Method
How the fingerprint test works
Every check, what it reads, and the exact rule for a failure.
Direct answer
The test reads values in your browser, compares them with each other and with what our server sees, and fails a check only for a value that a stock browser never shows. We run it on stock Chrome, Edge and Firefox on Windows, macOS and Linux to make sure that real browsers pass.
Every check and its rule
| Check | Fails when | Warns when |
|---|---|---|
| User agent vs engine | The user agent names an engine that differs from the one the page runs on | — |
| User agent header | The User-Agent header differs from navigator.userAgent | — |
| Client hints | Platform, version or browser name (Edge, Opera, AVG, Yandex, Samsung) in client hints differs from the user agent or the Sec-CH-UA-Platform header | Chrome 110 or newer with a full version in the user agent |
| Platform | navigator.platform does not fit the operating system in the user agent | — |
| Engine version | Chromium only: at least two JavaScript features of versions below the claimed one are missing, or at least two from more than one version above it are present | — |
| Version | — | The browser is more than four releases behind stable |
| Workers and frames | A web worker, iframe or service worker shows a different user agent, platform, language, CPU count, memory or time zone | Only the graphics card differs |
| Automation | navigator.webdriver is true, automation variables are present, or the browser is headless | Something reads console output (developer tools or CDP) |
| Spoofed functions | A built-in function has non-native source, extra properties or a Proxy wrapper, or navigator or screen has its own copy of a built-in value | — |
| Canvas, WebGL and audio | — | Plain colours or a constant sound do not read back exactly in Chrome or Edge (info in Firefox, Brave and Safari) |
| Graphics card | The renderer belongs to a different operating system | Software or virtual-machine renderer; no WebGL on Windows or Mac; WebGPU names another vendor |
| Fonts | Windows without Segoe UI, Windows with Mac system fonts, Mac without Mac fonts | Windows without one of Tahoma, Verdana, Arial, Times New Roman or Courier New; Mac or Linux with Windows icon fonts |
| Screen | Usable area larger than the screen, or JavaScript and CSS pixel ratios differ; a Mac with touch points in Chrome or Firefox | screen.width differs from CSS device-width |
| Time zone | The zone name and the clock disagree, or the zone is more than two hours from the IP location | The zone is one or two hours from the IP location |
| Language | The first Accept-Language entry differs from navigator.languages | — |
| IP address | — | The address belongs to a known hosting network |
| DNS | A resolver that looked up the test names is in another country than your IP address | — |
| TLS and HTTP/2 | — | A Chromium or Firefox browser whose TLS handshake comes from another TLS stack, or whose HTTP/2 pseudo-header order differs (antivirus HTTPS scanning can cause both) |
| WebRTC | WebRTC exposes a public address from another network | A real local address is visible, or an IPv6 address from another network in the same country |
How we keep real browsers passing
A check that fails for a normal browser is useless. Every week, and before every change to the rules, we run the test on stock Chrome, Edge and Firefox on Windows, macOS and Linux. The run fails if any stock browser gets a failure outside the automation checks, and we fix the rule before it goes live.
We do not flag a proxy as spoofing. A proxy changes your IP address, and a browser that matches the proxy location passes every time zone and language check here.
What we store
- The browser checks run in the page. The values and hashes stay in your browser.
- Our server reads your IP address, the request headers and the WebRTC addresses to report them back to you. It does not store them.
- Share result stores the verdicts only, without addresses, hashes or the user agent, for 30 days.
- The DNS leak test uses the public DNS detection API of ipleak.net. Your browser contacts it directly.
- IP location and network data: IP Geolocation by DB-IP (db-ip.com), licensed under CC BY 4.0.