You can clear every cookie, open a private window, and route through a VPN, and the site you land on can still recognise your browser as the same one that visited yesterday. It does this without storing anything on your machine. It just reads back the dozens of small, boring details your browser hands over on request - fonts, screen size, graphics card, the exact way your system draws a line of text - and combines them into a value distinctive enough to follow you across the web. This is browser fingerprinting, and the reason it keeps beating people is that the obvious defences aim at the wrong layer.
//Entropy, in One Idea
Fingerprinting is measured in bits of entropy. Each bit halves the crowd you could be. One bit splits the world's browsers in two; ten bits put you in one group out of about a thousand; around thirty-three bits single you out from every web user alive, because there are only about five billion of them. A trait is valuable to a tracker in proportion to how rare your value of it is - knowing you run a browser is nearly free information; knowing your exact set of installed fonts is not.
The seminal measurement is Peter Eckersley's 2010 EFF study, How Unique Is Your Web Browser?, which fingerprinted 470,161 browsers. The full fingerprint carried at least 18.1 bits of entropy - enough that a given browser was, on average, one in 286,777. In that sample 83.6 percent of browsers were instantly unique; among the browsers that still ran Flash or Java, which exposed a full font list, 94.2 percent were unique. The identifying power was there fifteen years ago, before the techniques got good.
//What Actually Gets Measured Now
Eckersley's biggest contributors - browser plugins and Flash-enumerated font lists - are gone, which is a useful reminder that the exact mix shifts over time. The weight has moved to a handful of newer vectors:
Canvas and WebGL
Ask the browser to draw the same text or 3D scene to an off-screen canvas and read back the pixels. The result depends on your GPU, graphics driver, and font rendering, so the same string hashes to subtly different values across machines. WebGL goes further and reports your graphics card's vendor and renderer string more or less verbatim.
Audio, geometry, and the rest
An AudioContext processes a synthesised waveform through your audio stack and reads back a device-dependent result. Screen resolution, colour depth, device pixel ratio and window size add more. Timezone, language headers, CPU core count and reported device memory each contribute a little. Individually most are weak; the point of the demo is that they combine.
//Why the Obvious Defences Fail
Every common "privacy" habit people reach for is aimed at stored state or the network, and a fingerprint is neither.
Clearing cookies deletes the label stuck to you, not the shape of you - the EFF's own tool says so directly: deleting cookies will not help, because it is the characteristics of your browser configuration being analysed. Incognito mode is the same browser with the same configuration; it forgets history, not its fingerprint. A VPN changes your IP address, which lives at the network layer the fingerprint never touches - see what a VPN actually hides.
Two defences that make it worse
Spoofing your User-Agent is the classic self-own. A faked User-Agent that disagrees with everything else measurable about your browser is rarer than an honest one - almost nobody has your exact mismatch - so it raises your entropy. Eckersley saw this in the data: spoofed agents were strongly identifying. The general law is that any privacy trick used by very few people becomes a tracking signal in itself. The same trap catches most random anti-fingerprint extensions: few people run the exact one you do, and its unusual modifications stand out.
//The One Approach That Works, and Why It Is Backwards
Tor Browser - and Firefox's resistFingerprinting, which borrows its model - takes the opposite tack. Instead of hiding or randomising your traits, it makes every user report the same traits, collapsing the number of distinguishable buckets so that you disappear into a crowd of identical browsers. It spoofs the operating system to a standard string, rounds the content window to fixed sizes with letterboxing, and refuses to let you customise any of it - because, as the Tor Project explains, any option you could choose would only make you more unique. The price is real: standard fonts, a non-resizable-feeling window, features turned off. Uniformity is the only thing that beats fingerprinting, and it works precisely by giving up the personalisation that creates the fingerprint.
//Sourcing and Framing
The entropy framing, the 470,161-browser sample, the 18.1-bits / one-in-286,777 figure, and the 83.6 percent (all browsers) and 94.2 percent (Flash/Java subset) uniqueness rates are from Eckersley's 2010 PETS paper. The "clearing cookies will not help" line is the EFF Cover Your Tracks documentation. The uniformity strategy, letterboxing, OS spoofing and the "any option makes users more unique" reasoning are from the Tor Project's fingerprinting-protections documentation. The per-vector bit values in the demo are illustrative teaching numbers, not measurements, and the article says plainly that correlated attributes mean a naive sum overstates uniqueness. The interpretation here is that the defences people actually reach for are aimed one layer off from where the fingerprint is built, which is why they fail so consistently.