Fingerprint Divergence
Blocking cookies does not stop a site recognizing you. Your machine answers a handful of ordinary questions in a way that is nearly unique to it, and that answer works as an identifier on its own. PATANYX changes the answers, differently for every site, so the reading that identifies you on one site does not match the one another site sees.
On by defaultVersion 2 enhancements are here
Fingerprint Divergence is shipping now and on by default. A second version has shipped. It changes the following.
- Audio noise rebuilt. The sound readings get noise that varies across the recording rather than a single adjustment applied evenly, which makes it far harder for a site to strip back off.
- Noise keyed to what is measured. The change applied depends on the actual reading a site takes, not only on which site is asking, so a site cannot take two readings of its own and compare them to work out what was added.
- Coverage inside background workers. Pages can run their measurements on a background thread, which is a place browsers built on a system web engine normally cannot reach. The common case is now reached, and the limits below say exactly how much is covered.
- A detectability measurement. A test that counts how many known techniques can tell the noise is there at all. Run it yourself.
Version 1 shipped, version 2 improved it, and the next work is already on the public board: search across every open tab, a tab switcher, and batch tab actions are being built now, the first features of the coming Premium tier among them. See what is being built. Free features always remain free.
Why fingerprinting works when cookies are blocked
A cookie is something a site gives you. A fingerprint is something you give the site, without being asked, just by rendering a page. Draw some text to a canvas and read the pixels back, and the exact bytes depend on your GPU, your driver, your fonts, and your operating system. Play an inaudible tone through the audio engine and measure the samples, and you get another number in the same family. Ask WebGL which graphics card is present and it will tell you the model.
None of these are secrets, and none of them identify you by themselves. Together they usually do. A tracker collects the answers, hashes them, and gets a value stable enough to recognize your browser tomorrow, on a different site, with a cleared cookie jar and a new IP address. Nothing needs to be stored on your machine, so there is nothing for you to clear.
What PATANYX does
PATANYX mixes a small amount of noise into those readings before a page sees them. The noise is not random per page load. It comes from one seed: a random token generated once per browser start, which is never written to disk and never exposed to any page, mixed with the hostname of the site you are on.
Three consequences follow, and they are the entire feature:
The same site sees the same reading all session
A tracker cannot sample the canvas a hundred times and average the noise away, because there is nothing to average: every read comes back byte for byte identical. It also means sites that use these APIs for real work keep getting consistent results.
A different site sees a different one
Two sites comparing notes find two different fingerprints. That is the linkage this exists to break. A third-party frame is keyed on the site embedding it, not on itself, so one measurement company embedded across a thousand sites collects a thousand unrelated identifiers rather than one.
Everything changes when you restart
The token is drawn fresh at every start, so yesterday's fingerprint does not carry into today. Tabs opened without a saved profile get their own separate token, so a site cannot match readings to tie one of those visits back to an ordinary one.
Why noise, and not making everyone identical
The other approach is to make every install answer the same way, so no reading distinguishes anyone. It is a real strategy and it works, but only if the population answering identically is large, and only for as long as nothing leaks through. A browser with a small user base that tries it hands trackers a different gift: a small, sharply defined crowd that is itself easy to spot.
Divergence aims lower and holds better. It does not try to hide that you are a particular machine. It makes the identity you present local to one site and one session, so it is useless as a key for joining records across sites. That is a narrower promise, and it is one this can actually keep.
The four surfaces
Canvas
Roughly one pixel in eight has the lowest bit of a color channel flipped. The alpha channel is never touched, because low-bit alpha changes are visible against a composited background. The change is far below what an eye can see: photos, charts, and signature pads look exactly as they did. Reading pixels back, exporting to a data URL, and exporting to a blob all route through the same noised copy, so the three paths cannot be played against each other to recover the original.
Audio
Every sample is scaled by its own factor, at most 0.09 dB in total, which no ear and no speaker will register. Each factor depends on the recording itself and on the sample's position in it, so dividing one reading by another no longer cancels the noise out, and digital silence stays exactly silent. It applies to the audio buffer readers and to the four analyser readouts fingerprinting scripts use.
Graphics vendor and renderer
The two WebGL parameters that name your exact GPU answer with the generic strings the engine itself reports instead. Not a fabricated model name: a lie inconsistent with the rest of the engine would be its own distinguishing signal. Every other graphics query passes through untouched, so real WebGL applications keep working.
Element measurement
Ask how wide anything on a page is and the answer comes back to a fraction of a pixel. Those fractions depend on your fonts, your zoom and your rendering stack, which makes a handful of measurements enough to tell machines apart. They are diverged too, by less than a quarter of a pixel, and clamped so the value still rounds to the whole pixel it would have been.
