity.
• Square wave - Contains odd harmonics with amplitudes following 1/n. Sharp transitions between +1 and -1 reveal aliasing behavior and filtering differences.
• Sawtooth wave - Contains all harmonics (both odd and even) with 1/n amplitude decay. Most harmonically rich, shows detailed DSP characteristics and maximum processing complexity.

Mathematical Signal Generation

The oscillator produces a periodic signal represented as 32-bit floating-point values between -1.0 and 1.0. The mathematical generation ensures:

• Reproducibility - same input parameters always produce the same theoretical output
• No external dependencies - doesn't rely on audio files or hardware input
• Precision testing - reveals how the browser handles float operations

Multi-Waveform Fingerprinting

Advanced fingerprinting systems may use multiple oscillator types to create a more comprehensive fingerprint. Each waveform tests different aspects of the audio processing pipeline. However, research shows that even a single oscillator type (typically triangle) is sufficient for high-accuracy device identification.

Audio fingerprinting has an interesting characteristic that makes it particularly valuable for tracking:

High Stability, Moderate Uniqueness

Research shows that audio fingerprinting contributes only slightly to uniqueness on its own, but is highly stable. This means:

• Stability: The same device produces the same fingerprint across sessions, browser restarts, and even incognito mode
• Uniqueness: Audio fingerprints alone may not uniquely identify a user, but combined with other techniques they become powerful

How Trackers Combine Fingerprints

Audio fingerprinting is typically used as one component of a larger fingerprinting system:

• Canvas fingerprinting - Graphics rendering variations
• WebGL fingerprinting - GPU-specific rendering differences
• Font enumeration - Installed font detection
• Screen resolution & color depth - Display characteristics
• Timezone & language settings - Regional preferences

Why Stability Matters

The stability of audio fingerprints makes them particularly valuable because:

• They persist across incognito/private browsing sessions
• They survive cookie deletion and browser cache clearing
• They remain consistent unless hardware or OS changes
• They provide a reliable "anchor" for cross-session tracking