Recommended Free Tools
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Short answer: a website cannot prove that a visitor is “lying” from one browser field. Reliable spoof detection is consistency analysis: compare the HTTP User-Agent with JavaScript-visible values, platform, features, rendering, fonts, device properties and (carefully) changes over time. A mismatch is an anomaly for review, not proof of malicious intent. Privacy browsers deliberately standardize or limit these signals, and ordinary browser updates can produce the same pattern.
What a browser “lie detector” actually checks
A browser fingerprint is a collection of signals exposed by browser APIs, the network connection and page rendering. Depending on the browser and settings, those signals can include the HTTP User-Agent header, navigator.userAgent, platform, screen dimensions, language, hardware concurrency, GPU and WebGL details, fonts, plugins, media-query results, canvas rendering, IP address and TLS characteristics. There is no fixed universal checklist: APIs and exposed values vary by release, operating system and privacy mode.
The useful question is not “What is the real value?” It is “Do these related claims fit together?” A browser that reports Windows in one place and unmistakable macOS-only rendering in another deserves investigation. A Tor or hardened Firefox user may also produce unusual combinations because reducing fingerprint uniqueness is the point of those products.
Why a single User-Agent check fails
User-Agent strings are easy to override and often contain compatibility tokens that do not describe the complete platform. A browser can send one value in the HTTP header while JavaScript exposes another. Even matching values do not prove authenticity.
#1 Best Overall
For website compatibility, do not build a “lie detector” around UA parsing. MDN describes UA detection as unreliable and recommends feature detection and progressive enhancement. Test whether a capability exists, such as CSS.supports(), a particular API, or an input type, instead of assuming it from a brand string. Anti-abuse systems have a different purpose, but they should still treat UA evidence as weak and corroborate it.
A practical consistency model
| Layer | What to compare | What a mismatch means |
|---|---|---|
| Transport | HTTP User-Agent, client hints when available, IP and TLS characteristics | A claim differs between network and browser layers; proxying, automation or normal intermediaries may explain it. |
| JavaScript identity | navigator.userAgent, navigator.platform, language, hardware concurrency |
Related properties do not describe a plausible configuration. |
| Capabilities | Feature support, media queries, plugins and APIs | The claimed browser appears unable to support—or unexpectedly supports—features for that configuration. |
| Rendering | WebGL vendor/renderer, canvas behavior, fonts and screen metrics | OS or device claims conflict with rendering or font evidence; virtual machines and privacy defenses can also cause this. |
| History | The same signals on later visits | Rapid or selective changes may indicate spoofing, but updates, setting changes, device changes and randomization are legitimate alternatives. |
These layers are evidence with different strength, not a score that identifies a person. A detector should record which rule fired, preserve the raw values securely, and let a reviewer or downstream policy decide what happens.
Build a browser-side evidence packet
The following diagnostic page collects ordinary, non-secret browser properties for a server-side comparison. It does not establish identity and should be covered by your privacy notice and retention policy.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →<script>
async function collectFingerprintEvidence() {
const canvas = document.createElement('canvas');
const gl = canvas.getContext('webgl') || canvas.getContext('experimental-webgl');
let webgl = {};
if (gl) {
const ext = gl.getExtension('WEBGL_debug_renderer_info');
webgl = {
vendor: ext ? gl.getParameter(ext.UNMASKED_VENDOR_WEBGL) : null,
renderer: ext ? gl.getParameter(ext.UNMASKED_RENDERER_WEBGL) : null
};
}
const media = query => window.matchMedia(query).matches;
return {
userAgent: navigator.userAgent,
platform: navigator.platform,
language: navigator.language,
languages: navigator.languages,
hardwareConcurrency: navigator.hardwareConcurrency ?? null,
deviceMemory: navigator.deviceMemory ?? null,
screen: { width: screen.width, height: screen.height, pixelRatio: devicePixelRatio },
timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
colorScheme: media('(prefers-color-scheme: dark)') ? 'dark' : 'light',
reducedMotion: media('(prefers-reduced-motion: reduce)'),
touchPoints: navigator.maxTouchPoints ?? 0,
webgl,
canvasDataUrl: canvas.toDataURL(),
time: new Date().toISOString()
};
}
collectFingerprintEvidence().then(data => {
fetch('/fingerprint-observation', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify(data),
credentials: 'same-origin'
});
});
</script>Do not treat a null, blocked or standardized value as suspicious by itself. Tor Browser, Firefox privacy features and other defenses can restrict fonts, alter canvas readback, standardize User-Agent values or reduce precision. A missing WebGL renderer may simply mean the API is disabled.
Compare the HTTP and JavaScript claims
Your server sees the request header; the page sees JavaScript properties. Store them together with a short-lived observation identifier, then apply explicit rules. Never silently assume that a reverse proxy preserved the original header.
// Node.js/Express example
app.post('/fingerprint-observation', express.json(), (req, res) => {
const uaHeader = req.get('user-agent') || '';
const js = req.body || {};
const findings = [];
if (uaHeader !== js.userAgent) {
findings.push({rule: 'ua-header-vs-js', severity: 'review'});
}
const saysWindows = /Windows/i.test(uaHeader + ' ' + js.userAgent);
const saysMac = /Mac OS X|Macintosh/i.test(uaHeader + ' ' + js.userAgent);
if (saysWindows && /MacIntel|MacPPC/i.test(js.platform)) {
findings.push({rule: 'platform-os', severity: 'review'});
}
res.json({findings});
});That example intentionally emits a review signal rather than a block. Production rules need an allowlist of known browser and operating-system combinations, tests for mobile and virtualized environments, and logging that distinguishes “value missing” from “value contradictory.”
