How Does a Tiny Site Icon Track You Across Incognito Sessions?
In short, browser fingerprinting via favicon gives your browser a stable identifier without writing anything to cookies. A server serves different icon files along different redirect paths, then observes which icons your browser has to download and which it already holds in cache; that pattern of hits and misses is the identifier. It survives cookie clearing, cache flushing, private windows, a VPN and ad blockers. Chrome, Edge, Safari and Brave were shown affected in the 2021 disclosure; Firefox behaves differently.
📌 TL;DR Executive Summary
- Core Takeaway: Favicons live in a separate local database — the F-Cache — that records the icon, its URL and a time to live. By serving different icons per redirect step, a server reads your cache back through request patterns and rebuilds a visitor ID that is stable across sessions.
- Key Risk/Challenge: This identifier is not a cookie. Clearing cookies, flushing the cache, rebooting the OS and opening private windows do not remove it, and it works behind a VPN or an ad blocker. It also scales: N binary choices distinguish 2^N visitors.
- Recommended Solution: Treat each identity as a separate browser profile with its own storage rather than a reused window, keep browsers updated, and stop assuming “clear browsing data” resets anything you cannot see.
A favicon is the small image a site declares with a link tag — usually a multi-size .ico, an .svg or a PNG. Your browser stores it on first fetch and reuses it afterwards, which is why tabs, bookmarks and history entries appear instantly instead of downloading an icon every time. That store is the favicon cache, or F-Cache, and it is managed separately from cookies, site data and the HTTP cache. The “clear browsing data” dialog in most browsers does not touch it — which is exactly what makes it a lasting identifier.
Because the store belongs to the browser install rather than to one site, a page can only ever see the icons it caused your browser to fetch. The signal comes from a request that does not happen: a missing icon forces a download, a cached icon produces silence. Requested or not requested is the one bit each icon carries.
Favicon Fingerprinting Is Two Different Things
Search results mix two unrelated techniques under the phrase browser fingerprinting via favicon, and the confusion sends people to the wrong fix. One targets servers; the other targets visitors.
Server icons as a reconnaissance clue
Analysts hash the favicon file a host serves and use it to guess what software or appliance answers at that address. It is a clue, not proof: the same product ships the same icon to thousands of customers, and the image says nothing about a version. It gets combined with headers, ports and response behaviour before anyone acts on it.
The client-side supercookie
The second technique targets visitors. It abuses the way the F-Cache answers “do you already have this?” and builds a visitor ID from the answers. Researcher Jonas Strehle published a working demonstration, the Supercookie research project, which assigns a unique number to each visitor without relying on cookies, storage or a logged-in session. That is the technique the rest of this article covers.
How the Favicon Cache Becomes a Persistent Identifier
Step 1: the server hands out different icons
Your first request returns a page whose link tags point at favicon variants. The server notes which file it served, then routes you onward. On the next hop you get a different set of link tags, so the sequence of icons you are offered depends on the path you took. The demonstration drives this with client-side redirects, not cookies.
Step 2: your browser answers by staying quiet
Every link tag makes the browser consult the F-Cache. On a miss it downloads the file and the server logs a hit. On a hit the browser sends nothing at all, and the server learns that this icon is already on your machine. Because that store outlives a single visit by a wide margin, the second answer describes your past rather than your present.
Step 3: the server rebuilds your number
N binary choices produce 2^N distinct patterns, so each extra icon in the chain doubles the number of visitors the scheme can tell apart. The output is stable: same browser install, same cache, same number. The original demonstration reported full identification accuracy in its own tests, and the reason is that browser fingerprinting via favicon estimates nothing — the server reads back what your browser already remembers. For the general mechanics of how signals like this accumulate, the breakdown of fingerprint entropy explains how much identity each extra bit really carries.
Which Browsers Are Affected, and What Has Changed Since
The 2021 disclosure reached Chrome, Safari, Edge and Brave, and put Firefox in an unusual position: technically susceptible, but a bug meant the scheme failed in practice.
| Browser | Status in the original disclosure | What to keep in mind |
|---|---|---|
| Chrome | Affected | Keep it patched; partitioning work has continued since, but no setting replaces a genuinely separate profile. |
| Edge | Affected | Same Chromium cache behaviour — profile separation matters as much as the version number. |
| Safari | Affected | Private windows were not a fix in the demonstration. |
| Brave | Affected, then fixed | Version 1.19.92 and later shipped a countermeasure after a private report from the researchers. |
| Firefox | Susceptible in theory, blocked in practice | A bug prevented the attack; from version 86 onward, private mode produces a different fingerprint. |
Treat those version numbers as history, not a permanent verdict. Browser teams shipped partitioning and cache mitigations after the disclosure, and write-ups as recent as mid-2026 still describe the favicon supercookie as surviving cache clearing, restarts, reboots and incognito mode across the major engines. The Ars Technica report on the 2021 disclosure is worth reading in full; the durable lesson is simpler: any cache your browser keeps for its own convenience can be interrogated through request patterns.
