Lower your fingerprint

This single choice moves your number more than all the others combined. In rough order of how well they flatten your fingerprint:

• Tor Browser — the gold standard. Every user is deliberately made near-identical: same canvas, bundled fonts, letterboxed window, UTC-ish timezone. Keep it at its default window size (don't maximise or resize), and don't add extensions — both carve you back out of the crowd.
• Brave — randomises ("farbles") canvas & audio per-session and blocks many vectors by default. Low effort, everyday-usable.
• Firefox with privacy.resistFingerprinting (in about:config) or at least Strict Enhanced Tracking Protection. RFP spoofs canvas, masks the WebGL renderer and forces a common timezone/size — it can break some sites, which is the trade.
• Safari ships built-in fingerprint simplification that presents a more uniform system profile.

These three are the strongest signals on the web — the canvas hash alone can be near-unique. You can't usefully change your GPU, so the play is to mask or randomise the readout.

• Use a browser that farbles canvas/audio (Brave) or spoofs them (Firefox RFP, Tor) — see step 01.
• Don't trust a random "canvas blocker" extension that still returns one stable fake value — a constant fake is just a new fingerprint. Per-read randomisation is what actually helps.

Installed fonts betray your OS, region and installed apps (Office, Adobe, dev tools). Every unusual font makes you rarer.

• Don't install exotic font packs on the machine you browse from.
• Tor bundles a fixed font set so all users match; RFP limits font enumeration. Let the browser standardise it rather than curating fonts yourself.

It's tempting to install a UA switcher. Resist it. Trackers cross-check signals, and inconsistency is itself a fingerprint: a UA that says Windows while your WebGL says Apple GPU, or client hints that don't match, flags you as both unusual and evasive — worse than doing nothing.

• Change your whole browser (step 01) so the UA, client hints, API surface and hardware signals all tell one coherent, common story.
• Don't mix a spoofed UA with an otherwise stock browser.

Resolution, device-pixel-ratio and the exact inner-window size combine into a display signature. Odd zoom levels and unusual multi-monitor sizes stand out.

• Browse at 100% zoom and a common window size. Tor letterboxes the viewport to rounded, popular dimensions on purpose.
• Don't rely on a bespoke resolution as "privacy" — rare sizes are more identifying, not less.

If you use a VPN in another country but your browser still reports your home timezone and language, the mismatch is a classic tell that unmasks the VPN. GlassBox cross-checks exactly this.

• Firefox RFP and Tor force a uniform timezone (UTC), sidestepping the mismatch.
• If you set a VPN exit region, align your system/browser timezone and language with it.

Your IP address is the strongest single identifier, and it's independent of the browser fingerprint — a VPN hides your IP but does nothing for canvas/fonts, and a hardened browser does nothing for your IP. You need both.

• Use a reputable VPN or Tor to change/hide your public IP.
• Close the WebRTC leak: WebRTC can reveal your real IP straight past a VPN. Disable it (Firefox: media.peerconnection.enabled = false), use a browser that blocks it, or a trusted extension. GlassBox flags it when your WebRTC IP differs from your exit IP.
• Don't assume "incognito + VPN" hides the fingerprint — the fingerprint is unchanged.

The set of services you're signed into is deanonymising on its own — few people share the exact same combination. Trackers also ride your logged-in cookies to attach a "pageview" to your real account.

• Log out of services you're not actively using; use private/ephemeral windows for casual browsing.
• Isolate identities with Firefox Multi-Account Containers or separate browser profiles.
• Clear cookies/site data regularly — though note fingerprinting is designed to survive that, which is why the steps above matter more.