Your browser reports a screen resolution, a time zone, a language, a list of fonts. Individually, every one of those values is shared with millions of other people — none of them identifies you. Yet combine enough of them and the result is often unique among billions of devices. That gap between "each signal is common" and "the combination is one of a kind" is the heart of browser fingerprinting, and it's governed by a measurable quantity: entropy. This guide explains exactly what makes a fingerprint unique, which signals actually carry the identifying information, why the math works so brutally against you, and why hardening your browser can make you easier to track rather than harder.
Uniqueness is the entire point
A fingerprint is only useful to a tracker if it's rare. If your fingerprint were shared with ten million other people, knowing it would tell a tracker almost nothing about who you are — you'd be indistinguishable from a crowd. Fingerprinting works precisely because most fingerprints turn out to be rare, and a large share are outright unique.
So the question "what makes a fingerprint unique?" isn't really about the fingerprint at all. It's about you versus everyone else: how unusual your particular combination of device, software, and settings happens to be relative to the rest of the population. Two people with genuinely identical configurations have identical fingerprints and are, to a fingerprinter, the same person. For the mechanics of how these signals get collected and hashed in the first place, see our explainer on how browser fingerprinting works — this article is about what happens to the numbers afterwards.
Entropy: measuring uniqueness in bits
Privacy researchers measure identifying information in bits of entropy. The definition is elegantly simple: one bit of entropy is any piece of information that cuts the candidate population in half.
Learning that someone's browser reports a European time zone might eliminate three quarters of the world's users — roughly two bits. Learning their exact font list might eliminate 99.7% of the remainder — around eight bits. Each bit you add halves what's left, which means identifying power grows exponentially, not additively, as signals accumulate.
The critical number is 33 bits. There are roughly 8 billion people on earth, and 233 is about 8.6 billion — so 33 bits of entropy is, in principle, enough to single out one individual on the planet. In practice you need far fewer, because a tracker isn't distinguishing you from all humanity but from the much smaller pool of people who visit their site.
Why 33 bits is less than it sounds
Thirty-three bits sounds like a lot until you realise canvas rendering alone can contribute eight or more, fonts another eight, and the GPU string several more. Three or four high-entropy signals get most of the way there — which is why fingerprints are so often unique despite being built from ordinary-looking values.
The anonymity set: how many people look like you
The flip side of entropy is your anonymity set — the group of people who share your exact fingerprint. A large anonymity set means safety: if 50,000 users produce the same fingerprint, that fingerprint can't identify any of them. An anonymity set of one means you're identified.
This reframing matters because it changes what "good privacy" means. You are not trying to have no fingerprint, which is impossible — every browser must expose some properties to function. You're trying to have a fingerprint that lots of other people also have. Privacy here is a crowd, not a cloak.
Which signals carry the most entropy
Not all signals are equal. A handful do nearly all the identifying work while the rest contribute almost nothing. Approximate entropy values from published research look roughly like this:
| Signal | Approx. entropy | Why it varies so much |
|---|---|---|
| Font list | ~8 bits | Installed software, OS version, language packs |
| Canvas hash | ~8 bits | GPU, drivers, OS text rendering, anti-aliasing |
| WebGL / GPU string | ~6–7 bits | Exact graphics hardware and driver version |
| User agent | ~5–7 bits | Browser, version, platform (shrinking as browsers reduce it) |
| Screen resolution | ~4–5 bits | Display size, scaling, available area |
| Time zone | ~2–3 bits | Only ~24 zones, unevenly populated |
| Language | ~1–2 bits | Heavily concentrated in a few common values |
Treat these numbers as directional
Published entropy figures vary considerably between studies because they depend entirely on the population sampled — a privacy-tool user base looks very different from general web traffic. Browsers have also actively reduced some signals in recent years, notably freezing the user agent. Use the ranking, not the decimals.
Why canvas and WebGL dominate
Canvas and WebGL deserve special attention because they don't report a setting — they measure your hardware's actual behaviour, which is far more variable than any configuration value.
When a site asks your browser to draw text and shapes to a hidden canvas and read back the pixels, the exact output depends on your GPU model, your graphics driver version, your operating system's text-rendering engine, sub-pixel anti-aliasing settings, and installed font rasterisation. Two machines can be identical in every reported setting and still produce different canvas hashes because their drivers differ by a point release.
That's the key property: canvas and WebGL capture hardware and driver diversity, which is enormous and which users have essentially no visibility into. You can change your time zone; you cannot easily change how your GPU rasterises a curve.
Uniqueness comes from combination, not any single value
It's worth making the arithmetic explicit, because it's where intuition fails. Suppose you have five signals, each of which only narrows you to one in ten people — individually unremarkable. Combined, they narrow you to one in 105, or one in 100,000.
Add two more modest signals at one in ten each and you're at one in ten million. None of those seven values is unusual on its own; anyone looking at any single one would find it completely ordinary. Together they've isolated you from a country-sized population. This is why "but everyone has a 1920×1080 screen" is not the reassurance people think it is — the screen isn't identifying you, the combination is.
The correlation caveat
Signals aren't fully independent, so you can't simply add all their entropy values together. Someone running a particular OS version is more likely to have a specific font set and a specific rendering stack, so those signals overlap. Real-world combined entropy is lower than the naive sum — but still more than enough to isolate most users.
The privacy paradox: hardening can backfire
Here is the most counterintuitive result in the entire field, and the one that trips up privacy-conscious users most often: measures intended to protect you can make you more identifiable.
Install an obscure anti-fingerprinting extension that spoofs your user agent to something unusual, disable a handful of APIs, add a rare font, and set your browser to a language nobody else in your region uses — and you have not hidden yourself. You have constructed a configuration that almost nobody else on earth shares. Your anonymity set has shrunk from thousands to approximately one.
