Articles / Privacy

830 words

  • tor
  • tor-browser
  • fingerprinting
  • letterboxing
  • browser-privacy
  • privacy

Why Your Tor Browser Window Size Is a Fingerprint

Tor hides your IP address, but a website can still read the exact pixel size of your browser window. That number is surprisingly specific. Combined with a few other values, it can tell one visitor from another, even when every visitor is behind the same exit relay.

Here is why that works, what Tor Browser does about it, and the one habit (maximising the window) that quietly undoes the protection.

A window size is more unique than it looks

Most people drag their window to some arbitrary size and leave it. The result is a width and height like 1437 by 811, which very few other visitors share. Odd window sizes are high-entropy: the more unusual the number, the fewer people it could be.

Any page can read it with a line of script:

const sizes = {
  inner: [window.innerWidth, window.innerHeight],
  outer: [window.outerWidth, window.outerHeight],
  screen: [screen.width, screen.height],
  avail: [screen.availWidth, screen.availHeight],
};
console.log(JSON.stringify(sizes));

The screen values matter as much as the window values. A maximised window on a laptop with a taskbar gives away the screen resolution minus the taskbar height, which pins down your hardware and OS layout further.

No JavaScript does not mean no leak

Disabling scripts helps, but CSS can still ask questions about the viewport. Media queries test width and height, and a stylesheet can make the browser fetch a different URL depending on which one matches.

@media (min-width: 1400px) { .probe { background: url("/probe?w=1400"); } }
@media (min-width: 1401px) { .probe { background: url("/probe?w=1401"); } }
/* ...and so on, one rule per step */

The server then sees which requests arrive and infers the width without a single line of JavaScript. It is clumsy but it works, which is why a fix has to live in the browser rather than in a script blocker.

What Tor Browser does: letterboxing

Older Tor Browser versions tried to open at a standard rounded size and asked users not to resize. That fell apart as soon as someone maximised the window or snapped it to half the screen.

Modern Tor Browser uses letterboxing. The page content area is forced onto one of a limited set of dimensions, and any leftover space becomes a grey margin. The feature comes from Firefox's resist-fingerprinting work, and Tor Browser has shipped it by default for several years.

  • You resize the window to whatever you like.
  • The browser rounds the usable content area down to a stepped size.
  • Scripts and media queries see the rounded size, not your real one.
  • The grey bars fill the difference.

Because many users land on the same few sizes, they share a bucket. Being one of thousands in a bucket is the whole point; being alone in one is the fingerprint.

Quick detour: why the screen size lies too

Hang on, why does the screen size not give you away anyway? Because Tor Browser reports a fake one. Under the resist-fingerprinting mode, screen.width and screen.height are tied to the (rounded) content size rather than your monitor.

That is neat: the script asks about the display and gets an answer that has nothing to do with the display. It only holds together if the window values are also bucketed, which is exactly what letterboxing guarantees.

The habit that undoes it: maximising

Tor Project guidance has long been not to maximise the window. The reason is that a maximised window is as large as your monitor allows, and that size tends to be less common and more tied to your real hardware.

Letterboxing reduces the damage, since the rounding still applies. But large sizes sit in sparser buckets, so you are in a smaller crowd. Leave the window at its default size, and if you need more room, use the browser's zoom rather than resizing.

Practical advice:

  1. Start Tor Browser and do not resize or maximise it.
  2. If you must resize, keep to the default or a common smaller size, and avoid dragging edges to odd values.
  3. Do not install extensions or change fingerprint-related settings, since each change moves you out of the crowd.
  4. Leave the security level alone unless you have a reason; it changes what pages can do.

Checking it yourself

Open the developer console in a normal Firefox window and run the snippet above, then resize and run it again. The numbers track your window exactly. Do the same in Tor Browser (pages you control, or a local file) and you should see values that jump in steps rather than follow every pixel.

If the values in Tor Browser change smoothly as you drag the edge, something is wrong: either letterboxing has been switched off or you are not running the stock build.

What this does and does not buy you

Letterboxing is one defence among many, and the bucket is only as good as the crowd in it. A rare window size with an otherwise common browser is still a weak signal, not proof of identity. The danger is accumulation: window size plus fonts, timezone, language and behaviour can narrow things down fast.

So the honest summary is modest. Tor Browser makes the window size boring on purpose, and the main thing you can do is not make it interesting again.

← All articles