18.28 bits: what Cover Your Tracks' number measures

Bits of identifying information is the EFF's way of saying how rare your browser is. Cover Your Tracks compares your values with the browsers it has seen recently and writes the answer as a power of two: N bits means roughly one browser in 2^N looks like yours. Our profile read 18.28 bits, which is one in about 318,000 of that sample. It measures rarity against the people who visit an EFF privacy test, not how trackable you are.

Bits of identifying information, as arithmetic

A bit halves the crowd. If half of all browsers share your timezone, your timezone is worth one bit. If one in 1,024 shares your font list, the font list is worth ten. The formula is the base-2 logarithm of one over the share: bits = log2(1 / share).

That is why the numbers stay small while the crowds get huge. Sixteen bits is one in 65,536. Twenty is about one in a million. Thirty-three is enough to pick one person out of everybody alive. So a jump from 17 to 18 bits does not sound like much, and it means you are twice as rare.

Cover Your Tracks prints the same unit per value, and the table under the headline is worth more than the headline. Each row says how many bits that one value carries and "one in x browsers have this value". The rows do not add up cleanly to the total, because values travel together: a Mac User-Agent and a MacIntel platform are one fact said twice, and a scanner that counted them twice would think you were rarer than you are.

How it works: Machines that exist

What our 18.28 was counted against

Our run read pass, 18.28 bits of entropy, fingerprint unique. Two to the power 18.28 is 318,294. The word "unique" changes how to read that number, and this is the part most explanations skip.

When nobody in the sample has your exact combination, the test cannot say how rare you are. All it knows is that you are rarer than one in however many browsers it checked. So for a unique browser the figure works out to the logarithm of the sample size, and 18.28 bits says the comparison ran against something like 318,000 recent visitors. A browser that is truly one in a billion would get the same number on the same day. The figure is a floor, not a measurement of you.

The sample also picks itself. The people who load an EFF fingerprint test are more likely than average to run Firefox, Brave, Tor Browser, a blocker or an unusual font set. A setting that is common among them can be rare on a shopping site, and the reverse. A tracker on a big site has its own population, measured over far more visits, and your rarity there is a different number nobody prints for you.

Rare is not the same as trackable

Tracking by fingerprint needs two things: values rare enough to tell you apart, and values that stay put long enough to be joined. Cover Your Tracks measures the first well. The second needs a second visit.

A browser can be unique on every load and still be useless to a tracker, if the values change each time. That is what the test's "randomized fingerprint" label means, and why we think it is the wrong goal for a profile that has to look like the same computer every time it logs in (why randomization reads as a signal). And a browser with a very common fingerprint is still followed perfectly by a cookie. The bits answer "how many browsers look like this one", which is a useful question and a narrower one than "can I be followed".

Read your number beside a control

A number like 18.28 tells you little on its own. It moves with the sample, with the day, and with the machine under the browser. What tells you something is the same test, run at the same time, in a browser nobody has touched.

We learned that on other detectors first. FingerprintJS could not name our browser, and it could not name Google's own unbranded build of the same major either. IPHey scored us 90, and scored Chrome for Testing 90 from the same address. Pixelscan read "inconsistent" on three fresh profiles until a stock Google Chrome on the same Mac read "inconsistent" twice. Each of those cost time because the verdict was read as a finding about the profile. So our detection runner has a --control flag that runs the selected tests through the machine's own stock browser in the same session and prints the two columns side by side. A row both columns fail is not a finding. (The control that settles "is it our patches" has how we pick that stock browser.)

For Cover Your Tracks the useful control is your own everyday browser, on the same machine, a few minutes apart. If your profile and your everyday browser both land in the high teens and both read unique, the sample size is doing most of the talking.

What we ask of a profile

Cover Your Tracks is one of the detectors in Mosaic's catalogue, in the uniqueness group. The pass we wrote for it asks for a normal-looking browser with entropy in line with a real one, roughly 16 to 18 bits, and treats a randomized verdict as a failure. Each profile is drawn from one real device record, and its canvas, audio and WebGL values come from the profile's own seed, so the next launch reads the same as the last. The values a page can read, and which ones carry the most bits, are listed in the browser fingerprint glossary entry. How a profile is drawn so its values agree with each other is on real fingerprints.