Browser fingerprint test sites: what 8 detectors check

You open a fingerprint test in the browser your agent uses, and it answers with a percentage, a red tile or a list of lies. The number feels like a verdict, and it often describes the test setup rather than the browser. We run 8 of these sites in an automated audit against every engine build and against live profiles, and each one needed its own rules before its result meant anything.

What does a fingerprint test site measure?

A fingerprint test site measures the values a page can read from your browser, and some also check whether those values contradict each other. None of them sees what a specific website's bot defence decides, because that depends on the site's own key, thresholds and the reputation of your address. CreepJS states its own purpose as "to shed light on weaknesses and privacy leaks among modern anti-fingerprinting extensions and browsers", and AmIUnique is run by a team of researchers and hosted at Inria to study how diverse browser configurations are. Both describe measurement, not access control.

Which 8 detector sites are worth running?

The 8 sites below are the ones our audit drives, and the list runs from the fastest result to the slowest, because the waiting time decides how you can use each one. The table gives what each reads and how long it took to settle in our runs.

1. What does BrowserLeaks show?

BrowserLeaks shows the raw values of browser fingerprinting without a verdict: a canvas hash, the WebGL vendor and renderer, a TLS page with the JA4 your browser sends, client hints and WebRTC addresses. It is the best page to compare two browsers value by value, because it does not score anything.

2. What does sannysoft check?

sannysoft checks the classic automation flags, such as navigator.webdriver and missing plugins, in three tables and marks each row as passed, warned or failed. Ordinary Chrome is green on every row, so a red row here is a finding you should explain before anything else.

3. What does CreepJS find?

CreepJS looks for lies: values that one API reports and another contradicts, plus headless and stealth ratings. The build we ran had no trust score, so the result is the list of lies and ratings, not a single number to wait for.

4. What does the FingerprintJS demo reveal?

The FingerprintJS demo returns a visitor ID and a set of flags, among them developer_tools. That flag reads true for a browser driven over CDP, including our own direct CDP connection with no Playwright, so a driven browser is visible here even when its fingerprint is clean.

5. What does Pixelscan decide?

Pixelscan decides per tile whether a fingerprint is consistent and reports "Masking detected" when it is not. An ordinary Chrome got that verdict in our runs, because its JavaScript timezone did not match the timezone of its exit address.

6. What does BrowserScan deduct?

BrowserScan starts every browser at 100 percent and deducts points for each anomaly it finds, listed with its reason. The same timezone mismatch cost an ordinary Chrome 10 percent there, and noise on canvas readback got our own canvas marked as manipulated.

7. What does iphey judge?

iphey judges browser, location, IP, hardware and software and ends with a word such as Trustworthy or Unreliable. It returned Unreliable for our driven browser for reasons outside the browser: it saw the CDP connection, it flagged a location mismatch, and it reported other automation programs installed on the same machine.

8. What does AmIUnique compare?

AmIUnique compares 57 attributes of your browser with its dataset and says how rare each value is. It is the slowest of the eight and the most sensitive to your setup: in our first live audit on 30 July 2026 it reported a font list shared by 0.00 percent of its visitors, and the cause was the test harness, not the engine.

How do you read a test result without fooling yourself?

You read it against a control: the everyday Chrome of the same version, on the same machine, over the same exit, opened a minute apart. Three rules came out of our runs.

1. Match the timezone and language to the exit address first, or Pixelscan and BrowserScan grade the mismatch and not the browser.
2. Keep the driver out of the verdict. A CDP connection shows up on FingerprintJS and iphey whatever the browser does, so score it as a driver finding, not as a fingerprint.
3. Run the audit on a machine without other automation software installed, because iphey scans for it.

A test site cannot predict a real block. The same browser, in the same minute, got a token from hCaptcha on one site and none on hCaptcha's own demo, because the site key differed. For the numbers a real site reacts to, measure against that site.

Why does a canvas test flag noise?

A canvas test flags noise because a graphics card draws a flat area in one colour, and random offsets put variation where no device would. We shipped such noise once and removed it on every readback surface; the guide to canvas fingerprinting has the numbers. The page on testing your setup describes how to run the same detector audit against a live profile.