Learn how entropy measures fingerprint uniqueness, how bits sum across signals, and what your anonymity set really means for tracking.
Key Takeaways
- Entropy measures surprise. A signal is only useful for tracking if its value is rare — common values add almost no identifying power.
- Entropy adds up. Roughly independent signals combine by adding their bit counts, which is why a handful of ordinary-looking attributes can still make you unique.
- ~33 bits ≈ unique on Earth, because 2^33 is close to the world's population — that threshold is a population-size approximation, not a hard law.
- Your anonymity set is the "1-in-X" crowd that shares your current fingerprint — bigger is safer, and it shrinks every time a script reads one more rare attribute.
- Mobile isn't automatically safer. Mass-produced phones flatten canvas and WebGL entropy, but add touch and sensor signals desktops lack — the mix changes more than the total does.
What Entropy Actually Measures
"Entropy" sounds abstract, but the idea behind it is simple: a signal is only informative if it's surprising. If every visitor to a site uses the same screen resolution, that resolution tells a tracker nothing about who you are. If almost nobody shares your combination of installed fonts, that same attribute narrows the crowd down to a near-certainty of one.
Formally, the surprisal of an observed value is -log2(p) bits, where p is the probability of that value occurring. A value shared by half of all browsers carries 1 bit of surprisal (-log2(0.5) = 1). A value shared by only 1 in 1,024 browsers carries 10 bits (-log2(1/1024) = 10). The rarer the value, the more bits it contributes — and bits are what a tracker is really collecting, one attribute at a time.
This is why raw attribute count is the wrong way to think about fingerprint risk. Ten common attributes can add up to less identifying power than one rare one. What matters is how surprising each value is, not how many values exist.
How Entropy Sums Across Signals
Individual signals rarely determine identity on their own — see the full list of signals a fingerprint script can read, from user-agent and timezone to canvas and WebGL output. Their power comes from combination. Because probabilities multiply for roughly independent events, and log2 turns multiplication into addition, entropy from separate signals simply adds: total bits ≈ sum of each signal's individual bits.
That additive property is the whole mechanism behind fingerprinting. A canvas hash or WebGL renderer string can each contribute double-digit bits on their own, because they encode GPU model, driver version, and OS rendering quirks all at once. But the boring-looking attributes carry bits too, and a script reads all of them in the same pass. None of these signals is remarkable in isolation — the danger is purely arithmetic.
The EFF's original Panopticlick study measured this directly: across roughly half a million browsers, the collected fingerprint distribution carried about 18.1 bits of entropy, meaning a random browser's fingerprint was shared by only about 1 in 286,777 others in that sample. In that dataset 83.6% of browsers had an instantaneously unique fingerprint — 94.2% among visitors running Flash or Java. The per-attribute breakdown showed where the bits came from: the user-agent string alone carried about 10 bits, the list of system fonts about 13.9, and the browser plugin list about 15.4, while a signal as coarse as whether cookies are enabled carried barely 0.35. See the EFF's summary of the Panopticlick results for the original numbers.
Two things have changed since 2010, and they pull in opposite directions. The richest signal in that dataset — plugin enumeration — is effectively dead now that NPAPI plugins are gone, and the user-agent string has been deliberately frozen and trimmed (see User-Agent Reduction). But browsers have also gained surfaces Panopticlick never tested — audio, media devices, WebGL, canvas, and more — so a script combining today's full attribute set still reaches entropy in the same range or higher.
One caveat matters more than any individual number: bits only add cleanly when the signals are genuinely independent, and real signals are not. An Android user-agent already predicts most of the font list, the screen geometry, and the GPU string; learning one tells you much of the rest. That is why Panopticlick's individual attribute entropies sum to more than 50 bits while the measured joint entropy of the whole fingerprint was 18.1. Adding every signal's bits together gives you an upper bound, not an estimate — the real figure is always lower, and any tool that quotes a total should be read with that in mind.
The Anonymity Set: Thinking in "1-in-X"
Entropy is a useful number for researchers, but the more intuitive framing is the anonymity set: the group of people who currently look identical to you from a tracker's point of view. If your fingerprint's entropy is b bits, your anonymity set is roughly 1 in 2^b — at 10 bits, you share your exact combination with about 1 in 1,024 people; at 20 bits, about 1 in a million; at 30 bits, about 1 in a billion.