Where This Hits People Who Manage More Than One Account
If you run one identity in one browser install, the F-Cache is a minor privacy leak. If you run several client accounts, several storefronts or several test personas in the same install, it becomes a mixing problem. Each of those sessions writes into one local store, and the residue from session A is still there when you sign into account B — the same residue that browser fingerprinting via favicon reads back.
That residue does not break a platform rule by itself, but it does degrade the separation you were counting on: a profile that has already loaded five clients’ dashboards is not a fresh environment for the sixth. It also sits inside a larger picture, covered in this look at what a browser fingerprint includes — fonts, canvas output, timezone, hardware hints and the way all of it holds together across repeated visits.
Quality assurance and support teams notice it first. Test a checkout as customer A and then as customer B in the same browser, and the second run inherits cookies, storage and cached icons from the first. The result is no longer a faithful reproduction of what a real new user sees, and a bug that only appears on a genuinely fresh visit can hide behind state you did not know you were carrying.
Where a platform limits multiple accounts, use that platform’s own route: Amazon’s approval process for an additional seller account, or Business Manager roles for agencies working on client Meta assets. Isolation is about keeping accounts you own or are authorised to manage separate and orderly. It is not a way around a suspension, a verification step or an account limit, and a restricted account is restored through the platform’s own appeal process.
Favicon Supercookie vs Other Tracking Techniques
The favicon trick is not stronger than canvas or TLS fingerprinting. It is just harder to clear, because there is nothing obvious to delete.
| Technique | Signal it reads | Survives cookie clearing | Where it lives |
|---|---|---|---|
| Favicon supercookie | Which icons your browser already has cached | Yes — the F-Cache is a separate store | Local icon cache, read through requests |
| Canvas fingerprinting | How your device renders text, shapes and gradients | Yes — recomputed on each visit, nothing to delete | Rendering pipeline |
| TLS fingerprinting | Cipher suites and extensions in your handshake | Yes — nothing is stored on your device at all | Network layer |
| Cookies | An identifier the site wrote to your device | No | Cookie jar |
Canvas and WebGL draw on the same idea: ask the device to do work, then treat the output as a signature. The favicon variant differs because it reads memory instead of measuring hardware, which is what makes it cheap, quiet and awkward to clear. This guide to canvas fingerprinting walks through what the site actually renders and why two supposedly identical machines return different pixels.
A Practical Checklist to Break the Favicon Identifier
- Give each identity its own browser profile. Not a new tab and not a private window — a profile with its own storage and its own cache. This is the same principle behind browser isolation, applied at the level of one profile per account.
- Stop reusing long-lived profiles across clients. A profile that has browsed five clients’ dashboards carries five sessions’ worth of cached icons. If a profile has been used for client work, retire it rather than repurposing it.
- Do not rely on “clear browsing data”. Cookies, site data and the HTTP cache are different stores from the F-Cache. Clearing what the dialog offers will not clear what this scheme reads.
- Assume private mode is not a fresh browser. The original disclosure showed the identifier persisting into incognito windows, so use private mode for convenience, not as your separation strategy.
- Keep browsers current. Brave shipped a working countermeasure in 1.19.92 and later, and Firefox 86 changed its private-mode behaviour. Updates are the cheapest mitigation available to you.
- Test your own setup, then test it again. Visit the reference demonstration at supercookie.me, then repeat the visit from a brand-new profile and compare the numbers. If both runs return the same identifier, your separation is not doing what you think it does.
- If you publish sites, ship a minimal icon set. One multi-size favicon.ico, one favicon.svg, one 180×180 apple-touch-icon.png and a couple of manifest PNGs behind four link tags. Fewer variants means fewer cache entries, and fewer combinations for anyone probing your visitors.
Common Mistakes That Keep the Identifier Alive
- Confusing cookies with every other store. Cookies are one container. Site storage, service worker caches, HSTS state and the favicon cache are separate, and each has its own rules about when it expires.
- Believing a VPN changes this. A VPN changes your exit IP. The cache that gets read is on your disk, so the network path makes no difference here.
- Expecting ad blockers to help. The scheme does not depend on advertising requests, and the original research notes it working with tracking protection in place.
- Deciding it is a 2021 problem. Mitigations landed, and write-ups from 2026 still describe browser fingerprinting via favicon as functional, so old disclosures are not safely ignored.
- Mixing the two meanings. Hardening your own server’s icon files does nothing about a visitor-tracking scheme; conversely, a clean profile does not stop an analyst from hashing your public favicon.
- Separating the logins but not the browsing. Signing into two clients in two profiles while researching both in a third shared profile leaves a trail that spans both.
How Send.win Helps With Browser Fingerprinting Via Favicon
Send.win is a browser profile manager for professionals and teams: every account gets its own isolated browser profile.
- Isolated profiles – separate cookies, storage and sessions per profile
- Fingerprint protection – each profile keeps its own consistent browser fingerprint, so profiles never share one browser identity
- Desktop app + cloud browser – native app for Windows, macOS and Linux, or run profiles in the cloud with no install
- Residential proxies included – on Pro and Team, with timezone and locale matched to the proxy
- Team sharing – share a signed-in profile with a teammate without sharing the password
Try the free cloud demo — no install — or download the desktop app. Paid plans start at $19/month, and your first card purchase is covered by a 7-day money-back guarantee (see pricing).
