Audio fingerprinting: tracking you with silent sound

The short version

Your browser can generate sound — not just play music files, but build tones from scratch for games and apps. A tracking script abuses that: it makes your device calculate a sound you never actually hear, then measures the tiny math differences in the result. Those differences are consistent for your device, so they become a hidden ID. No microphone, no cookie, no noise. A couple of free browser choices make it far less useful.

What's actually happening

Think of two identical-looking calculators from different factories. Ask both to do a very long division and they'll almost always agree — but look at the last few digits and sometimes they differ, because of tiny internal differences. Your device's audio engine is like that. When a script tells it to generate a tone and run it through some processing, the exact numbers that come out depend on your processor, operating system, and browser build.

The sound is never played out loud — it's all done silently, as math. The script just reads the numbers and keeps the "signature."

Why it matters to you

• It needs no permission and no microphone — nothing pops up to warn you.
• It works in private/incognito mode and survives clearing cookies.
• Hidden ad and analytics scripts can use it to recognize your device across different websites.

By itself it's a weaker clue than canvas or GPU, but trackers combine it with the others. Reducing it still helps.

How to fix it

As with other fingerprints, you don't fix this on the website — you choose a browser that either scrambles the result or makes you look like a big crowd.

Option A — Brave (easiest)

1. Use Brave with its default Shields on. It randomizes the audio result so trackers can't reuse it.
2. Check by clicking the Brave lion icon in the address bar and confirming fingerprinting protection is active.
3. Leave the default setting — that's the one doing the work.

Option B — Firefox

1. Set tracking protection to Strict under Settings → Privacy & Security to block many known fingerprinting scripts.
2. Firefox's stronger "Resist Fingerprinting" mode also masks the audio signature, but it has side effects (wrong time zone, forced English). Most people should stay on Strict.

Option C — Tor Browser (blends into a crowd)

1. Install Tor Browser from torproject.org.
2. It standardizes the audio engine so everyone looks the same. Use it as delivered — no extensions, no resizing.

On phones

Brave on Android and iPhone has the same protection. On iPhone and iPad, Safari's engine already limits this, so you're reasonably covered.

A warning about extensions

Rare "audio blocker" add-ons can make you more unique, because hardly anyone else runs that exact tool. Prefer a browser that protects you by default.

How to check it worked

Run this site's test in Brave or Tor and watch your audio result change or match a common value, with a better grade. You can also compare two separate private windows — a protected browser won't give both the same audio ID.

If your result was already good

If you scored an A or B, your browser is already handling this well. Nothing to install or change — just keep it updated and avoid adding niche privacy extensions that could make you stand out.

Want to go further?

The Advanced version explains the exact Web Audio calls involved, why the output varies at the floating-point level, and how Brave's randomization and Tor's uniformity each neutralize it.

What audio fingerprinting actually is

Audio fingerprinting exploits the Web Audio API. The common technique uses an OfflineAudioContext (which renders faster than real time and plays nothing audible): the script wires an OscillatorNode through a DynamicsCompressorNode (and sometimes other nodes), renders a short buffer, and then reads the resulting samples — hashing them or summing their magnitudes. The output varies at the floating-point level across CPU architecture, OS math libraries, and browser audio-stack build, producing a stable per-device value. A second variant reads AudioContext properties (sampleRate, channel counts, max channels, latency) for lower-entropy signal. No permission, no microphone, no audible output.

Why it matters

The value is stateless and survives incognito and cookie clearing, and a third-party script computes the same value across every site it's embedded in. Its entropy is lower than canvas or WebGL — many identical devices share a value — so it's rarely identifying alone, but it adds bits to a composite fingerprint and helps distinguish otherwise similar machines.

Defenses by browser

Brave — randomization

1. Brave farbles Web Audio readback with its per-session, per-eTLD+1 seed, so the rendered-buffer hash is non-reusable across sites and across sessions. Canvas and Web Audio are the two surfaces Brave documents farbling by default.
2. On by default under the standard Shields setting; per-site control is in the Shields panel, global control in brave://settings/shields.
3. Edge case: values are stable within one site/session for compatibility, so this defeats linkage, not in-session sampling.

Firefox — RFP

1. privacy.resistFingerprinting=true standardizes/masks audio-derived values as part of the broader spoofing suite.
2. Default browsing relies on blocking Disconnect-listed fingerprinting scripts (ETP Strict) rather than audio randomization.
3. Trade-off: RFP's well-known side effects (UTC timezone, en-US locale, letterboxing) and a smaller RFP cohort.

Tor Browser — uniformity

1. Firefox-ESR-based with RFP on; aims for one shared audio value across same-version/same-platform users rather than noise.
2. Cost: Tor latency and occasional breakage of audio-processing web apps.

OS and hardware reality

• CPU and math library drive most of the variation: x86-64 vs Apple Silicon vs ARM Android can produce different low-order bits.
• OS audio stack (Windows WASAPI, macOS CoreAudio, Linux PulseAudio/PipeWire) and the browser's resampler contribute.
• iOS/iPadOS: all browsers use WebKit; Safari's Web Audio surface is more uniform, so Apple mobile devices converge.
• Android Chrome has no audio defense; Brave for Android farbles.

Verify properly

• Use browserleaks.com/audio for the raw audio fingerprint and context properties, plus this site's test and coveryourtracks.eff.org.
• Brave: the audio hash should change across sessions. Firefox RFP: expect a constant/masked value. Tor: expect the platform's uniform value.
• Note that AudioContext sampleRate (often 44100 or 48000) and channel counts are low-entropy but still reported — a changed buffer hash with revealing context properties is only a partial win.

Trade-offs & gotchas

• Low base entropy means audio alone rarely identifies you — don't over-invest here at the expense of canvas/WebGL/font defenses that carry more bits.
• Rare extensions backfire: a unique blocker or a contradictory spoofed value makes you more distinguishable, not less.
• Weak noise is sampleable: repeated renders averaged together can recover a signal; structured farbling resists this.
• Disabling Web Audio entirely breaks legitimate apps and is itself an uncommon, detectable configuration.
• All of these are software measures — no hardware change removes an audio fingerprint.