A browser can pass 97.8% of individual checks while only 91.4% of profiles pass every check at once. Those numbers are not contradictory. They answer different questions, and reporting only one of them makes a benchmark easy to misread.
The arithmetic
Incogniton’s 800 profiles produced 37,600 individual check results (800 × 47). At a 97.8% check-level rate, about 36,773 of those results passed. That is an average of 46.0 passes per profile.
But a profile only counts as a full pass if all 47 checks pass together. Incogniton had 731 full-pass profiles out of 800, or 91.4%.
The gap is explained by the 69 profiles that failed at least one check. Those profiles failed a cluster of related checks, usually after a proxy timeout, a kernel mismatch, or a partial restore. A profile that fails 12 checks contributes 12 failures to the check-level denominator but only one failure to the profile-level count.
Why full-profile is stricter
One leaked signal can be enough to link an account. A profile that passes canvas and WebGL but leaks a real WebRTC candidate is not “97.8% safe.” It is a profile with a specific, exploitable inconsistency.
That is why the report leads with both metrics and why the ranking table shows them side by side. If a vendor quotes only a check-level rate, ask for the full-profile rate and the sample size.
What would be a red flag
- A check-level rate with no full-profile rate.
- A full-profile rate that is higher than the check-level rate.
- A claim that a browser “passed all 47 checks” when the reported rate is below 100%.
- A ranking that changes when the metric is defined differently, without an explanation.
Reproduce it
The profile-level CSV contains the check counts and failure IDs. The methodology defines both metrics. The reference harness shows the reporting contract.