CreepJS, entropy checkers, and vendor anonymity scores can call the same browser three different things, because they measure three different quantities.
Run your browser through two fingerprint testers back to back and you can get two answers that look flatly contradictory. One says your fingerprint is "1 in 400,000" — a phrasing that sounds reassuring, but which actually means nobody else in that tool's sample looks like you. Another gives you a trust score of 62%, flagged for inconsistencies. A third calls you "highly unique" and stops there, no explanation. None of them are wrong. They aren't measuring the same thing, and the word "score" is doing a lot of work to hide that.
Key Takeaways
- Fingerprint testers report three genuinely different quantities under the same word "score": uniqueness (how rare your combination is), coherence (whether your signals contradict each other), and vendor anonymity composites (a weighted blend a vendor defines privately).
- Uniqueness is an information-theory measurement, not a verdict — a high number means you're identifiable, not that anything about your browser is broken or fake.
- Coherence is closer to lie-detection: a perfectly coherent browser can still be highly unique, and a highly anonymous-looking browser can still fail coherence checks.
- Hardening your browser can push these two numbers in opposite directions at once — that's the single most counter-intuitive fact readers of a fingerprint report need to know.
- Even two uniqueness checkers can disagree with each other, because each computes rarity against its own self-selected visitor population — a rarity figure means "rare among this tool's visitors," never "rare on the internet."
- A test that only reads browser APIs cannot compare your timezone against where your IP actually resolves. That comparison needs a server that saw your connection arrive, which puts it outside every browser-only score.
Three Different Questions Wearing One Word
"Score" implies a single ruler. In practice, every fingerprint test you'll encounter is answering one of three separate questions, and mixing them up is why two tabs open to two different testers can feel like they're talking about two different browsers.
Uniqueness asks: out of everyone who's ever been measured, how many people share your exact combination of signals? This is a population-statistics question, answered with information theory — read Browser Fingerprint Entropy and Anonymity Sets Explained for the full mechanics of how individual signal "bits" combine into a single figure. The EFF's own primer on the underlying math is a good short read if you want the theory without the browser-specific framing: A Primer on Information Theory and Privacy.
Coherence asks a completely different question: do the signals your browser exposes plausibly come from one real device, or does something look patched? CreepJS's lie-detection model is the clearest public example — it doesn't care how rare your fingerprint is, only whether your properties agree with each other across multiple independent code paths. Fingerprint Consistency: Why Mismatched Signals Get You Flagged covers the same idea from a detection-system point of view: a user-agent claiming Safari next to a GPU renderer string that could only come from a Windows machine is a coherence failure, regardless of how common or rare either value is on its own.
Vendor anonymity composites are the third and least transparent category. Commercial fingerprinting products often publish a single percentage or letter grade meant to summarize "how trustworthy does this visitor look," blended from some mix of uniqueness, coherence signals, and proprietary heuristics the vendor doesn't disclose. There's no shared standard for how that blend is weighted — one vendor's 80% and another's 80% aren't measuring the same recipe, because each is free to define its own. Treat any single vendor number as that vendor's opinion, not a measurement in the sense the first two are.
What Each One Can and Cannot Tell You
Uniqueness tells you how findable you are across visits to sites that fingerprint you — it says nothing about whether your browser looks tampered with. A completely stock, unmodified browser with an unusual but genuine hardware and font combination can score as highly unique while being perfectly coherent. High uniqueness is a privacy problem (you're trackable), not a red flag for fraud systems.
One caveat here explains a great deal of the disagreement between two uniqueness checkers: the denominator is whatever population that particular tool has measured, and those populations are self-selected. People who deliberately seek out a fingerprint tester skew far more privacy-conscious than the web at large. A rarity figure therefore means "rare among this tool's visitors," not "rare on the internet" — so two entropy checkers can hand you two different numbers for the same unchanged browser while both report their own sample honestly.
Coherence tells you whether your signals hang together, and nothing about how rare the combination is. Firefox's privacy.resistFingerprinting — always on in Tor Browser — makes every user report the same standardized values, which pushes uniqueness down: a large, uniform crowd is the entire design goal. But those values are substituted rather than native, and a lie-detector that reaches the same property through several independent code paths can often tell, so a browser that reads as close to anonymous on a uniqueness test can still light up a coherence report. Coherence failures are what production fraud-scoring and bot-mitigation systems weigh most heavily, because an unmodified device rarely contradicts itself in that particular way. Rarely is the honest word: privacy features, managed enterprise configurations, and unusual or aging devices all generate genuine coherence complaints too, which is why a coherence flag is a lead worth investigating rather than a verdict.
Vendor composites tell you how one company's model currently weighs whatever inputs it uses, which can shift between product versions without you knowing it changed. They're useful as a rough gut-check from that one vendor's perspective, not as a portable number you can compare against a different tool's output or explain to someone else without also explaining which vendor produced it.