Cross-attribute checks that are worth reviewing
User-Agent and platform
Compare the OS tokens in the HTTP header and JavaScript platform, but account for compatibility tokens and privacy standardization. A conflict is stronger when several independent properties agree against the claim.
Features and claimed browser
Use capability tests to select code paths. If an alleged old browser exposes a feature that could not exist in that release, record it as an anomaly only after checking polyfills, extensions and embedded webviews.
Fonts, WebGL and canvas
Fonts and graphics can reveal OS-related differences, while canvas output can change because of hardware, drivers, virtualization or anti-fingerprinting defenses. Compare broad plausibility, not a rigid “known-good” hash. The FP-Scanner work evaluated checks across User-Agent, platform, WebGL, plugins, media queries, fonts, browser features and canvas; its historical countermeasures and results do not prove that every current spoofing tool is detectable.
Screen, language and timezone
A New York timezone, French language and a very different IP geolocation may be perfectly normal for travel, a VPN or a multilingual user. These signals are context, not proof of account abuse.
Use time carefully
Store a versioned observation and compare later visits only when you have a lawful, user-understandable reason. A single attribute changing between visits can reflect an update, a new monitor, changed settings, a different device or intentional randomization. The 2024 FP-Inconsistent preprint proposes cross-attribute and over-time rules, but its evaluation used a specific honey-site deployment and cannot be converted into a universal error rate.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteFrom anomaly to risk decision
Separate detection from enforcement. A sensible pipeline is:
- Normalize values without erasing the raw observation.
- Run independent consistency rules and record each finding.
- Combine findings with account, rate and transaction context that you are permitted to use.
- Choose a proportionate response: allow, request step-up verification, rate-limit, or send to human review.
- Provide recovery when a privacy browser or false positive is blocked.
Do not block solely because a visitor uses Tor or another privacy-focused browser. Tor documents that inconsistencies can cause anti-bot systems to classify users as bots and deny requests. WebKit likewise notes that anti-tracking changes can affect fraud prevention, bot detection and client-authentication practices. A privacy choice is not evidence of malicious intent.
What published measurements do—and do not—show
The FP-Inconsistent authors reported more than half a million requests from 20 bot services in a 2024 preprint. In that deployment, average evasion was 52.93% against DataDome and 44.56% against BotD; their inconsistency rules reduced measured evasion by 48.11% and 44.95%, respectively. Those figures describe that sample, setup and two services, not current vendor performance or detector accuracy in general.
The FP-Scanner paper is a historical evaluation of particular countermeasures. It supports the value of multi-signal checks, not a guarantee that every spoofing technique will be found.
Free tools Windows power users keep installed
One-click scans. No signup required.
Common implementation failures
| Symptom | Likely cause | Fix |
|---|---|---|
| Every visitor has a UA mismatch | A proxy rewrites the header or the comparison uses different normalization. | Capture the header at the edge, normalize casing and whitespace, and test direct and proxied requests. |
| Privacy-browser users are blocked | Missing or standardized values are scored as hostile. | Downgrade those rules, add a recovery path and test Tor, Firefox protections and common extensions. |
| Mobile users trigger desktop rules | Responsive browsers expose compatibility tokens or unusual screen metrics. | Segment mobile and embedded webviews before applying desktop assumptions. |
| Canvas or WebGL differs on repeat visits | GPU/driver changes, virtualization or anti-fingerprinting randomization. | Use broad consistency checks and avoid exact hashes as identity. |
| Legitimate users cannot appeal | The risk score is used as an irreversible block. | Offer email, support or step-up verification and retain an explanation code. |
Or skip the browser setup
If your goal is to capture a clean reference image of a page while investigating rendering differences, ScreenshotNeo provides a website screenshot API and MCP server. A single request can return PNG, JPEG, WebP or PDF:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo documentation for options. Before capture it can accept cookie or consent banners and remove more than 60 known consent platforms, newsletter popups and chat widgets; each step can be disabled. Bot checks/CAPTCHAs, blank pages, timeouts, failed loads and cache hits cost nothing, and response headers identify the page verdict and whether it was billed. Its MCP server exposes take_screenshot, get_page_info and capture_pdf to Claude, Cursor and other MCP clients.
Plans include 1,000 screenshots a month free with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account to try it.
FAQ
Can a website tell that I changed my fingerprint?
It can notice that related observations changed, but it cannot determine why from fingerprint data alone. Updates, new devices, settings and privacy randomization are plausible explanations.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchIs a spoofed User-Agent illegal?
A User-Agent is a client-controlled request value. Its legal and contractual implications depend on the service and use; the value alone does not establish fraud.
Should I collect every available fingerprint signal?
No. Collect only what your purpose requires, document retention and access, and follow applicable privacy obligations. More signals increase both privacy impact and false-positive opportunities.
What should I use for normal browser compatibility?
Use feature detection and progressive enhancement. UA parsing is a fallback for narrow, documented cases, not a general capability test.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