The same trap catches people who add many extensions, use niche browsers, or aggressively customise settings. Every deviation from the common configuration is another bit of entropy handed to the tracker.
Blend in, don't stand out
The winning strategy is to look like the largest possible crowd: a mainstream browser, default settings, common screen resolution, standard fonts. Boring is anonymous. This is exactly why Tor Browser tries to make every user look identical rather than making each user look random.
Uniqueness needs stability to matter
A fingerprint that's unique but changes every hour is useless for tracking — the tracker can't tell whether a new fingerprint is a new person or the same person with an updated driver. Effective fingerprinting needs both uniqueness (rare enough to identify) and stability (persistent enough to recognise later).
This tension is real. Browsers auto-update, changing user agent strings. Drivers update, changing canvas output. You plug in an external monitor, changing resolution. You install a font. Each of those shifts your fingerprint, and trackers handle it with fuzzy matching — treating a fingerprint that differs in one or two attributes as probably the same device rather than a new one.
The practical consequence: signals that are both high-entropy and stable are the most dangerous. Canvas and WebGL score highly on both, which is precisely why they're the backbone of commercial fingerprinting.
Why phones are often less unique than laptops
Mobile devices invert the usual assumption. Because enormous numbers of people own the same handful of phone models running the same OS version with the same default font set and no installed extensions, a given phone's fingerprint is frequently shared with many thousands of others.
A heavily customised desktop — unusual resolution from a multi-monitor setup, a long font list accumulated from installed software, a specific GPU and driver combination, several extensions — is often far more unique than a stock smartphone. The desktop user has more knobs, and every knob turned is entropy.
That's genuine cover for mobile users, but only against fingerprinting in isolation. Combined with an IP address, behavioural patterns, and a logged-in account, a shared mobile fingerprint still narrows to an individual quickly.
How to check your own uniqueness
Abstract entropy is much easier to grasp once you see your own numbers. Our free browser fingerprint tool shows the actual signals your browser is exposing right now — user agent, screen, time zone, languages, hardware hints, and your canvas and WebGL hashes — so you can see which values are ordinary and which ones make you stand out.
A revealing experiment: run it in your normal browser, then in a fresh install of a mainstream browser with default settings. The stock configuration will usually expose a more common, less distinctive set of values than your customised daily driver — a direct demonstration of the paradox above.
How to actually lower your uniqueness
Given everything above, the effective moves are narrower than most privacy advice suggests:
- Use a mainstream browser at default settings. The single most effective step, and the one most people get backwards.
- Keep extensions minimal. Each unusual extension is potential entropy, and some are directly detectable.
- Prefer browsers that normalise rather than randomise. Tor Browser makes users look alike; that's a bigger anonymity set than randomising into a unique configuration each session.
- Avoid exotic spoofing tools. An inconsistent spoof — a user agent claiming one OS while canvas says another — is more identifying than no spoofing at all, because the mismatch itself is rare.
- Use per-profile fingerprints for multi-accounting. If your goal is separating identities rather than disappearing, an antidetect browser gives each profile a distinct but internally consistent, plausible fingerprint.
For managing multiple identities where each profile needs its own coherent fingerprint, Multilogin is the established premium option:
The original enterprise antidetect browser.
AdsPower covers the same ground at a lower entry price with a free tier to test:
Profiles at scale with strong automation.
Compare the wider field in our roundup of the best antidetect browsers. And remember that a VPN does nothing here — it changes your IP, not a single one of the signals discussed above, which is why VPN users are still fingerprintable and why a VPN can leak your real IP separately.
The bottom line
What makes a browser fingerprint unique isn't any single dramatic signal — it's the multiplication of many ordinary ones. Entropy measures this in bits, where each bit halves the population and roughly 33 bits isolates one person on earth; a few high-entropy signals like fonts, canvas, and WebGL get most of the way there because they capture hardware and driver diversity users can't see or control. Your protection is the size of your anonymity set, which is why blending into the largest possible crowd beats customising, and why aggressive hardening so often backfires by making your configuration rare. Check where you actually stand with our fingerprint tool, then decide whether your goal is disappearing into the crowd — in which case be boring — or separating identities, in which case you need consistent per-profile fingerprints rather than fewer signals.
Frequently asked questions
No single signal does — uniqueness comes from combining many ordinary values. Each signal narrows the candidate population, and because that narrowing multiplies rather than adds, a handful of common-looking attributes like fonts, canvas output and screen resolution can isolate one device among billions.
Entropy measures identifying information in bits, where one bit halves the candidate population. Roughly 33 bits is enough to single out one person among 8 billion, and high-entropy signals like fonts and canvas can each contribute around 8 bits on their own.
Canvas and WebGL rendering, along with your installed font list, carry the most entropy. Canvas and WebGL are powerful because they measure actual hardware behaviour — GPU model, driver version, text rendering — rather than a reported setting, and that hardware diversity is enormous.
Yes, and this is the most common mistake. Spoofing your user agent to something unusual, installing niche extensions, or heavily customising settings creates a configuration almost nobody else shares, shrinking your anonymity set. Inconsistent spoofs are especially identifying because the mismatch itself is rare.
Often yes. Huge numbers of people own the same phone models running the same OS with default fonts and no extensions, so mobile fingerprints are frequently shared with thousands of others. A customised desktop with an unusual resolution, long font list and several extensions is typically far more unique.
Blend in rather than stand out: use a mainstream browser at default settings, keep extensions minimal, and prefer tools that normalise users to look alike rather than randomising you into a rare configuration. If your goal is separating identities instead of disappearing, use an antidetect browser with consistent per-profile fingerprints.