Received signal strength (RSS)/channel state information (CSI) fingerprinting techniques have been widely adopted for wireless local area network (WLAN)-based indoor localization. However, in most of the RSS/CSI fingerprinting techniques, an application/software has to be installed on the target for uploading RSS/CSI information to the localization system. As a result, RSS/CSI fingerprinting cannot achieve passive localization (application-free), which is an essential requirement in many existing localization systems, especially for commercial and military purposes. In this paper, we propose data rate (DR) fingerprinting to achieve passive localization. DR fingerprinting is compatible with most off-the-shelf wireless fidelity (Wi-Fi) devices and can be directly implemented in the existing WLAN-based localization system without any extra hardware. In DR fingerprinting, DRs are used to replace the RSS/CSI to form fingerprints, since DR information can be directly obtained by access points (APs). However, the inherent features of DR, including low-resolution and serious fluctuation, significantly impair the performance of DR fingerprinting. For implementing DR fingerprinting, we leverage multiple transmission power levels, propose a time-window mechanism with different fingerprint formulations, design a AP switching strategy, and design a new matching algorithm named dynamic nearest neighbors (DNNs). We conducted extensive experiments in a real-world testbed to study the performance of DR fingerprinting. Specifically, we compared DR fingerprinting with the state-of-the-art RSS/CSI fingerprinting techniques. The experimental results illustrate that DR fingerprinting can achieve the localization accuracy that is comparable to that of the RSS/CSI fingerprinting with the additional benefit of achieving passive localization.