What Is CPU Fingerprinting? How hardwareConcurrency Reveals Your Processor

CPU fingerprinting is a browser tracking technique that reads navigator.hardwareConcurrency — a single JavaScript property that reveals how many logical processor cores your device exposes to the browser. Combined with other hardware signals, your CPU core count helps trackers build a persistent device identifier that survives cookie deletion, private browsing, and VPN switches. You can check what your browser currently exposes on whatsmy.fyi.

TL;DR

navigator.hardwareConcurrency is a standard Web API that returns the number of logical CPU cores your browser is allowed to use. Fingerprinting scripts collect this value — along with canvas output, WebGL renderer data, screen resolution, and timezone — to build a stable device fingerprint without cookies. On its own, CPU core count contributes low-to-medium entropy; combined with other signals it adds meaningful uniqueness. The most effective defences are Brave Browser (which randomises the value) and Firefox with privacy.resistFingerprinting enabled (which clamps it to 2).

What Is CPU Fingerprinting?

CPU fingerprinting is the use of processor-related data, exposed by browser APIs, to contribute to a unique device identifier. The primary signal is navigator.hardwareConcurrency, a read-only property defined in the HTML Living Standard that returns the number of logical processors available to the browser. It was designed to help web developers determine how many parallel Web Workers to spawn for computationally intensive tasks. Fingerprinting scripts repurpose it as a hardware descriptor.

CPU fingerprinting is one layer of the broader browser fingerprinting technique, which assembles dozens of browser and hardware signals into a single identifier. Unlike cookies, CPU fingerprinting stores nothing on your device — it reconstructs your identifier from the observable characteristics of your hardware every time you visit a site.

How Does CPU Fingerprinting Work?

The basic attack is a single JavaScript property read — one line of code that executes in under a millisecond. More sophisticated attacks go further, using timing side-channels to estimate your actual CPU microarchitecture even when the browser spoofs the value.

Step 1 — Reading hardwareConcurrency

The simplest form of CPU fingerprinting reads the logical core count directly from the Navigator object. This value is available without any permissions prompts, without user interaction, and is identical in both normal and incognito browsing sessions.

// Reads logical CPU cores exposed by the browser
const logicalCores = navigator.hardwareConcurrency;
// → 8 on a MacBook Pro M3 Pro
// → 4 on a mid-range Android phone
// → 2 on Firefox with resistFingerprinting enabled
// → a random value between 2 and 8 on Brave Browser

Step 2 — Combining with Other Hardware Signals

A raw core count (e.g. 8) is not unique on its own — millions of devices share the same count. Fingerprinting scripts combine it with complementary signals: GPU vendor and renderer from WebGL, canvas pixel hash, screen resolution and pixel density, timezone, language, and audio stack characteristics. Together these signals create a fingerprint with significantly higher entropy than any single value alone.

Step 3 — Timing-Based CPU Identification (Advanced)

Academic research from CISPA Helmholtz Center for Information Security demonstrated that JavaScript can fingerprint CPU microarchitecture — not just core count — using timing side-channels. By running specially crafted parallel computations and measuring execution latency, scripts can estimate whether your processor is an Intel Core, AMD Ryzen, Apple M-series, or Qualcomm Snapdragon chip. This technique bypasses naive spoofing of hardwareConcurrency entirely because it observes actual hardware behaviour rather than the reported API value.

// Minimal CPU fingerprint collector
function getCpuFingerprint() {
  return {
    logicalCores: navigator.hardwareConcurrency,  // e.g. 8
    deviceMemory: navigator.deviceMemory ?? 'unknown', // e.g. 8 (GB, rounded)
    platform: navigator.platform,                 // e.g. "MacIntel"
    maxTouchPoints: navigator.maxTouchPoints,     // 0 = desktop, >0 = touch
    // Combined with canvas, WebGL, and screen signals
    // this becomes a high-entropy device identifier
  };
}

How Much Does hardwareConcurrency Contribute to Fingerprint Uniqueness?

On its own, navigator.hardwareConcurrency contributes modest entropy because the distribution of core counts is heavily skewed — most devices cluster around 4 or 8 logical cores. Its real value lies in the combination with other signals. The table below summarises key statistics from published research and browser documentation.

