Methodology

This document describes the technical methodology behind Panopticlick's browser fingerprinting analysis. We use information theory and statistical analysis to measure how unique your browser is compared to others.

Disclosure: every number Panopticlick shows you is a modeled estimate, not a live market measurement. Here is exactly where each figure comes from:

• Entropy values are computed against a hand-curated probability table of browser attribute distributions (screen resolution, platform, timezone, CPU cores, device memory, and more). These priors are derived from published fingerprinting research—EFF's original Panopticlick study (Eckersley, 2010), INRIA's AmIUnique project (Laperdrix et al., 2016), and Princeton WebTAP's 1-million-site measurement (Englehardt & Narayanan, 2016)—not from traffic measured on this site.
• RTB valuations come from a modeled simulation: six fictional DSP (Demand-Side Platform) profiles mirror the structure of real DSP categories, base CPM rates follow published industry ranges (roughly $1–15 CPM depending on vertical), and each simulated bid adds ±10% random variance to imitate auction dynamics. No real bid request is sent, and no real auction takes place.
• Uniqueness ("1 in N") is derived as 2^entropy from the summed entropy of individual components. This assumes components are statistically independent; in reality they correlate (platform and fonts, for example), so the true figure is an upper bound.

We publish these limitations deliberately: a privacy tool that inflated its own numbers would be part of the machinery it claims to expose.

We collect fingerprinting signals from multiple sources:

3.1 Canvas Fingerprint

We render text and shapes on an HTML5 canvas element and extract the pixel data. Differences in GPU, drivers, and rendering engines create unique patterns.

3.2 WebGL Fingerprint

We query WebGL renderer information and render a 3D scene. The combination of GPU vendor, renderer string, and rendering output creates a unique signature.

3.3 Audio Fingerprint

We create an audio oscillator and measure the processed output. Different audio stacks produce subtly different results due to floating-point precision differences.

3.4 Font Enumeration

We test for the presence of ~140 fonts by rendering text and measuring dimensions. The set of installed fonts is highly distinctive.

3.5 Additional Signals

• Screen: Resolution, color depth, pixel ratio
• Timezone: IANA timezone, UTC offset
• Navigator: User agent, platform, languages, hardware concurrency
• Capabilities: Touch support, WebGL extensions, codec support

We use Shannon entropy to measure the information content of each fingerprinting signal.

4.1 Information Theory Basis

Entropy (H) is calculated as:

Where p(x) is the probability of observing a particular value.

4.2 Practical Calculation

For each fingerprint component, we use a research-derived prior probability from the curated reference table described above. The following numbers are an illustrative calculation, not observations from Panopticlick visitors:

4.3 Component Weights

Different components have different entropy ranges:

We express uniqueness as "1 in N" where N = 2^entropy:

• 20 bits → 1 in 1,048,576 (one million)
• 30 bits → 1 in 1,073,741,824 (one billion)
• 40 bits → 1 in 1,099,511,627,776 (one trillion)

The current model often produces totals in the 25–45 bit range. That is a modeled output, not proof that a browser is globally unique; the component-independence assumption can overstate the “1 in N” figure.

We simulate Real-Time Bidding (RTB) auctions to estimate advertising value.

6.1 Persona Detection

Based on fingerprint signals, we infer demographic categories that advertisers target:

• Hardware: High-end device → affluent user
• Software: Developer tools → tech professional
• Behavior: Privacy tools → privacy-conscious
• Location: US timezone → US market (higher CPMs)

6.2 CPM Calculation

We simulate bids from fictional DSPs with different targeting criteria. The following are illustrative base-rate bands used by the simulation, not current bids or market quotes:

6.3 Annual Value Estimation

We estimate annual value based on typical browsing patterns:

We evaluate your browser's privacy protections:

7.1 Scoring Criteria

• Canvas blocking: +20 points
• WebGL protection: +15 points
• Tracker blocking: +15 points
• Fingerprint randomization: +20 points
• Ad blocking: +10 points
• Secure DNS: +10 points
• WebRTC protection: +10 points

7.2 Tier Classification

• Fortress (90-100): Maximum protection
• Hardened (70-89): Strong protection
• Protected (50-69): Moderate protection
• Basic (25-49): Minimal protection
• Exposed (0-24): No protection

Our methodology has known limitations:

• Prior-model bias: Published reference distributions may not represent today's full browser population
• Temporal changes: Fingerprints change over time as browsers update and users install/remove software
• Model boundary: The local collectors cannot reproduce every server-side or cross-site tracking implementation
• RTB simulation: Actual advertising prices vary significantly based on context, time, and advertiser demand

Our methodology is based on academic research:

• Eckersley, P. (2010). “How Unique Is Your Web Browser?” Proceedings of the Privacy Enhancing Technologies Symposium. DOI: 10.1007/978-3-642-14527-8_1
• Laperdrix, P., et al. (2016). “Beauty and the Beast: Diverting modern web browsers to build unique browser fingerprints.” IEEE Symposium on Security and Privacy. DOI: 10.1109/SP.2016.57
• Mowery, K. & Shacham, H. (2012). “Pixel Perfect: Fingerprinting Canvas in HTML5.” W2SP
• Englehardt, S. & Narayanan, A. (2016). “Online Tracking: A 1-million-site Measurement and Analysis.” ACM CCS. DOI: 10.1145/2976749.2978313

Our fingerprinting SDK and valuation engine are open source. You can review the code and methodology: