Deterministic Browser Mode: Reproducible Fingerprints Across Sessions

Introduction

Browser fingerprinting relies on signals that are stable within a session but vary between devices. The flip side of this problem is reproducibility: when you need multiple browser sessions to present the same identity, or when you need to verify that your privacy protection is working correctly, you need deterministic behavior. A browser that produces slightly different canvas hashes, audio fingerprints, or WebGL output each time it launches makes it impossible to maintain a stable identity or to reliably test your configuration. BotBrowser's deterministic mode, enabled through the --bot-noise-seed flag, gives you complete control over all sources of fingerprint variation. The same profile and seed combination always produces the same fingerprint, across sessions, across machines, and across operating systems.

Privacy Impact

The need for deterministic browser behavior comes from a fundamental tension in fingerprint protection. Noise is important for privacy. Adding controlled variation to canvas output, audio processing, and WebGL rendering prevents fingerprints from being trivially linked to a single profile. But uncontrolled noise, where every session produces a different fingerprint, creates a different problem: each session appears as a unique user, which is the opposite of blending in.

Research from the INRIA privacy team has shown that fingerprint instability (changing fingerprints across sessions) is itself a tracking signal. If a fingerprint changes on every visit but other signals (IP, login state, behavioral patterns) remain stable, the changing fingerprint becomes a marker rather than a shield.

Deterministic mode solves this by giving you explicit control. You choose when fingerprints should stay the same (same seed) and when they should differ (different seed). This is particularly important for:

• Session continuity. Returning to a website across multiple sessions with the same fingerprint.
• Multi-instance coordination. Running multiple browser instances that need distinct but stable identities.
• Testing and verification. Confirming that your fingerprint protection produces expected results.
• Research reproducibility. Running controlled experiments where fingerprint variation must be eliminated as a variable.

Technical Background

Sources of Fingerprint Variation

Modern fingerprint protection involves adding controlled noise to several rendering and processing pipelines:

• Canvas 2D. Text rendering, shape drawing, and image manipulation produce device-specific pixel output. Noise adds sub-pixel variation to prevent exact matching.
• WebGL/WebGPU. Shader execution, texture sampling, and framebuffer readback produce GPU-specific output. Noise modifies pixel values in the rendered output.
• Audio. OfflineAudioContext rendering and AnalyserNode frequency data produce platform-specific float values. Noise varies the processing output.
• Text metrics. measureText(), getBoundingClientRect(), and getClientRects() return dimensions that depend on font rendering. Noise adds sub-pixel variation to measurements.

Without a seed, each of these noise sources generates fresh random variation on every browser launch. With a seed, the random number generator is initialized to a known state, producing identical variation patterns every time.

How Noise Seeds Work

A noise seed is a single integer that initializes a deterministic pseudo-random number generator (PRNG). The PRNG produces a sequence of values that appears random but is entirely determined by the seed. Two sessions with the same seed produce the same sequence, and therefore the same noise applied to every fingerprint surface.

BotBrowser's noise seed (set via --bot-noise-seed) controls:

• Canvas 2D image noise
• WebGL image noise
• WebGPU rendering noise
• Audio context processing variation
• Text metric variation (client rects, text rects)
• Text layout variation

The seed does not affect non-noise properties like navigator.hardwareConcurrency, screen.width, or user agent strings. These come directly from the profile and are always deterministic.

Timing Determinism

Beyond fingerprint noise, BotBrowser offers additional timing controls:

• --bot-time-seed - Controls execution timing diversity across 27 browser operations. Each seed produces a unique, stable performance profile. This covers performance.now() intervals, performance.getEntries(), navigation timing, and more.
• --bot-time-scale - Scales down performance.now() intervals to normalize timing differences caused by varying server loads.

Together, noise seeds and timing seeds provide comprehensive deterministic control over all variable browser outputs.

Common Protection Approaches and Their Limitations

No noise at all means your fingerprint directly reflects the profile's base values. This is deterministic but removes the privacy benefit of variation. Multiple sessions with the same profile all have the exact same fingerprint, which means they are linkable by definition.

Random noise without a seed provides variation but at the cost of reproducibility. Every session has a unique fingerprint. You cannot maintain a stable identity, you cannot verify your configuration reliably, and you cannot coordinate multiple instances.

