Topic Archive
120 articles in Fingerprint
Browse other topics
This article lives in the editorial library. For step-by-step setup, reference material, and ongoing updates, jump into the docs section.
Category overview
This archive groups 120 articles on Fingerprint. Use it to move from editorial reads into practical BotBrowser guidance, then continue in Fingerprint.
Common tags in this topic
Articles
120
Latest update
Oct 1, 2026
Docs section
Fingerprint
Three strong reads to understand this topic before diving into the full archive.
Understand BotBrowser's --bot-performance-timing basic and advanced modes, the Performance Timing APIs they affect, and the limits of proxy and anti-bot cross-checks.
Compare Rebrowser patches, original Playwright and a declared browser profile on one owned page. Separate library behavior, rendering observations and proxy routing.
Additional guides from this topic archive.
The common and targeted levels inspect different things, labels let one rule feed the next, and a block reads nothing like a challenge. One measured 403 shows the difference.
The availability endpoint publishes four channels and three artefacts per platform at one version. Pinning that version still leaves fonts, GPU and clock outside the pin.
Three clients, one listener: what a TLS-impersonating HTTP client matches, why it still differs by an extension, and the page layer it never reaches.
How a ClientHello becomes a JA3 or JA4 value, why one stays stable and the other changes between runs, what a SETTINGS frame states, and how to check your own client.
What webgl_debug_renderer_info reveals about your GPU to any page, what it cannot show, and how to verify a WebGL fingerprint in your own browser.
Learn how ordinary browser signals combine into a fingerprint, why cookies do not control it, and how to test privacy boundaries safely.
Trace CreepJS WebRTC report fields to pinned APIs, SDP transforms and partial-result branches without treating them as identity.
One probe on patched APIs: which overrides a toString whitelist catches, which descriptors still leak, and why a Proxy or a bound function passes as native.
Map BrowserLeaks WebRTC support, ICE, SDP, and media-device fields to browser operations without treating one row as a leak verdict.
Trace CreepJS CSSStyleDeclaration key collection, alias handling, and separate system color and font probes without confusing support with a measured value.
Read the pinned CreepJS CSS media collector: one preference answered through an @media custom property and through matchMedia, its fourteen keys, and the screen range scan.
Interpret Linux armv81, User-Agent Client Hints and WebGL together without treating a browser surface as hardware identity.
Read the public evasion list of a popular Puppeteer extra plugin, then see which three surfaces page-JavaScript patches cannot reach and how to prove a patch ran.
Trace what a challenge page samples, why one browser can pass one vendor and fail another, and how to record per-detector results instead of chasing an undetected claim.
Trace CreepJS SVG report fields to a pinned collector, distinguish lossy text-length grouping from geometry, and read blocked states without inferring identity.
Trace CreepJS Math results, browser reference flags, repeated-call checks and lie state without treating source labels as live browser evidence.
Compare CreepJS getPrediction lookup with renderPrediction signal aggregation and unknown states; neither output proves device identity.
Read CreepJS DOMRect checks without confusing empty geometry, fragmented text, transforms or missing results with a device identity.
Read navigator.cpuPerformance values, distinguish missing from zero, and understand Chrome 152 support, overrides and CPU-tier privacy limits.
Trace optional WebGL renderer disclosure from extension lookup to getParameter without treating a renderer string as device identity.
Separate ICE prefetch, candidate delivery and restart phases; a missing page event does not establish that earlier network activity did not occur.
Trace BrowserLeaks WebGL fields from context discovery to parameter, extension, precision, and pixel reads. Diagnose missing output without guessing.
Plan camera and microphone permissions, device labels, and virtual camera workflows so media features remain useful, transparent, and privacy conscious.
Separate data:, sentinel returns, PNG format fallback and SecurityError from pixel differences when reading a Canvas fingerprint test.
Map Android WebView signals across HTTP, page JavaScript, workers, and app bridges; see what CreepJS source checks and what it cannot prove.
