Your Browser Is a Witness That Never Stops Talking
Clearing cookies can remove one kind of identifier, but it does not make every browser look the same. A site can still observe the language you prefer, the timezone your clock reports, the dimensions and pixel density of your display, the graphics features exposed by WebGL, the way a canvas image is rendered, and many other details needed to make modern web applications work. A browser fingerprint is the attempt to combine those ordinary details into a signature.
No single field needs to be extraordinary. A common screen size may narrow the population only slightly. A common browser version may do the same. But the intersection of screen, browser build, operating system, fonts, graphics renderer, locale, hardware class, privacy settings, and rendering outputs can be much rarer than any individual value. That is why the dossier above presents exhibits together: the tracking value comes from the combination.
Fingerprinting also behaves differently from a cookie. A cookie is a value a website writes and later reads. A fingerprint is reconstructed from observations. Deleting storage does not necessarily change the observations, and private browsing does not guarantee that the browser reports a different hardware or rendering profile. Some signals change frequently, while others remain stable for weeks or months. Trackers can use that mix to recognize a returning browser with varying levels of confidence.
| Signal | Why it exists | Why it can identify |
|---|---|---|
| Canvas / WebGL | Draw graphics and expose GPU capabilities | Rendering can vary by GPU, driver, OS, and browser |
| Fonts | Render documents and application interfaces | Installed sets reflect software and system history |
| Screen / hardware | Adapt layout and workload to the device | The combined device class can be uncommon |
| Locale / timezone | Format language, dates, and local time | They narrow geography and user configuration |
| Privacy signals | Express blocking or preference choices | Unusual combinations can themselves add distinction |
What the Entropy Number Does—and Does Not—Say
Panopticlick summarizes distinctiveness in bits of entropy. In information theory, one bit represents a doubling of the number of equally likely possibilities. Roughly speaking, a result with more bits would require a larger population before another browser with the same modeled profile is expected to appear. The relationship is exponential, which is why a small numerical increase can imply a much larger anonymity set reduction.
The number is an estimate, not a census. This site does not maintain a complete live database of every browser on the internet. It compares observed attributes with probability assumptions derived from fingerprinting research and known distributions, then combines them using a documented model. Attributes are not perfectly independent, so a model can overstate or understate real-world rarity. A laptop model, operating system, screen, and GPU may occur together more often than independent multiplication would suggest.
Treat the score as a diagnostic comparison: useful for seeing which signals contribute most, useful for comparing the same browser before and after a change, but not proof that one specific company has identified you. Repeatability matters as much as rarity. A highly unusual value that changes every page load may be less useful to a tracker than a moderately distinctive value that remains stable.
The Auction Is a Model, Not a Secret Receipt
On advertising-supported pages, real-time bidding can let advertising systems evaluate an impression in a fraction of a second. A publisher or its technology partners describe an opportunity to show an ad; demand-side platforms compare the available context and audience signals with active campaigns; eligible buyers return bids; and an exchange chooses an outcome. The exact participants, fields, legal basis, and auction design vary widely.
The auction on this site is educational. It does not contact advertisers, place an ad, or observe a live clearing price. The valuation engine assigns fictional bidder profiles baseline CPMs and adjusts them with modeled device, geography, persona, and trackability factors. A small variation makes the display behave like an auction rather than a fixed lookup. That is why the result should be read as a scenario: “signals like these may change how an impression is valued,” not “this is the exact amount a named advertiser paid for me.”
CPM means cost per thousand impressions. A $5 CPM is therefore half a cent per impression before fees and other commercial arrangements. It is not the sale price of your identity and it is not money owed to you. The annual figure multiplies assumptions about impressions over time to make a tiny per-impression value easier to grasp. Real prices move with the publisher, campaign goal, location, season, available consent, audience demand, fraud controls, ad format, and market conditions that this demonstration cannot know.
Why “More Random” Is Not Always More Private
Fingerprint defenses generally follow two strategies. Standardization makes many browsers report the same value. Randomization changes a value so that a stable signature is harder to recover. Both can work, and both can fail when applied incompletely. If only one obscure attribute is randomized while every other signal remains stable, the unusual behavior may make a browser stand out. If a protection changes values consistently per site, it may prevent cross-site linking while still allowing a site to recognize repeat visits.
Browser choice matters because the browser controls what websites can ask and what answers APIs return. Extensions can block known scripts and network requests, but every extension also changes the environment and may add detectable behavior. Strict blocking can break pages. Permissive settings can preserve compatibility while exposing more surface. There is no universal configuration that maximizes privacy, anonymity, usability, and compatibility at the same time.
The most useful defense workflow is experimental. Save the current report, change one meaningful setting, restart the browser if required, and run the test again. Look for fewer high-entropy signals, a larger modeled anonymity set, and more resistance without relying on a single headline score. Then test ordinary sites you depend on. A defense you immediately disable because it breaks essential work is not a durable defense.
A Practical Privacy Baseline
- Keep the browser current. Security patches matter more than chasing a theoretically perfect fingerprint while running known vulnerabilities.
- Use built-in tracking protection. Start with the browser’s documented privacy controls before stacking extensions whose interactions you cannot explain.
- Block unnecessary third-party requests. A reputable content blocker reduces contact with many advertising and tracking endpoints before they can execute code.
- Separate contexts that should not be linked. Profiles, containers, or purpose-specific browsers can reduce accidental joins between work, personal, and sensitive activity.
- Express privacy choices. Global Privacy Control can communicate a preference where supported, though a signal is not the same as technical blocking.
- Retest after changes. Browser updates, extensions, permissions, display changes, and hardware can alter the result. A privacy posture is a maintained system, not a one-time grade.
Network privacy and browser fingerprint privacy are related but different. A VPN can change the public IP address visible to a site, yet the browser may still expose a recognizable combination of rendering and hardware signals. Conversely, a standardized browser fingerprint does not hide the IP connection. Evaluate both layers, and be skeptical of any product that claims one switch makes you anonymous.
Frequently Asked Questions
Is my browser fingerprint unique?
It may be distinctive enough to narrow you to a small modeled group, but this test cannot prove global uniqueness. It estimates rarity from the signals available in your browser and the probability assumptions described in the methodology. The result is most useful for comparing configurations and finding the attributes that contribute the most identifying information.
Does Panopticlick store my fingerprint?
Collection and analysis can run locally. Server storage is optional and requires consent in the scan controls. If you decline, the report remains on this device so the single-page experience can display and reopen it. Privacy controls are available for reviewing or deleting data associated with an authorized session.
What happens during the browser fingerprint test?
The scanner asks supported browser APIs for hardware, software, rendering, capability, and privacy signals. It records which collectors finish, builds a local dossier, estimates entropy, runs an educational advertising auction model, and scores detectable defenses. Unsupported or failed collectors are not silently presented as successful evidence.
Treat the report as the start of an investigation
Change one defense, scan again, and compare the evidence—not just the grade. Privacy improves when the browser exposes less stable, less linkable information.
Return to the investigation ↑