Methodology
How we calculate your fingerprint score
Most privacy tools show you a number and ask you to trust it. We publish the math, the assumptions, and the code.
Open source · MIT licensed · 1 starsTwo ways to score uniqueness
Black-box tools
Score shown, derivation hidden.
Signal weighting can't be verified.
"Uniqueness" is often a hardcoded point system labeled as a percentage.
Assumptions and limitations aren't disclosed.
PrivacyTestLab
Every score uses published Shannon entropy math, shown in full below.
Signal weights are open source and auditable.
Uniqueness is measured in bits of entropy, the standard unit in information theory.
Known limitations are documented publicly and updated on record.
Bits of entropy explained
Imagine your screen resolution is shared by 1 in 8 people online. On its own, that fact barely narrows you down. Now add your list of installed fonts — maybe 1 in 40 people share that exact list. Then your GPU model, your timezone, your CPU thread count. None of these facts is identifying by itself. But combine enough of them, and the combination usually is — often unique among billions of browsers. That combination effect is exactly what Shannon entropy measures: not "is this one fact rare," but "how much does this fact narrow down who you could be, added on top of everything else we already know."
Where P is the probability of that exact value occurring in a reference
population. Rarer values → lower probability → more bits → more identifying.
Total entropy across signals (assuming independence — see Limitations below).
What each signal contributes
Bar length shows relative entropy compared to the highest-entropy signal we measure. Values current as of 2026-07-02 — full history in the changelog.
GPU + driver + OS + browser rendering stack combine into an effectively continuous hash space
Common renderer strings (Intel/NVIDIA/AMD via ANGLE) are shared by many users; less common ones narrow the pool sharply
More detected fonts = more specific software/OS install history
Audio stack processing has small, consistent hardware-level variance
Standard resolutions (1920×1080, etc.) are shared by a large population
Higher thread counts are progressively less common
Known specific platform strings (Win32, MacIntel, etc.) narrow more than an unknown/blocked value
Common locales (en-US, etc.) contribute less than rare ones
24/32-bit is near-universal; other depths are rare
1x/2x are common; fractional ratios (1.25x, 1.5x) are less so
Major population-center timezones contribute less than rare ones
Zero plugins (sandboxed Chromium) is now common; higher counts narrow more
Not-exposed is treated as low-entropy (privacy-preserving); high RAM narrows more
No-touch is common on desktop; touch support narrows on desktop specifically
Current limitations
We'd rather tell you exactly where our numbers are strongest and weakest than present a false sense of precision. Three things worth knowing:
- Weights are currently seeded from published academic research, not our own scan data. Sources: Laperdrix et al. (IEEE S&P 2016 / AmIUnique dataset), EFF Panopticlick methodology. As PrivacyTestLab's own scan volume grows, these will be replaced with live, self-computed frequency tables — tracked as an open item in our changelog.
- Signals are treated as statistically independent when summed, which isn't perfectly true (e.g., platform and font list correlate somewhat). This is the same simplification used in EFF's own methodology — a reasonable estimate, not an exact figure.
- Single-signal tools (like our standalone Canvas Fingerprint Test) report raw entropy bits for that one signal, not a 0–100 score — because that scale is calibrated for the full 14-signal combination and would misrepresent what one signal alone can determine.
Changelog
- Initial public release of
entropy.js,scoring-engine.js, andsignal-weights.json. - Real Shannon entropy calculation (
-log2(probability)) per signal, replacing an earlier internal hardcoded point system (e.g. flat+25for canvas,+15for WebGL) that had no statistical basis. That system is retired and does not appear anywhere in this repo. signal-weights.jsonseeded from published fingerprinting research (Laperdrix et al. 2016 / AmIUnique dataset; EFF Panopticlick methodology). Status: not yet derived from PrivacyTestLab's own scan volume — tracked as an open item below.- Wired into production on:
- Browser Fingerprint Test (full 14-signal combined score)
- Canvas Fingerprint Test (single-signal entropy report)
- Replace seeded/published-research weights with live frequency data once PrivacyTestLab has sufficient scan volume for statistically meaningful per-value frequency tables. Target: revisit at 100k+ scans.
- Model signal correlation (e.g. platform ↔ font list) instead of assuming full independence when summing entropy bits.
- Re-sync individual signal-row exposure badges (set during collection, before scoring completes) to the final
scoringResult.perSignal[key]values, so both are guaranteed to agree at all times instead of only by coincidence.
Frequently asked questions
How does PrivacyTestLab calculate browser fingerprint uniqueness?
PrivacyTestLab uses Shannon entropy — the same mathematical framework used in information theory and academic fingerprinting research — to measure how many bits of identifying information each browser signal contributes, then sums them into a total uniqueness estimate.
What is Shannon entropy in browser fingerprinting?
Shannon entropy measures how rare or common an observed value is within a reference population, expressed in bits. Rarer values contribute more bits, meaning they narrow down who a specific browser could be more effectively.
Is PrivacyTestLab's fingerprinting methodology open source?
Yes. The entropy calculation, signal weighting, and scoring engine are published under the MIT license at github.com/PrivacyTestLab/fingerprint-scoring, and the live site runs this exact code.
How accurate is a browser fingerprint entropy score?
It's an estimate, not an exact measurement — current weights are seeded from published academic datasets rather than PrivacyTestLab's own live telemetry, and signals are summed assuming independence, which is a simplification. Both limitations are documented and tracked publicly.
What data does PrivacyTestLab use to calculate fingerprint scores?
Frequency estimates are currently based on published fingerprinting research (the AmIUnique dataset and EFF Panopticlick methodology), not on data collected from PrivacyTestLab's own visitors.
Why do most browser fingerprints score as "highly unique"?
Research consistently finds that combining more than a dozen browser signals — even individually common ones — usually produces a combination unique among billions of users. This is a property of combinatorics, not a flaw in the scoring method.
Sources
- Laperdrix, P., Rudametkin, W., Baudry, B. "Beauty and the Beast: Diverting Modern Web Browsers to Build Unique Browser Fingerprints." IEEE Symposium on Security and Privacy, 2016. (amiunique.org)
- Electronic Frontier Foundation. "Cover Your Tracks" (formerly Panopticlick) methodology. (coveryourtracks.eff.org)
See your own score.