CreepJS checks 51 font names to infer a Windows or macOS version. Executing its tables shows every answer needs a complete base set, not one stray font.
One probe on CreepJS: soft tells, hard headless bits and wrapper checks are scored separately, so a cleaned page still reports a percentage.
Trace CreepJS Intl fields to their fixed inputs, locale collection and error paths, without treating formatting differences as identity or a lie verdict.
Compare browser signal groups, trace behavior checks, and route fingerprint differences.
Separate CreepJS timezone fields, historical offset comparisons and conditional display from physical location, identity and an automation verdict.
Trace CreepJS WebGL fields from pinned source to report output, including context comparisons, optional renderer data, pixel reads, and limits.
Separate fingerprint uniqueness, browser stability, and cross-browser linkability with sample limits, confounders, and a practical evidence worksheet.
EFF test results mix simulated trackers with fingerprint uniqueness. Separate the two, then read Canvas, WebGL, fonts and timezone fields within their limits.
Separate missing WebGL renderer information from context failures, privacy restrictions and unrequested collection. Preserve the distinction in support records.
Trace BrowserLeaks Canvas from its support checks to its PNG digest and signature lookup, then separate those observations from identity or bot verdicts.
Trace CreepJS audio report fields from OfflineAudioContext rendering through missing, noise and lie branches without treating a checker result as identity.
Read CreepJS emojiSet and textMetricsSystemSum from pinned source. Separate representative metrics, lossy aggregation and field inclusion from OS identity.
How WebCodecs exposes media-processing support, why results vary by browser and platform, and how to review compatibility without collecting extra data.
Plan WebGL software-rendering fallbacks that preserve an accessible experience while keeping capability checks separate from device profiling.
Compare focus, blur, visibilityState, and document.hidden across headless and headful BotBrowser sessions without treating active state as human presence.
Understand how AudioContext and OfflineAudioContext rendering differences form an audio fingerprint, and how to keep audio output consistent with a loaded profile.
How Encrypted Media Extensions and Widevine capability queries expose platform signals, why VPNs and private windows do not change them, and how to check them against a profile.
What is font fingerprinting? Learn how font availability, fallback behavior, and text metrics expose platform traits and affect browser privacy.
Understand secure-context requirements, permission choices, accuracy tradeoffs, and privacy-safe fallbacks for browser geolocation.
performance.now timing resolution and jitter reveal timer coarsening and workload variation. Compare repeated readings before concluding.
How the WebGPU API exposes GPU adapter details for fingerprinting, and how to control GPU identity signals at the browser profile-managed.
One probe on abort reasons: what the default reason is, how timeout and any pick one, how often the event fires, and why a late listener never runs.
One probe on a public detection ruleset: a heavy environment tell scores 0.7 and still cannot convict, while one cross-layer contradiction goes straight to a verdict.
CreepJS multiplies a canvas seed by 15000 modulo 2001000001 every round. This probe measures how many rounds stay distinct before that sequence repeats.
One probe on CreepJS: nine independent group patterns become a single ordered decision string, and one group can only be caught by comparing it with another.
One probe on date strings: a date-only value is read as UTC midnight while a date-time with no offset is read as local, and an out-of-range day rolls over.
A public ruleset splits 126 rules into 95 a page can check and 31 that need the network edge. Real handshakes show why the heaviest ones sit on the far side.
One probe on number formatting: which rounding mode is the default, what each mode does at a .5 boundary, and how a sign or a trailing zero quietly disappears.
One probe on iterator helpers: when each helper pulls a value, why the result cannot be iterated twice, and how take stops a source that drop must walk.
One probe on a single hole: which methods skip it, which visit it, what it becomes when materialised, and why indexOf and includes disagree about it.
Canvas measureText() exposes sub-pixel metrics that vary with fonts and browser setups. Compare this signal with Canvas and understand BotBrowser profile limits.
Two public suites publish 49 tests between them. Reading their own catalogues shows 11 read the connection, and four shared names are classified differently.