This is why ~33 bits is the informal threshold for "unique on Earth." With roughly 8 billion people alive, and 2^33 ≈ 8.6 billion, a fingerprint carrying 33 bits of entropy has an anonymity set of about one — you, and essentially nobody else, even before accounting for how many of those 8 billion people even browse the web. It's worth being precise about what this threshold is: an approximation tied to today's world population, not a fixed constant. As global population grows, the bit count needed to reach "unique on Earth" creeps up by a fraction of a bit; it's a moving target, just a very slowly moving one.
A common combination — ordinary user-agent, common screen size, default fonts, standard timezone — might land you in an anonymity set of thousands or millions, which is a comfortable place to be. Add a rare font, an unusual WebGL renderer string, and a distinctive audio stack, and that set can collapse toward one within a handful of extra signals — because, again, the bits simply add.
Why a Rare Configuration Hurts You
The practical implication is counterintuitive to a lot of people: standing out is the problem, not being tracked by any single attribute. A gaming laptop with a distinctive high-end GPU, a rare regional keyboard layout, and a niche browser extension installed doesn't need any one of those things to be secret — the combination is what shrinks the anonymity set. This is also why privacy tools built on randomization carry a subtle risk: if being randomized is itself detectable, "this browser has an obviously fake canvas value" can become a rare, identifying attribute of its own — see Canvas Noise vs Real Hash: Why Randomization Backfires for how that trade-off plays out in practice. Tools built on uniformity — standardizing values across an entire user population, as Tor Browser and Firefox's resistFingerprinting do — target the anonymity set directly, by keeping everyone's reported bits identical rather than trying to hide any one of them.
Mobile vs Desktop: Same Math, Different Numbers
The entropy framework is universal, but the numbers it produces differ sharply by platform. Desktop PCs come in an enormous variety of GPU, driver, monitor, and font combinations, so canvas and WebGL signals tend to carry high entropy there. Mass-produced phone hardware flattens exactly those signals — millions of identical devices render canvas and WebGL output the same way, shrinking their contribution to your total bit count. But mobile devices add signals desktops mostly lack — screen geometry quirks, touch-point counts, and motion sensors — which partially offsets the flattening. Net effect: a phone's anonymity set isn't automatically larger than a desktop's, it's just built from a different mix of high- and low-entropy signals. See Mobile Browser Fingerprinting for how Android and iOS get tracked specifically.
How to Check Your Own Anonymity Set
Entropy numbers are hard to reason about in the abstract — the fastest way to understand yours is to measure it. BrowserInsight's fingerprint check runs entirely client-side and estimates how unique your current setup is, breaking down which signals contribute the most bits. EFF's Cover Your Tracks tool (the successor to Panopticlick) reports a similar 1-in-X figure against its own aggregated dataset. Running both, then comparing before and after enabling a privacy browser or extension, is the clearest way to see whether a given defense actually grows your anonymity set — because, as the sections above show, the answer depends entirely on which signals it changes and by how much.
Frequently Asked Questions
Is a higher entropy number always worse?
For your own privacy, yes — more bits means a smaller anonymity set and a more identifiable browser. Entropy is a property of your specific combination of values, not a fixed score; it changes if you switch browsers, update fonts, or enable a defense.
Does deleting cookies reduce my fingerprint entropy?
No. Entropy comes from device and browser characteristics — GPU, fonts, rendering quirks — none of which are stored as cookies. Clearing cookies has zero effect on the bits a fingerprinting script can read; see the full fingerprinting guide for why fingerprints survive data clearing when cookies don't.
Can I have zero entropy — a fingerprint that's completely anonymous?
Not on the open web, but you can get close. Tools that standardize your values to match a large population (Tor Browser, Firefox's resistFingerprinting) don't hide the signals — they make everyone report the same ones, so those attributes contribute close to zero bits. Whatever entropy remains comes from what they can't standardize, such as network-level and timing behaviour. That shared baseline is the practical ceiling for anonymity-set size while still browsing normally.
Why do sources cite different entropy numbers for the "same" fingerprint?
Entropy is measured against a specific dataset. EFF's Panopticlick study measured entropy against the browsers that visited its own site in 2010; a script running on a different site today, with a different visitor population and a different attribute list, will compute a different number for the same physical device. The bits are dataset-relative, not absolute.
Recommended Reading
- Browser Fingerprinting Explained: How to Protect Your Privacy
- Canvas Fingerprint Detection: How Websites Identify Your Device
- WebGL Fingerprinting Deep Dive: What Your GPU Reveals
- Canvas Noise vs Real Hash: Why Randomization Backfires
- Mobile Browser Fingerprinting: How Android and iOS Get Tracked
- Fingerprint Consistency: Why Mismatched Signals Get You Flagged
