What a Browser Fingerprint Test Score Actually Means

A fingerprint test hands you a number and calls it bits of entropy. Then people add those numbers up and conclude they are one of a handful of people on the internet. Both steps are wrong in interesting ways. The bits are not independent, and the test is not a census.

1. Do not add dependent signals

Start with the relationship between the observations rather than their count, which is also what W3C's fingerprinting guidance asks for when it talks about likely distributions. Two balanced binary properties show the arithmetic in its simplest form.

Four equally likely states carry two bits; two equally likely states carry one. If the second property always copies the first, the report still lists two fields and the information is still one bit. Reading the same fact twice is not a second distinction.

Real features are rarely exact copies. Language, locale and timezone are correlated in ways an independence assumption ignores, which is why naive addition overstates the result.

2. Ask which population the score describes

A test can honestly report that a combination was rare within its own observations. That is a statement about a sample, on a date, with a particular attribute list and a particular calculation. It is not a permanent property of your browser, and it is not a count of every device in the world. Browser updates move the answer on their own.

Read the method before the headline: what was collected, how values were bucketed, how many samples, and whether the rarity claim comes from the same panel that produced the score. A number computed against a small self-selected sample describes the sample.

3. Separate recognition from identity

A persistent account or cookie connects your visits without any clever fingerprinting, and changing a VPN exit does not touch it. A fingerprint can recognise a returning browser without naming the person behind it. Those are different capabilities, and one score blurs them together. When a service wants identity, it usually reaches for the boring tools first.

That also explains why two people in one office can look identical to a coarse fingerprint and completely different to a login.

4. Note what will move the number anyway

Settings change, extensions change, and browser versions change what is observable in the first place. Some protections deliberately normalise fields that a test would otherwise count as distinguishing. Others randomise a value per session, which shows up as instability rather than anonymity.

A fingerprint that shifts every visit is harder to link across sessions, and it tells you nothing about your rarity. Both facts belong in the reading.

5. Decide what you are trying to achieve

Write the goal down before you install anything. If the goal is to stop cross-site tracking by one ad network, cookie and storage hygiene plus a content blocker does most of the work. If the goal is to avoid one specific correlation, name the feature. If the goal is to be hard to single out, the honest approach is a mainstream configuration rather than a rare one.

The counter-intuitive part is that chasing rarity makes you easier to pick out. A distinctive configuration is exactly what a fingerprinting script hopes to find. Blending in is a different objective from maximising a printed number.