The Counter-Intuitive Part: Hardening Can Move Them in Opposite Directions
This is the detail that makes fingerprint reports genuinely confusing rather than just verbose: a single change to your browser can raise one number while lowering the other.
Installing an extension that spoofs or randomizes a handful of signals — a fake canvas hash, a jittered WebGL parameter — can lower your measured uniqueness on a given visit, because the value it reports that day may happen to be more common. But randomization is itself a pattern a coherence checker can catch: Canvas Noise vs Real Hash: Why Randomization Backfires covers why "this canvas value changes on every reload" is its own tell, distinct from and sometimes worse than a stable, unique value. The same browser gets more suspicious to a coherence checker at the exact moment it gets more common-looking to a uniqueness checker.
The reverse also happens. A browser that's completely stock — no extensions, default settings, whatever fonts shipped with the OS — tends to score very well on coherence, because nothing about it looks patched. But "completely stock" is also, for GPU model, installed font list, and screen geometry, often a distinctive combination in its own right, which can push uniqueness up rather than down. No single move reliably improves both numbers at once; a defense has to be evaluated against each measurement separately, because a testing session that only reports one of the two is showing you half the picture.
The Blind Spot Every Browser-Only Test Shares
Every tool discussed so far — uniqueness checkers, CreepJS, vendor composites — scores you from inside your browser, using what JavaScript can read from the browser's own APIs. That gives all of them the same structural blind spot: nothing in that API surface tells a script where its connection actually came out. Intl.DateTimeFormat().resolvedOptions().timeZone returns what the browser was configured to report; it says nothing about the route the request took, or about the IP a server saw on the other end.
That comparison — timezone and locale against IP geolocation — is one of the cheapest, most widely used signals a production detection stack runs, precisely because it sits outside the browser-attribute layer entirely. A browser can report a perfectly coherent, perfectly plausible timezone and language pair while sitting behind a VPN exit node in a completely different country, and no amount of additional probing inside that browser will surface the mismatch. Closing the gap takes a second, server-side observation: a lookup of the IP the connection actually arrived from, compared against what the browser claimed. BrowserInsight's VPN and proxy check is built around that network-side half, and the fingerprint check folds the same server-side location lookup into its consistency verdicts — which is exactly the ingredient a page scoring you purely on browser attributes cannot supply on its own.
Reading a Set of Results Without Chasing a Number
None of this is a guide to raising any of these scores — the three numbers exist because they answer different threat questions, not because one is the "real" one and the others are approximations of it. Which one to pay attention to depends on what you're actually worried about:
- Worried about being tracked and profiled across sites? Uniqueness is the relevant number — see Browser Fingerprint Entropy and Anonymity Sets Explained for how to read your anonymity set.
- Worried about looking automated or spoofed to a site you're interacting with? Coherence is what matters, and it's what tools like CreepJS and public pass/fail testers such as Sannysoft and CreepJS's public pages are built to surface.
- Evaluating a specific vendor's product because a site you run uses it? Their composite score is only meaningful in the context of that vendor's own documentation of what it weighs — treat it as their opinion, not a universal measurement.
A single number from a single tool was never going to answer all three questions at once. Run BrowserInsight's fingerprint check to see the underlying signals laid out individually — canvas, WebGL, fonts, TLS, navigator properties — next to the consistency verdicts they feed, instead of collapsed into one figure, and pair it with the VPN and proxy check for the network-side comparison a browser-only test can't make.
Frequently Asked Questions
Which fingerprint test tool gives the "correct" score?
None of them, because they're not competing to answer the same question. A uniqueness checker, a coherence checker like CreepJS, and a vendor's proprietary composite each measure something different; asking which is correct is like asking whether a thermometer or a barometer gives the "correct" weather reading.
If my uniqueness score is high, does that mean I look suspicious?
No. High uniqueness means you're identifiable across visits — a privacy concern — not that anything looks fake or tampered with. A stock, unmodified browser with an unusual but entirely genuine hardware combination can be both highly unique and perfectly coherent at the same time.
Can I improve both my uniqueness and coherence scores with one change?
Not reliably. The two measure different things, and a change that helps one — such as randomizing a signal to lower your apparent rarity — can simultaneously look like a coherence failure to the other, because the randomization itself becomes a detectable pattern. Evaluate any change against both measurements separately.
Why doesn't any fingerprint test catch a VPN with a mismatched timezone?
Because that check requires comparing your browser's reported timezone against the IP a server actually saw your connection arrive from — and no browser API exposes that to a page's own JavaScript. It takes a server-side observation, which is why it belongs to network tools like a VPN/proxy check rather than to any test that scores you purely on browser attributes.
Recommended Reading
- Browser Fingerprint Entropy and Anonymity Sets Explained
- CreepJS Explained: How Fingerprint Lie-Detection Catches Spoofing
- Bot Detection Test Tools: Sannysoft and CreepJS Explained
- Fingerprint Consistency: Why Mismatched Signals Get You Flagged
- Timezone and Locale Leaks: When Your Browser Contradicts Your IP