That bound is the entire design. Layout is arithmetic on these numbers: shift them enough to be obvious and menus land in the wrong place and text wraps early. Under a quarter of a pixel nothing on the page moves, and the exact fractions stop being yours. The test page reports this one to four decimal places, because rounding before comparing would show nothing at all.
Where the secret lives, and what Rust is doing here
The noise itself is JavaScript, running inside the page, because that is the only place it can reach the functions a site calls. Rust's job is everything around it: holding the secret, deciding what to inject, and failing safely.
The token never enters the page
The session token is drawn from the operating system's randomness once per browser start, held in Rust for the lifetime of the process, and never written to disk. Pages only ever see values derived from it, never the token, and the injected script has no way to send anything anywhere: it has no network calls, no dynamic imports, and no message passing, which is pinned by a test that fails the build if any of them appear.
Failure is a case the compiler makes you handle
The function that produces the script returns an optional value, not a string. If the switch is off, or if the system cannot supply randomness, the answer is no script at all, and the type system will not let that case be quietly skipped. There is no fallback constant, deliberately: a fixed token would make your noise identical after every restart, which is itself a stable fingerprint. Once randomness has failed, that outcome is recorded, so the session never runs half seeded.
The profile is decided before the tab exists
Whether a tab keeps a saved profile is known in Rust when its view is built, and the second, separate token is chosen there. A no-profile tab and an ordinary tab therefore cannot produce matching readings for a site to join up, and that split is not something page code could get wrong, because page code is never asked.
What it does not cover
This is noise, not invisibility. PATANYX does not try to make you look like everyone else, and it cannot stop a determined site from fingerprinting you. Here is what is outside the fence, stated plainly so nobody has to discover it.
Workers, partly.
This used to be the largest hole here: neither engine injects registered scripts into a worker, so a script that did its canvas work on that second thread walked straight past everything. Most of it is now closed. A worker built the ordinary way is handed a shim that installs the same canvas and WebGL hooks before the real worker code runs, so OffscreenCanvas inside it diverges exactly as it does on the page.
What is still open: module workers, workers created from a
data: or blob: address, SharedWorker,
and service workers. The shim reaches a worker by loading it
alongside the original script, and those four cannot be reached
that way. The test page has a row for this, so you can see which
side of the line your browser is on rather than take our word
for it.
Reading pixels directly out of WebGL.
Deliberately left alone. Real WebGL applications read back exact pixels to work out which object you clicked on, and noising those bytes would break them. The common fingerprinting path hashes the rendered canvas through the export functions, which are covered.
Screen size, fonts, and the user agent.
These read out exactly as they are. They carry real entropy, and nothing here changes them.
Anything a page can see by looking harder.
A site that checks whether these functions have been modified can see that they have, and a site that restores the originals gets your real readings. Divergence raises the cost of cross-site correlation. It does not make you anonymous, and it is not a substitute for the rest of the privacy work in the browser.
Check it yourself
Do not take any of the above on trust. Start with the test on this site, then confirm it against pages nobody here controls.
Run the browser fingerprint test It works in any browser, not only PATANYX. It runs the individual tricks a tracker would use on each surface and tells you, for every one, whether it came away with nothing, could only tell a protection is running, or recovered your true fingerprint. Everything is measured in your own browser and nothing is sent anywhere.
- Canvas. Open browserleaks.com/canvas and note the signature. Reload: it should be the same. Open it in a second tab: still the same. Now compare against any other site that reports a canvas hash, and it should differ.
- Graphics. Open browserleaks.com/webgl and look at the unmasked vendor and renderer. They should read as generic strings with no GPU model in them.
- Across a restart. Note a visitor identifier from fingerprintjs.github.io/fingerprintjs, close PATANYX completely, reopen it, and check again. It should be a different identifier.
If the same site gives you a different signature on every reload, something is wrong: the reading is meant to be stable per site and per session, and per load jitter would be averaged away by any tracker worth the name.
Where the switch is
Fingerprint Divergence is on by default and currently unlocked for everyone while Premium is in development. It is part of the coming Premium tier, and the About page's Premium section is the plain list of what joins that tier when it launches. The switch is in the privacy panel, listed under its own name, and it applies to new tabs: both engines accept injected page scripts only when a view is created, so tabs that are already open keep whatever they started with. Open a new tab after flipping it.
The implementation is in the public source tree, comments and all, if you would rather read it than read about it. More on what the browser does and does not protect is on the About page, including a plain list of the things it cannot hide.
Windows and Linux, free, and Fingerprint Divergence is on the moment you open it. PATANYX is pre-1.0 and under active development.