The CISPA findings are particularly significant: even if a browser spoofs hardwareConcurrency to a fixed value of 2, an advanced fingerprinting script can still identify your CPU vendor with 97.5% accuracy by measuring how long it takes your processor to complete specific parallel workloads. Spoofing the API value alone is insufficient defence against timing-based attacks.

Who Uses CPU Fingerprinting in the Real World?

Commercial Fingerprinting Platforms

Services like Fingerprint.com, ThreatMetrix, and Sift collect navigator.hardwareConcurrency as one of 30 or more signals assembled into a device fingerprint. These platforms serve both fraud detection and advertising use cases. The core count is especially useful as a stability signal — it does not change between sessions, is unaffected by cookie deletion, and is consistent across VPNs and IP changes.

Fraud Detection and Bot Prevention

Anti-fraud systems use CPU signals to distinguish human users from bots and to flag inconsistencies. A browser that claims to be a mobile device but reports 16 logical cores, or a browser running in a headless Chromium environment that exposes an unusual core count, may be flagged as suspicious. CPU fingerprinting is one component of the device integrity checks that protect login pages, checkout flows, and API endpoints from automated abuse.

Advertising Attribution

As third-party cookies have been deprecated across major browsers, ad networks have increased their reliance on fingerprinting for cross-site attribution. CPU core count is a stable hardware signal that does not change when a user clears cookies, switches networks, or enables private browsing — making it useful as a persistence anchor in an otherwise volatile fingerprint. The EFF's Cover Your Tracks tool explicitly lists hardwareConcurrency as one of the fingerprinting vectors it tests for in its analysis.

Device Integrity Verification

Security-focused applications — banking apps, government portals, and enterprise SSO systems — use hardware signals to verify that a returning session originates from the same physical device. In this context, CPU fingerprinting is a defensive tool: it detects session hijacking and account takeover attempts by comparing the current device fingerprint against the one registered at login.

Is CPU Fingerprinting Legal?

Under the GDPR, reading hardware characteristics to construct a persistent device identifier constitutes processing of personal data when that identifier can be linked to an individual. The French supervisory authority (CNIL) has ruled that browser fingerprinting for advertising purposes requires informed consent. Under the US CCPA and CPRA, device fingerprints qualify as personal information subject to opt-out rights. Legitimate interest exemptions may apply to narrow fraud detection use cases, but tracking-focused deployments face increasing regulatory scrutiny across all major jurisdictions.

How to Protect Yourself from CPU Fingerprinting

Defences against CPU fingerprinting range from browser-level protections that are transparent to the user, to more disruptive measures that may break site functionality. These are listed from strongest protection to most practical for everyday use.

• Tor Browser (strongest protection): Tor Browser normalises navigator.hardwareConcurrency across all users, returning a uniform value that makes individual identification by CPU core count impossible. Combined with Tor's IP anonymisation, it offers the strongest available fingerprint protection. The trade-off is slower browsing due to the Tor network latency.
• Brave Browser (recommended for daily use): Brave randomises hardwareConcurrency per site and per session, returning a value between 2 and Math.min(actualCores, 8). This makes cross-site tracking via CPU core count unreliable without breaking the sites that legitimately use the API to optimise Worker thread counts. Brave also applies similar randomisation to canvas and WebGL — see the canvas fingerprinting guide for details.
• Firefox with privacy.resistFingerprinting: Setting this flag to true in Firefox's about:config causes the browser to report hardwareConcurrency as 2 on all devices, regardless of actual core count. This clamps the value to the lowest common denominator, reducing its uniqueness contribution. Note that this flag also affects dozens of other fingerprinting surfaces simultaneously, providing broad protection.
• Mullvad Browser: Based on Tor Browser's fingerprinting protections but designed for use without the Tor network, Mullvad removes or normalises hardware APIs including hardwareConcurrency entirely, returning a consistent baseline value across all users of the browser.
• Anti-fingerprinting extensions: Extensions such as Canvas Fingerprint Defender, Trace, and Chameleon can intercept API calls to navigator.hardwareConcurrency and return spoofed values. Effectiveness varies — naive value spoofing does not protect against timing-based CPU identification attacks, but it does raise the bar for passive fingerprint collectors.
• Understand the limits of VPNs: A VPN changes your visible IP address but has no effect on what your browser's JavaScript environment reports. navigator.hardwareConcurrency is read directly from the browser and is entirely unaffected by routing traffic through a VPN server. Check whether your VPN is functioning correctly on whatsmy.fyi.