Sort fixed arrays: the default string order, in-place mutation, a stable sort, where undefined and NaN land, how a bad comparator yields a wrong order, and subtraction overflow.
Read one ArrayBuffer as Uint8Array, Uint32Array and DataView: byte versus element length, why slice copies and subarray aliases, byte order, and how a transfer detaches the source.
Read the pinned FingerprintJS BotD registry and run its detectors over explicit component states to see which automation checks fire, which stay silent, and which fail open.
Run btoa and atob over accented, CJK and emoji strings to see exactly where each throws, what atob returns, whether padding is optional, and which alphabet is rejected.
One probe on fixed lists: how a locale comparison differs from a code-unit sort, how numeric, sensitivity and caseFirst change the outcome, and what resolvedOptions reports.
Read crypto-js 4.2.0 and 3.1.2 source, then measure which entropy call each version makes, how many calls a request costs, and what a stubbed crypto object can change.
One probe on fixed buffers: the default byte order, unaligned reads, bounds errors, float precision, shared buffers, offset views and the BigInt getters.
Ask ICU which timezone identity a page really reads: how aliases collapse, when TZ wins, and why a fixed offset matches a DST zone in January and diverges in July.
One ordering probe: sync code finishes first, promise callbacks drain in queue order, nested microtasks wait, await resumes as a microtask, and a timer never preempts a loop.
Build objects with mixed keys: integer keys sort ascending, string keys keep insertion order, which keys count as integers, and how JSON, Map, for-in and spread follow the order.
Two probes on fixed shapes: all stops at the first rejection, allSettled reports every outcome in input order, any aggregates errors, and an empty race never settles.
One probe on fixed traps: which traps fire, which answers the runtime rejects with a TypeError, and what a revoked or non-callable proxy does.
Run a pattern through test, exec and matchAll: how lastIndex advances under global and sticky flags, why a reused global pattern flips its answer, and how unicode counts.
Run structuredClone and a JSON round trip over dates, maps, sets, NaN, BigInt, cycles and shared references to see what each keeps, changes, rejects or silently drops.
Decode fixed bytes under several labels: which alias, how a BOM and a bad byte behave, why a chunk split drops a character, and why byte and string length differ.
Run the pinned ua-parser-js bundle over fixed user agents and Client Hints to see which identity it reports, which markers it drops, and how a 500-character cap hides a bot token.
Run the host ICU over precomposed, decomposed, emoji and Hangul strings to see the four different lengths a page can read for the same visible text, and why a key match fails.
Parse odd URLs and query strings to see where new URL throws, what normalisation rewrites, how duplicate keys, plus signs and sort order behave, and why a set is not an assignment.
One probe on fixed shapes: which keys a WeakMap accepts, why nothing can be counted, what a strong Map keeps alive, and what a weak collection cannot survive.
Interpret Cloudflare Bot Score, Bot Management variables, and Logpush records without treating a score, challenge, or HTTP status as identity proof.
Trace FingerprintJS OSS load(), source ordering, component errors, and lazy visitorId digest provenance without claiming a runtime detector result.
Compare Web Crypto getRandomValues with crypto-js random generation using a reproducible fixture and privacy-bounded fingerprint observations.
How requestAnimationFrame timing, display refresh rate, and video playback cadence work as fingerprint signals, and how BotBrowser sets display FPS and video FPS.
Distinguish screen, available area, window, layout viewport, visual viewport, zoom, and pixel density without treating display observations as proof of identity.
How CSS media queries such as color-gamut and prefers-color-scheme create fingerprint signals, and how to keep CSS and JavaScript values consistent.
How canPlayType, isTypeSupported, and MediaCapabilities report media support, why results vary by host, and how to check them against one profile.
How a fixed integer noise seed makes Canvas, WebGL, Audio, and text-measurement output repeat across sessions, restarts, and CI runs, and how to verify it.
Handle empty voice lists, locale matching, speech queues, and errors without treating voices as an identity signal.
Learn why JavaScript recursion limits vary across contexts, how to review the signal responsibly, and what BotBrowser can control.
