01
Canvas rendering
Derived from the hardware and driver stack underneath the browser, not from anything a page writes to disk. Trackers now run multiple canvas tests with different rendering paths to catch the inconsistencies naive spoofing leaves behind — a single fake value isn't enough.
CANVASHARDWARE-DERIVED
02
WebGL renderer & parameters
The renderer string, supported extensions, shader precision, and max texture size — collected at a deeper level than canvas. Spoofed values have to match a GPU that actually exists; a fabricated renderer string is a bigger red flag than no spoofing at all.
WEBGLGPU
03
AudioContext output
An inaudible signal run through an OfflineAudioContext and read back from the output buffer. Lower entropy than WebGL, but hard to fake because it depends on the real audio processing pipeline, not a JavaScript property you can just override.
AUDIOCONTEXTDSP
04
Fonts, screen & hardware
Installed font enumeration, screen resolution, color depth, hardware concurrency, and device memory. Consistency matters as much as the values themselves — a profile spoofing Windows that still reports Apple-exclusive fonts is telling on itself.
FONTSSCREENHARDWARE
05
WebRTC leaks
ICE candidate gathering can expose a real local or public IP even behind a clean proxy. One of the most common ways otherwise well-isolated profiles get correlated back to each other.
WEBRTCIP LEAK
06
Media device enumeration
navigator.mediaDevices reporting zero cameras and microphones is itself a signal — real hardware almost never comes back empty. Profiles need plausible virtual device entries, not an empty array.
MEDIA DEVICESHARDWARE IDS
07
User-Agent & Client Hints
The classic UA string, plus the Client Hints headers Chrome now uses alongside it. UA reduction was rolled out to limit passive fingerprinting — but a Client Hints profile that doesn't match the rest of the fingerprint is its own tell.
USER-AGENTCLIENT HINTS
08
TLS / JA3 fingerprint
A network-level fingerprint taken from the TLS ClientHello — TLS version, cipher suites, extensions, elliptic curves — before the page ever loads. Invisible to JavaScript-based checks, and the layer most anti-detect tools don't touch at all.
TLSJA3/JA4NETWORK-LEVEL
09
HTTP/2 fingerprint
SETTINGS frame ordering and other connection-level details, often paired with TLS fingerprinting for a stronger combined signal. Same story as JA3 — it runs below the page, where spoofing a canvas value does nothing.
HTTP/2CONNECTION-LEVEL
10
Storage & cache persistence
localStorage, IndexedDB, and cache-based identifiers survive a fingerprint reset if storage isn't isolated along with it — quietly re-linking a 'new' profile back to the old one.
STORAGEPERSISTENCE
11
Timezone & locale
Intl.DateTimeFormat and navigator.language expose the system timezone and locale. A profile with a US IP but a timezone or language that doesn't match is one of the simplest inconsistencies to catch — and one of the easiest to get wrong.
TIMEZONELOCALEINTL API
12
Permissions API
Querying every permission type — camera, microphone, geolocation, notifications — builds a state matrix unique enough to identify a browser on its own. Growing in importance as trackers lean on it more now that canvas and WebGL get more scrutiny.
PERMISSIONS APISTATE MATRIX
13
Speech synthesis voices
speechSynthesis.getVoices() returns a voice list that reveals OS, browser version, and locale — high entropy, and Chrome ships with no protection against it at all. One of the more overlooked signals in most anti-detect tooling.
SPEECH SYNTHESISVOICE ENUMERATION
14
CSS-only fingerprinting
Feature-support testing through stylesheets alone — no JavaScript required — identifies browser engine, version, and rendering capabilities. Invisible to script blockers and most anti-detect tools, since it never touches the JS layer they're built to intercept.
CSSFEATURE DETECTION
15
Performance API timing
Clock resolution, CPU timing patterns, and resource-load timing all leak real hardware behavior. One of the hardest signals to fake convincingly, because it depends on how the actual machine executes code, not a property you can override.
PERFORMANCE APITIMING
16
CDP protocol leaks
Distinct from the navigator.webdriver flag — this is about traces the DevTools Protocol connection itself leaves, which stealth plugins that only patch JavaScript properties never touch.
CDPDEVTOOLS PROTOCOL
17
Touch & pointer consistency
maxTouchPoints and pointer media queries need to agree with the rest of the profile — a 'mobile' fingerprint that reports no touch support is the same kind of inconsistency as a font list that doesn't match the claimed OS.
TOUCHPOINTERCONSISTENCY
A real 2026 anti-bot system checks upward of 40 signals across network, browser, and behavioral layers. This list is the depth we build to, not a claim that it's every check that exists.