How can a few browser facts identify one person out of millions?

Each fact — timezone, screen resolution, GPU string, canvas hash — carries measurable bits of entropy. Combined, they multiply: enough distinct facts and the remaining candidate pool shrinks from hundreds of millions toward a single device.

Is this the same math real tracking systems use?

The entropy values are grounded in EFF's Panopticlick research where measured, and reasonable estimates elsewhere. The underlying math — population divided by 2^bits — is the same used to describe browser fingerprint uniqueness generally.

Forensic profile

Observable signals reduce identity entropy.

This report treats the current session as an attack surface: signal becomes identity, identity reduces uncertainty, and reduced uncertainty creates an exploitable person-shaped record.

Identity entropy report

The session is no longer an anonymous visit.

Observed marks

The math, live

How this session's real signals narrow a candidate pool.

Shannon entropy measures uncertainty. For a set of possible outcomes $x_i$ with probabilities $p(x_i)$ , the entropy $H(X)$ is calculated as:

H(X) = - \\sum_i p(x_i) \\log_2 p(x_i)

$p(x_i)$ is the probability of a specific outcome, and $\\log_2$ measures information in bits. Here, each exposed signal removes a few bits of uncertainty, shrinking the number of plausible people your browser could belong to. See Shannon's original paper, A Mathematical Theory of Communication.

Candidate pool, narrowed live from 330,000,000 (U.S. population)

Illustrative model — see note below. Not a measured ground truth for this device.

Timezone — UTC+3.04 bits (measured — EFF Panopticlick, 2010)40,122,017 left
Screen resolution + pixel ratio — 1280×720 @ 1x+4.83 bits (measured — EFF Panopticlick, 2010)1,410,613 left
Platform + language — Linux x86_64 · en-US+2.10 bits (estimated)329,037 left
GPU renderer string — ANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) (0x0000C0DE)), SwiftShader driver)+7.00 bits (estimated)2,571 left
Canvas render hash — fp-707c41bf+5.00 bits (estimated)80.3 left
Audio-stack fingerprint — fp-5556c7b1+3.00 bits (estimated)10.0 left
Installed font list — 1 detected · Bauhaus 93+6.00 bits (estimated)0.16 left

This adds each signal's estimated bits as if they were independent, which overstates precision a little — GPU, canvas, and audio fingerprints correlate with each other. Timezone and screen-resolution bits are measured (EFF Panopticlick, 2010); the rest are this project's own conservative estimates, not a population study.

Where each signal could go

Four categories, four exploitation paths.

Network

Unavailable in browser-only mode

Entropy reduction: Unavailable in browser-only mode
Exploitation path: ZIP-level location, ISP context, subpoena-ready timestamp, carrier inference.

Device

Linux x86_64 · 1280×720 · UTC

Entropy reduction: Viewport, platform, timezone, cores, and language narrow the device cohort.
Exploitation path: Cookie-free linkage, identity graph enrichment, corporate or residential targeting.

Behavior

No typing signature yet · No scroll rhythm yet · No tap/click trace yet

Entropy reduction: Cadence, scroll velocity, and tap timing form a passive biometric pattern.
Exploitation path: Risk scoring, passive authentication, replay comparison, synthetic identity validation.

Continuity

1 page seen · last input: none

Entropy reduction: Route order and repeated visits attach behavior to the same node.
Exploitation path: Routine reconstruction, dossier enrichment, stalking, insider-threat targeting.

Observable signals reduce identity entropy.

The session is no longer an anonymous visit.

The math, live

Where each signal could go

FAQ

Common questions