Use navigator.hardwareConcurrency and Worker benchmarks to see how browsers report CPU cores and what that signal can reveal.
Choose a profile, real, or advanced display scale for BotBrowser sessions and keep DPR consistent across desktop, mobile, and per-context workflows.
How navigator values such as platform, hardwareConcurrency, deviceMemory, languages, and userAgentData combine into a fingerprint signal, and how to check that they stay coherent.
How navigator.connection values add to a browser fingerprint, why a proxy exit can disagree with them, and how to review a network information policy.
Protect browser privacy by keeping storage quota, JavaScript heap limits, and device memory aligned with the active profile across supported hosts.
Keep external URL handling aligned with the selected platform profile while preserving standard web navigation.
Capture local V8Log evidence during authorized validation, keep traces readable with API filters, compare against a baseline, and route support cases with facts.
The keyboard, orientation changes, and browser chrome each resize the viewport. Order the events, coalesce them on one frame, and decide layout once per change.
WebAuthn and passkey capability checks are limited feature hints, not proof of hardware, identity, credentials, or sign-in success. Learn how to use them respectfully.
Learn where WebGL fits, how browser support varies, and how to plan fallbacks, accessibility, privacy, and compatibility without collecting device profiles.
WebRTC codec enumeration through getCapabilities() and SDP offers exposes media capabilities that differ by operating system. Learn how the codec list becomes a platform signal.
Validate Canvas, WebGL, and WebGPU browser privacy signals across software rendering, hardware rendering, headless mode, and headed mode.
Understand the proposed Private Verification Tokens design, its current platform status, and how privacy-focused browsers can evaluate it without assuming a rollout.
A practical way to review browser data, permissions, storage, network visibility, and privacy settings without breaking ordinary tasks.
Compare built-in browser tracking protection settings by scope, site compatibility, and user control without treating any one setting as a complete privacy solution.
Client Hints headers such as sec-ch-ua describe browser brand, version, and platform on every request. Learn where mismatches arise and how to compare headers with JavaScript.
Use keyboard layout mapping for accessible labels without turning a layout into a keystroke or identity signal.
How Canvas rendering differences become a stable device identifier, why VPNs and private browsing leave it unchanged, and how profile-driven deterministic output works.
Learn what the Battery Status API exposes, why support is limited, and how to use battery information without turning it into a user profile.
Learn what navigator.deviceMemory can and cannot tell a web app, how to adapt resources progressively, and where privacy limits apply.
Understand how web fonts affect layout stability, choose a resilient loading policy, and preserve readable content while fonts load or fail.
Learn how screen, viewport, and device-pixel-ratio properties support responsive layouts, testing, and privacy-aware product decisions.
Use orientation changes as a responsive layout state while preserving accessibility, user choice, and privacy.
The browser mic API is getUserMedia({audio:true}). Compare playback that needs no prompt with capture that does, plus recording privacy and fallbacks.
Understand how Web Bluetooth user activation, permissions, availability, and device selection shape a privacy-aware web experience.
Understand what a WebGPU adapter represents, when it may be unavailable, and how to choose graphics fallbacks without collecting a device profile.
Understand what WebNN does, why browser support and execution choices vary, and how to test machine-learning features without turning capability checks into telemetry.
Understand how browser Canvas supports graphics, animation, games, and media, with accessible fallbacks and clear security boundaries.
Understand which local browsing records private windows limit, what remains visible to websites and networks, and when to use a separate profile instead.
Learn how websites combine rendering, display, language, and request metadata across sites, and how to verify privacy boundaries without exposing internal details.
Learn how permission states become browser identity signals and how profile-backed consistency protects privacy while preserving normal access controls.
How a fixed noise seed keeps Canvas, WebGL, Audio, and text-metric noise reproducible across sessions, and how to check that one seed repeats while another seed changes the output.
Load a profile, keep the signals you just read about consistent inside the browser, and confirm the result on your own machine before a rollout.