Published October 2, 2026

Firefox has a hidden switch called privacy.resistFingerprinting. Flip it on, and dozens of the small details websites use to recognize your browser suddenly look the same as everyone else's. It's the same protection that Tor Browser is built on, and it's sitting in regular Firefox right now, turned off.

Most guides stop at "set it to true." That's where the questions start. Why are your Google Calendar events suddenly four hours off? What are those gray bars around web pages? How do you keep one site working without turning the whole thing off? This guide walks through what the setting actually changes and the companion settings that go with it, so you can decide how far you want to take it.

What resistFingerprinting Actually Changes

Browser fingerprinting doesn't need cookies. A website quietly reads dozens of properties from your browser (your timezone, screen size, installed fonts, graphics card) and combines them into an ID that's often unique to you. You can see your own fingerprint and how rare each piece of it is on the Browser Fingerprint page.

resistFingerprinting (often shortened to RFP) attacks the problem from the other side. Instead of hiding these values, it replaces them with standard ones that millions of other users report too:

None of these changes alone makes you anonymous. Together, they move you out of a crowd of one and into a much larger group of browsers that all report the same things.

How to Turn It On

1. Type about:config in the Firefox address bar and press Enter.
2. Click "Accept the Risk and Continue."
3. Search for privacy.resistFingerprinting.
4. Double-click it so the value changes to true.
5. Reload any open tabs.

That's it. To undo it, double-click the same setting again. The browser privacy settings guide covers this step alongside the other settings worth changing, like WebRTC and HTTPS-Only Mode.

Want It Only in Private Windows?

If you'd rather keep normal browsing untouched, leave privacy.resistFingerprinting set to false and set privacy.resistFingerprinting.pbmode to true instead. RFP then applies only in Private Browsing windows. That gives you a quick "hardened mode" for sensitive browsing, while your everyday windows keep your local time, dark mode and normal site behavior.

Exempted Domains: Keep Specific Sites Working

This is the setting most people go looking for after a day with RFP. privacy.resistFingerprinting.exemptedDomains lets you list sites that should see your real browser values. Everywhere else, the protection stays on.

1. Open about:config and search for privacy.resistFingerprinting.exemptedDomains.
2. Click the pencil icon to edit it.
3. Enter the site's domain exactly as it appears in the address bar, for example calendar.google.com. Separate multiple sites with commas, like calendar.google.com,outlook.office.com.
4. Save, then reload the site.

Good candidates are sites where correct local time matters (calendars, scheduling tools, webmail) and sites that keep throwing CAPTCHAs or security checks at you, such as some banks.

Letterboxing: Those Gray Bars Around Web Pages

Even with RFP on, your browser window size can still give you away. If you've dragged your window to an unusual size, very few people will report exactly the same dimensions.

Letterboxing fixes that. It's a separate setting, privacy.resistFingerprinting.letterboxing, and it isn't turned on just by enabling RFP. When you set it to true (if it isn't listed in about:config, type the name, choose "Boolean" and click the plus button to create it), Firefox snaps the area that shows web pages to a set of standard sizes and fills the leftover space with gray margins. Websites only ever see one of those common sizes, no matter how you resize the window.

Tor Browser and Mullvad Browser have letterboxing on by default, which is why their windows often have that gray frame. In regular Firefox, it's worth turning on if you take fingerprinting seriously and can live with the margins. If the bars bother you, the next best thing is to keep your window maximized on a common monitor resolution.

Why Your Times Are Wrong: The UTC Timezone

This is the side effect US users notice first. RFP reports your timezone as UTC to every website, and web apps that display times based on your browser's clock will believe it.

UTC is 4 hours ahead of New York in summer and 5 hours ahead in winter, and 7 to 8 hours ahead of Los Angeles. So a 3:00 PM meeting in New York can suddenly show up as 7:00 PM in a browser-based calendar, and "order by 5 PM for same-day pickup" timers can be off by hours.

Your computer's clock isn't changed, only what websites are told. There are three ways to deal with it:

• Add the affected sites to exemptedDomains (see above). This is the cleanest fix for calendars and webmail.
• Use RFP only in private windows with pbmode, so your everyday browsing keeps local time.
• Switch to the lighter Fingerprinting Protection described below, which keeps your real timezone.

There's an upside, too. Because every site sees UTC instead of your local time, your timezone no longer reveals roughly where in the country you live. That's one of the reasons it's recommended for VPN users in the timezone guide.

Other Side Effects to Expect

• No dark mode on websites. Sites are told you prefer a light theme, so automatic dark mode stops working. Firefox's own menus and tabs stay dark.
• More CAPTCHAs. Some anti-bot systems find standardized browsers suspicious and ask you to prove you're human more often.
• Web apps that draw graphics. Online image editors, some maps and some CAPTCHAs read canvas data and can misbehave when it's blocked or randomized.
• Odd zoom and window sizes. New windows may open at a rounded size instead of filling your screen, and sites see a pixel ratio of 1, which can make some images look softer on high-resolution displays.

Mozilla itself warns that RFP can break websites. That's not a reason to avoid it, just a reason to know what you're signing up for.

resistFingerprinting vs. Fingerprinting Protection

Firefox has a second, newer option called Fingerprinting Protection (privacy.fingerprintingProtection), which you get by setting Enhanced Tracking Protection to "Strict." It blocks common fingerprinting methods like canvas and font detection but keeps your real timezone and language, so far fewer things break.

• Choose Fingerprinting Protection if you want solid protection that you can forget about. This is the right choice for most people.
• Choose resistFingerprinting if you want the strongest protection Firefox offers and you're willing to manage exemptions and live with UTC time.

If both are turned on, resistFingerprinting takes priority. Prefer to skip the configuration altogether? Tor Browser, Mullvad Browser and LibreWolf ship with RFP enabled out of the box. See how they compare in the privacy browser comparison.

Check That It's Working

Open the Browser Fingerprint page before and after you enable RFP. With RFP on, your Timezone Offset should show +0h (offset: 0 min), which is UTC, your pixel ratio should be 1, and your screen resolution should match your browser window rather than your monitor. If those values still show your real setup, double-check the setting in about:config and make sure the site isn't on your exempted list.

resistFingerprinting is the closest thing regular Firefox has to Tor Browser's "everyone looks the same" approach. Set up a handful of exempted domains, decide whether you want letterboxing, and it becomes one of the strongest privacy upgrades you can make without installing anything.