Frequently Asked Questions

What does navigator.hardwareConcurrency actually return?

It returns the number of logical processor cores available to the browser — not physical cores. A CPU with 4 physical cores and hyperthreading active reports 8 logical cores. Browsers may also cap the reported value lower than the actual count to improve Worker scheduling accuracy or for privacy reasons. The property is read-only and available without any user permission.

Does private or incognito mode hide my CPU core count?

No. Private browsing prevents your browser from writing history, cookies, and form data to disk — but it does not change the hardware values your browser exposes to JavaScript. navigator.hardwareConcurrency returns the same value in an incognito window as in a normal window. Only browsers with active fingerprint randomisation, such as Brave or Tor Browser, behave differently.

Can spoofing hardwareConcurrency fully protect me?

No. While spoofing the API value raises the bar for passive fingerprint collection, it does not protect against timing-based CPU identification. Academic research has demonstrated that JavaScript can estimate your CPU vendor with 97.5% accuracy by measuring the latency of carefully designed parallel computations — regardless of what the browser reports for hardwareConcurrency. Effective protection requires a browser that also restricts high-resolution timing APIs (like performance.now()) and limits the precision of scheduling measurements.

How is hardwareConcurrency different from deviceMemory?

navigator.hardwareConcurrency reports logical CPU cores; it is part of the HTML Living Standard and is supported across all major browsers. navigator.deviceMemory reports approximate device RAM in gigabytes, rounded to the nearest power of two (0.25, 0.5, 1, 2, 4, 8) — and is only supported in Chrome and Edge. Both are used as complementary hardware signals in fingerprinting scripts. Together they help distinguish budget devices (2 cores, 2 GB RAM) from premium workstations (16 cores, 64 GB RAM).

Is CPU fingerprinting more effective on mobile or desktop?

The raw core count is less unique on mobile due to strong clustering — a very large share of Android devices report 8 logical cores (octa-core SoCs are dominant in mid-range and premium segments). Desktop fingerprints are more varied because workstation CPUs range from 4 to 128+ logical cores. However, mobile fingerprints tend to be more stable over time because mobile hardware is refreshed less frequently than desktop configurations.

Can a website detect that I'm spoofing my CPU count?

A sophisticated fingerprinting script can detect naive spoofing by cross-referencing the reported core count against timing benchmarks. If your browser reports 2 cores but parallel JavaScript tasks complete at the speed expected of an 8-core processor, the inconsistency is itself a fingerprinting signal — and potentially a stronger one than either value alone. This is why browser-level protections (Brave, Firefox) apply timing restrictions alongside value spoofing, rather than simply replacing the number.

Does CPU fingerprinting affect my privacy score on whatsmy.fyi?

Yes. whatsmy.fyi's Privacy Score evaluates the combination of fingerprinting risk signals your browser exposes, including hardware concurrency, WebRTC leak status, TLS version, and connection protocol. A browser that reports a common core count (4 or 8) without additional uniqueness signals contributes less to fingerprint entropy than one with an unusual value. Using Brave or Firefox with resistFingerprinting will positively affect your score.

Related Articles

• What Is Browser Fingerprinting? How Sites Track You Without Cookies — the complete guide to all fingerprinting signals combined
• What Is Canvas Fingerprinting? How Websites Track You Without Cookies — how invisible canvas renders produce a unique device identifier
• What Is WebGL Fingerprinting? How Your GPU Identifies Your Browser — how the 3D graphics API exposes your GPU vendor and driver version
• What Is Audio Fingerprinting? How AudioContext Tracks Your Browser — how your device's audio processing stack produces a unique identifier