Cover Your Tracks: What Your Uniqueness Score Doesn't Prove

Run EFF's Cover Your Tracks and it hands back a single, alarming-sounding line: your browser has a fingerprint unique among however many thousand it has tested recently. It's tempting to read that as a grade — a "you failed" or "you passed" on your overall privacy setup. It isn't one. That figure answers exactly one question — how identifiable your combination of browser signals is — and that's a narrower question than "am I safe," "is my browser lying," or "am I protected from tracking" in general. Treating the uniqueness figure as an answer to any of those bigger questions is the most common way people misread their own result.

Key Takeaways

• The "1 in X" figure measures uniqueness — how many other tested browsers share your exact combination of signals — not safety, not honesty, and not overall protection.
• Cover Your Tracks does report other results next to that number, but they are separate pass/fail tracker-blocking tests; they are not inputs to the uniqueness figure.
• The "1 in X" figure is relative to the tool's own recent sample, not the entire internet; the math behind it is information-theory entropy, in bits, and bits from roughly independent signals add up.
• A rare fingerprint is not the same as a spoofed one, and a common fingerprint is not the same as a private one — uniqueness and coherence are different axes entirely.
• Anti-fingerprinting extensions can make your uniqueness score worse, not better, if the extension itself becomes the rare, identifying signal.
• The tool only sees what JavaScript can read inside your browser — it has no way to compare that against the IP address your connection actually arrived from.

What "1 in X" Actually Means

Cover Your Tracks (the successor to EFF's original Panopticlick study) collects a set of browser-readable signals — things like your user-agent string, installed fonts, canvas and WebGL output, screen geometry — and checks how many of its other recent visitors reported the exact same combination. If nobody else in that recent window matches you, it reports your fingerprint as unique; if a few hundred others match, it reports that group size instead.

Other results sit next to that number on the same page, and separating them from it is half the battle. Alongside the fingerprint, Cover Your Tracks runs pass/fail tracker-blocking tests — whether a simulated tracking ad is blocked, whether an invisible tracking beacon is blocked, and whether your browser unblocks domains that promise to honor Do Not Track — with a "partial protection" state when those trackers load but their cookies are blocked. EFF documents the methodology for each. Those tests grade your content blocker; they are not inputs to the "1 in X" figure, which is computed from the fingerprinting signals alone. Reading the page as one combined grade is where the confusion starts.

The math underneath the uniqueness figure is entropy, measured in bits: a signal is only informative if it's surprising, and roughly independent signals combine by adding their bit counts. EFF's own primer on the underlying math is a good short read on why this works the way it does: A Primer on Information Theory and Privacy. We cover the mechanics — how individual signals sum into a single figure, and what a comfortable anonymity-set size looks like — in Browser Fingerprint Entropy and Anonymity Sets Explained.

The detail that trips people up is the denominator. "1 in X" is relative to the population Cover Your Tracks has measured recently, not to every browser on Earth. People who go looking for a fingerprint tester skew more privacy-conscious than the general web, and the tool's sample window is finite. Your true rarity against the whole internet is unknowable from any single tool's number — but the figure is still useful as a relative signal, and it's an honest one for what it actually measures.

The Misreading: Rare Isn't Suspicious, Common Isn't Safe

The single biggest misunderstanding is collapsing uniqueness into a verdict about trustworthiness. It doesn't work that way in either direction.

A completely stock browser — no extensions, default settings, whatever fonts shipped with the OS — can still land on a rare, high-end GPU, a regional keyboard layout, or an uncommon monitor resolution, and score as highly unique while being entirely genuine. Nothing about that browser is tampered with; it's just an uncommon combination of ordinary, honestly-reported values. High uniqueness on Cover Your Tracks is a privacy concern — you're identifiable across visits — not a fraud or spoofing signal.

That's a different axis from coherence: whether a browser's signals agree with each other and with how a real implementation behaves. CreepJS's lie-detection model is built specifically to catch that kind of contradiction — a user-agent claiming one browser next to a rendering signature that could only come from another. A browser can be perfectly coherent and highly unique at the same time, or perfectly common-looking and still fail a coherence check. Why Fingerprint Test Tools Disagree About You walks through this split in more detail, including a third category — vendor anonymity composites — that blends uniqueness, coherence, and undisclosed heuristics into one proprietary number that isn't directly comparable to either.

The reverse mistake is just as common: assuming a common-looking result means you're safe from tracking. A shared fingerprint only removes one tracking vector — uniqueness-based identification. Cookies, login state, and account-level tracking don't care how unique your canvas hash is, and none of that shows up in the uniqueness figure at all.

