liarjs.dev

Browser fingerprint test: Can your browser fool me?

I read your browser in JavaScript, then ask the network layer what it actually saw. A browser controls its own JavaScript; it does not control the network it connects over. Every disagreement is a finding - and then I check whether a hand is driving you at all.

Analyzing your browser…

Provisional, and 8 points short: a coherent environment still does not prove a hand is here. Hit Human challenge and keep the pointer moving for a few secondsdrag a finger around this page for a few seconds - no clicking or tapping needed. How I score you ↓

Your IP
…
Timezone
…
WebRTC
…
Inconsistencies & lies

Your live scan. Every check below is computed in your browser right now.

Single tests
  • WebRTC leak testAsks a public STUN server for your address and compares it with the IP this connection came from.
  • Bot detection testOnly the automation axis: webdriver, framework residue, DevTools-protocol traces and headless tells.
  • Headless browser detection testThe checks that tell headless Chrome from a windowed one: UA token, browser UI height, software GPU, empty device list.
  • Canvas fingerprintDraws the same canvas twice and compares the reads; noise that changes between them is a spoof. Runs in the scan above.
  • WebGL and WebGPUTwo independent views of your GPU, which must name the same chip. Runs in the scan above.
  • FontsChecks that the fonts your browser lists can actually be measured on this host. Runs in the scan above.
  • Timezone vs IPBrowser clock against the timezone of the IP the edge saw. Runs in the scan above.
  • TLS and HTTP versionWhat the handshake negotiated, read at the edge where JavaScript cannot reach. Runs in the scan above.
How I score you

The score is internal coherence, and it is not a ban prediction. It starts from one question: does this browser's JavaScript story agree with itself, and with what the network layer saw? A coherent story is not proof that a person is here, so the challenge next to the score asks the second question directly, and until you answer it the score stays provisional.

Detection runs on three separate axes, and they fail independently.

  • Fingerprint · does this look like a real device? Canvas, WebGL, WebGPU, audio, fonts, timezone, the plugin face. measured here
  • Network · does the wire agree with the page? TLS version, HTTP protocol, ASN, header shape, exit-IP geography. measured here
  • Automation · is a program driving this browser? Passively:navigator.webdriver, a removed webdriver property, framework residue, headless GPU and device tells. Then by challenge: coalesced pointer samples, path curvature, event timing.measured here

Two things are worth being blunt about. First, the behavioural layer runs only on liarjs.dev: the open-source package ships the passive probes, not the challenge. Second, a completely unpatched, headed Chrome has nothing inconsistent about its environment. Stock Playwright and Puppeteer still give themselves away on this site, because the DevTools domain they switch on for every page leaves traces I can read. A driver that never switches it on leaves none, and the passive layer may well find nothing. That is exactly why the challenge exists, and why a score you never verified stays provisional instead of turning green. Why the axes are orthogonal →

Same scan, in your terminal

The checks above are an open-source package. Point it at a browser you're building (a patched Chromium, a stealth automation stack, an anti-detect profile) and get the same score with an exit code, in CI, before a silent regression becomes a ban rate.

How the package works →11 stealth setups, scored →GitHub ↗npm ↗
npx liarjs
Field notes

How each of these dimensions actually works, one at a time, from reverse-engineering real detectors and testing real anti-detect browsers.

All field notes →