Session-based noise (generating a random seed per session and storing it) is a manual workaround that adds complexity. You need to manage seed values, associate them with sessions, and ensure they are applied consistently. BotBrowser eliminates this overhead by accepting the seed as a CLI flag.

Extension-based noise typically applies random noise at the JavaScript level without any seed mechanism. Each page load produces different results. The noise is not deterministic, not controllable, and not consistent across API surfaces.

BotBrowser's Engine-Level Approach

BotBrowser's deterministic mode operates at the rendering engine level, ensuring that noise is applied consistently across all API surfaces from a single seed value.

Single Seed, Complete Coverage

The --bot-noise-seed flag accepts an integer from 1 to 4294967295 (UINT32_MAX). This single value controls all noise sources simultaneously:

• Canvas 2D toDataURL(), toBlob(), and getImageData() produce identical output for the same seed.
• WebGL readPixels() returns the same framebuffer data for the same drawn scene and seed.
• OfflineAudioContext renders the same buffer for the same audio graph and seed.
• measureText() and getClientRects() return the same measurements for the same content and seed.

Cross-Machine Reproducibility

Because the noise is derived from the seed and applied at the engine level, the same profile + seed combination produces the same fingerprint regardless of the underlying hardware, operating system, or GPU. A session on a Linux server with an NVIDIA GPU and a session on a Mac laptop with Apple Silicon produce identical fingerprints when using the same profile and seed.

Seed as Identity

In practice, you can think of each seed as defining a unique sub-identity within a profile. Profile A with seed 42 is a stable, reproducible identity. Profile A with seed 43 is a different stable, reproducible identity. The profile defines the device class (OS, browser, hardware), and the seed defines the individual within that class.

This model maps naturally to multi-account or multi-session workflows:

• Session 1: profile A, seed 100
• Session 2: profile A, seed 200
• Session 3: profile B, seed 100

Sessions 1 and 2 appear as different users with similar hardware. Session 3 appears as a different user on different hardware.

Timing Determinism

With --bot-time-seed, execution timing becomes reproducible too. Performance measurements, navigation timing, and resource timing all follow a deterministic pattern for a given seed. Combined with --bot-noise-seed, this provides complete control over all variable browser outputs.

Deterministic Mode: Seed Controls All Noise Sources

chrome --bot-profile="/path/to/profile.enc" \
       --bot-noise-seed=42 \
       --user-data-dir="$(mktemp -d)"

chrome --bot-profile="/path/to/profile.enc" \
       --bot-noise-seed=42 \
       --bot-time-seed=42 \
       --bot-stack-seed=profile \
       --user-data-dir="$(mktemp -d)"

# Instance 1 - stable identity A
chrome --bot-profile="/path/to/profile.enc" \
       --bot-noise-seed=1001 \
       --user-data-dir="/tmp/session-a" &

# Instance 2 - stable identity B
chrome --bot-profile="/path/to/profile.enc" \
       --bot-noise-seed=1002 \
       --user-data-dir="/tmp/session-b" &

const { chromium } = require('playwright');

const browser = await chromium.launch({
  executablePath: '/path/to/botbrowser/chrome',
  args: [
    '--bot-profile=/path/to/profile.enc',
    '--bot-noise-seed=42',
    '--bot-time-seed=42'
  ]
});

const page = await browser.newPage();
await page.goto('https://example.com');

// This canvas fingerprint will be identical on every run
const hash = await page.evaluate(() => {
  const canvas = document.createElement('canvas');
  const ctx = canvas.getContext('2d');
  ctx.fillText('deterministic test', 10, 10);
  return canvas.toDataURL();
});
console.log(hash);

const puppeteer = require('puppeteer');

const browser = await puppeteer.launch({
  executablePath: '/path/to/botbrowser/chrome',
  defaultViewport: null,
  args: [
    '--bot-profile=/path/to/profile.enc',
    '--bot-noise-seed=42',
    '--bot-time-seed=42'
  ]
});

const page = await browser.newPage();
await page.goto('https://example.com');

chrome --bot-profile="/path/to/profile.enc" \
       --bot-noise-seed=42 \
       --bot-config-noise-canvas=false \
       --bot-config-noise-audio-context=false