The Counter-Intuitive Result: Extensions Can Make You Worse

Here's the part that surprises people who install a privacy extension expecting their number to improve: it sometimes gets worse instead.

Most anti-fingerprinting extensions work by spoofing or randomizing a handful of signals — a fake canvas hash, a jittered WebGL parameter, a blocked font enumeration. If the presence of that spoofing is itself detectable — and it very often is, since only a small minority of visitors run that specific extension — then "this browser has an obviously modified canvas API" becomes a rare, identifying signal in its own right. You can walk away from an extension install more fingerprintable than you started, not less. Our browser extension privacy piece covers the broader trust question extensions raise beyond fingerprinting alone.

The alternative approach is uniformity rather than randomization: instead of hiding your value, make everyone's value the same. That's the design behind Firefox's privacy.resistFingerprinting, always on in Tor Browser — see resistFingerprinting Explained for exactly what it spoofs and why it targets the crowd size directly rather than trying to disguise any one signal. It works because it's shared across a large, coordinated population — the crowd is the defense. A single user running an idiosyncratic randomization scheme has no crowd behind them, which is exactly why two setups that both call themselves anti-fingerprinting can land on opposite sides of the same uniqueness score.

What the Score Can't See: Anything Outside the Browser

Every signal Cover Your Tracks reads comes from inside your browser's own JavaScript environment. That gives it a hard structural limit: it has no way to compare what your browser claims against what a server actually observed about your connection.

Intl.DateTimeFormat().resolvedOptions().timeZone tells a script what timezone your OS is configured to report — nothing about the route your traffic took to get there. A browser can report a perfectly plausible, internally consistent timezone and language pair while connecting through a VPN exit node on another continent, and a browser-only fingerprint test has no path to notice. Catching that requires a second, server-side observation: comparing the IP a connection actually arrived from against what the browser claims. Timezone and Locale Leaks: When Your Browser Contradicts Your IP covers that mechanism in full, and BrowserInsight's VPN and proxy check is built specifically around the network-side half a browser-only score can't supply.

None of this is a flaw in Cover Your Tracks — it's simply outside the scope of what a page's own JavaScript is able to observe. It's worth knowing the boundary exists so a clean uniqueness result doesn't get read as a clean bill of health for everything else about your setup.

Reading Your Result Without Overreading It

A Cover Your Tracks result is genuinely useful for the one question it's built to answer: how identifiable is your current combination of browser-readable signals, relative to what the tool has recently seen. Run BrowserInsight's fingerprint check alongside it to see the individual signals behind that number laid out separately — canvas, WebGL, fonts, navigator properties — rather than collapsed into one figure, and pair both with the VPN and proxy check for the network-side comparison neither browser-only tool can make on its own.

Frequently Asked Questions

Does a high Cover Your Tracks score mean my browser is fake or compromised?

No. It means your combination of signals is uncommon among the browsers the tool has recently tested — a privacy concern about trackability, not a signal that anything is spoofed or broken. A completely genuine, unmodified browser with an unusual hardware or font combination can score as highly unique.

If Cover Your Tracks says my browser blocks trackers, does that fix my uniqueness score?

No — those are separate results. The tracker-blocking tests check whether a simulated ad, an invisible beacon, and Do Not Track-honoring domains are handled by your blocker. The "1 in X" figure is computed from your fingerprinting signals alone. A browser can pass every blocking test and still be highly unique, because blocking a tracker's request doesn't change what your canvas, fonts, and screen geometry report to a page that does load.

Why did my uniqueness score get worse after installing a privacy extension?

Because the extension's spoofing or randomization can itself become a rare, detectable pattern, and rarity is exactly what the score measures. Uniformity-based defenses like Firefox's resistFingerprinting avoid this by making a large population report identical values, rather than making one browser's values different from everyone else's.

Can two runs of Cover Your Tracks give different numbers for the same browser?

Yes, because the "1 in X" figure is relative to whatever population the tool has measured recently, and that sample shifts over time. The result reflects your rarity against that specific sample, not a fixed, universal rarity figure.

Does Cover Your Tracks check for VPN or IP-based tracking?

No. It only reads signals available to JavaScript inside your browser, which has no way to see the IP address a server observed your connection arrive from. That comparison — timezone or locale against IP geolocation — needs a server-side tool like a VPN and proxy check.

Recommended Reading

• Browser Fingerprint Entropy and Anonymity Sets Explained
• Why Fingerprint Test Tools Disagree About You
• CreepJS Explained: How Fingerprint Lie-Detection Catches Spoofing
• resistFingerprinting Explained: Firefox and Tor Browser
• Browser Extension Privacy Risks: Your Add-ons May Be Watching You
• Timezone and Locale Leaks: When Your Browser Contradicts Your IP