Why a VPN alone fails fingerprint tests

A VPN changes the route. It does not rewrite the browser. Canvas, fonts, WebGL, screen metrics, and hardwareConcurrency still describe the Windows box you launched. Lab pages that look at those surfaces will still see the same person after the exit moves. That is why a VPN-only setup fails fingerprint tests.

This is a mechanism note for accounts you have a right to open. It is not a hide-the-IP recipe. If you do not have a right to the account, a new line will not create that right.

What a VPN actually changes

A VPN (or a proxy you brought) changes the address sites see on ordinary fetches. The TCP path leaves through another machine. Geo databases then guess a country, a city, and an ISP for that exit.

That is useful. It is also a small slice of what browser fingerprinting actually measures. The measurement is a bundle. The exit is one field in the bundle.

On a real Windows desktop the rest of the bundle stays home. ClearType still paints canvas. DirectWrite still measures fonts. ANGLE still answers WebGL. The monitor still reports the same width. The CPU still reports the same core count. A page that asks those questions does not need the old IP to recognize the process.

The cheap contradiction a VPN creates

The exit moved. The clock often did not. Intl still thinks you sit in the kitchen. navigator.languages still lists the host pack. The Geolocation API may still offer the host pin. A Dallas line with a Sydney clock is a coherence tell. Sites do not need a rare hash if the IP and the clock argue.

Geolocation API versus the exit IP is the sibling that splits those two location doors. The rule on this page is simpler: a VPN does not align them. You have to.

A VPN also does not close every address door. What an IP leak is is the parent definition. What a DNS leak is is one door. WebRTC is another. You can see a correct VPN exit on an IP page and still spill a local candidate or a resolver that ignored the tunnel.

What lab pages still see

BrowserScan will still list GPU, canvas, and hardware. Pixelscan will still flag a platform that does not match a renderer. IPhey may like the new line and still grade the engine. Different skins. Same leftover box.

I will not walk those pages to green. They are maps. A VPN-only operator who treats a new score as a new person is reading the wrong layer.

JA3 and JA4 sit in another leftover layer. They describe TLS Client Hello behavior. A VPN does not rewrite BoringSSL. A page script does not either. If a vendor hashes the handshake, the tunnel did not change the handshake.

What a local profile adds that a VPN does not

On Windows, a headed MaskWright profile can override a lot of what JavaScript sees: UA, Client Hints, timezone, locale, languages, geolocation, screen, cores, WebGL, WebGPU, canvas, fonts, rects, audio, battery, and media IDs. Timezone and the pin can follow the proxy exit after a lookup to ip-api.com.

You bring the HTTP or SOCKS5. We do not broker the line. A VPN app on the host is not the same as a per-profile proxy. The host tunnel moves every process. The profile proxy moves that profile, and launch can align the clock to the exit. There is no offline magic.

The public download is Windows 10 and 11 x64. Profiles are desktop families. Client Hints mark mobile false. A VPN on a phone UA does not make the host a phone.

Isolation is still the folder

A VPN does not split cookie stores. Chromium keeps cookies, localStorage, and IndexedDB in the user-data directory. Each MaskWright profile gets its own folder under the local store. Separate profiles means separate cookies. One system VPN plus one everyday Chrome profile is still one session with a new route.

The Browser fingerprinting cluster keeps that split named. The route is not the measurement. The measurement is not the login. If you only changed the route, you still have the same browser and the same cookies.

How I want you to use this page

Use a VPN or a proxy as a route for a profile you already have a right to open. Then ask whether the engine still tells one story, and whether the clock and the pin follow the exit you actually launched. If a lab page still sees the old box, that is expected. The VPN did its job. Fingerprinting was never its job.

FAQ

Why did my fingerprint look the same after I turned on a VPN? Because canvas, fonts, WebGL, screen, and cores did not move. Only the exit did.

Is a host VPN the same as a per-profile proxy? No. A host tunnel moves every process. A profile proxy moves that profile, and MaskWright can align clock and pin to the exit.

Will a VPN rewrite JA3? No. The Client Hello belongs to the binary.