Where Send.win Fits
Send.win is a browser profile manager for people who work across more than one account. Each isolated profile keeps its own cookies, storage, sessions, fingerprint settings and proxy, so the local record of a session — including the icon cache — belongs to that profile rather than to the machine as a whole. That matches the mechanism described above: separation has to happen where the readable state lives, inside the browser’s own storage.
Two ways to run it. Sendwin Browser is a native desktop app for Windows 10/11 (64-bit), macOS 12+ and Linux, built on Chromium and installed locally. The cloud browser runs profiles on Send.win’s servers in Helsinki, Finland, from any device with nothing to install, which suits a team that needs the same profile on a laptop and a workstation. Fingerprint protection is handled inside the browser engine, so each profile keeps its own consistent fingerprint instead of sharing one browser identity with every other profile — the same idea as the fingerprinting protection in Firefox or Brave, applied per profile. Timezone, locale, WebRTC and geolocation follow your proxy’s exit IP, and you can use the built-in residential proxies on Pro and Team or bring your own HTTP/SOCKS5.
For teams, a profile shared with a paid teammate opens already signed in, so no password changes hands; live cloud sessions can be handed over, and cloud sync carries logins across devices. Every part of the workflow is manual by design: you open, switch and share profiles yourself, in the desktop app or in the cloud browser, and there is nothing to script against.
Pro is $19/mo — 150 saved profiles, 5 GB of proxy bandwidth a month and 6 seats. Team is $49/mo — 500 profiles, 20 GB and 16 seats. Both allow up to 50 profiles open at once, with add-ons at $6 per GB and $0.05 per profile. There is no free trial of the desktop app; the only free option is the cloud demo, and your first card purchase carries a 7-day money-back guarantee.
🏆 Send.win Verdict
Favicon caching is a good reminder that “clear your cookies” only ever addressed one container on your machine. If you manage several client accounts, storefronts or test personas, the practical fix is architectural: one isolated profile per identity, each with its own storage and its own consistent fingerprint settings, so the readable state of one session never becomes the starting point of another. Send.win is built around exactly that model, on desktop or in the cloud, with proxies and sharing included rather than bolted on. It does not change platform rules — you still work only with accounts you own or are authorised to manage.
See Send.win plans — Pro starts at $19/mo (or $6.99/mo billed annually) with residential proxies included and a 7-day money-back guarantee, or try the free cloud demo first.
Frequently Asked Questions
What is browser fingerprinting via favicon in plain terms?
It is a way to give a browser a stable ID without storing anything on it. The server serves different favicon files along different redirect paths, then observes whether each icon had to be downloaded or was already cached. The pattern of hits and misses encodes a number that stays the same across visits.
Can favicon tracking survive incognito mode and cookie clearing?
According to the original research, yes on both counts. The identifier persisted in incognito windows, after clearing cookies and after the cache was flushed, and it also survived an OS restart. The reason is that the favicon store is a separate local database rather than part of the cookie jar or the HTTP cache.
Which browsers are affected?
The 2021 disclosure reached Chrome, Safari, Edge and Brave. Firefox was susceptible in theory but a bug prevented the scheme from working, and version 86 and later produce a different fingerprint in private mode. Brave shipped a countermeasure in version 1.19.92 and later, which is why keeping browsers updated matters.
Does a VPN prevent favicon tracking?
No. A VPN changes the IP address the site sees, but the information being read is stored in your local browser profile. The research notes the method working with a VPN in place, so treat network anonymisation and browser-level separation as two different jobs.
Do ad blockers or cache-clearing tools stop favicon-based tracking?
Ad blockers block requests, and this scheme does not depend on ad requests, so they do not interfere. Cache-clearing tools usually target the HTTP cache and cookies; the favicon database has its own lifecycle, which is why a genuinely unused profile beats any cleanup routine.
Is favicon fingerprinting still a threat in 2026?
Browsers added partitioning and cache mitigations after the 2021 disclosure, and coverage as recent as mid-2026 still describes the technique as functional across the major engines. Treat specific version numbers from 2021 as history, and assume that any convenience cache your browser keeps can be queried by whoever serves the content.
What is the difference between favicon fingerprinting and browser fingerprinting?
Browser fingerprinting is the umbrella category: canvas, WebGL, audio, fonts, timezone and hardware signals combine into a profile of your device. The favicon supercookie is one narrow member of that family, and it is unusual because it reads stored state instead of measuring hardware, so cookie cleanup does not affect it.
Is server-side favicon fingerprinting the same attack?
No, and mixing them up leads to wasted effort. Server-side favicon fingerprinting hashes a host’s public icon to guess what software runs there, and the icon is only a clue. The supercookie works in the opposite direction, profiling visitors through their local cache, and it cannot be fixed by changing your own favicon files.