The full browser fingerprint report

A browser fingerprint is the combination of signals a website can read from your browser, User-Agent, screen size, fonts, canvas rendering, WebGL hardware, timezone, language, plugins, and dozens of other properties. Together those signals are usually unique enough to identify a specific device, even with cookies disabled. Sites use this for tracking and for bot detection.

Proxies only change your IP. They don't change your fingerprint. If your headless browser still reports navigator.webdriver=true, missing chrome.runtime, an unusual WebGL renderer like 'Google SwiftShader', or a timezone that doesn't match the proxy's country, you're flagged regardless of how clean the IP is. Run the test on this page to see what you're actually leaking.

Start with stealth plugins (puppeteer-extra-plugin-stealth, playwright-stealth, undetected-chromedriver). Then patch the obvious leaks: spoof navigator.webdriver, fix the WebGL UNMASKED_RENDERER_WEBGL string, match timezone and language to your proxy, ensure window.chrome exists, and check that Notification.permission isn't stuck on 'denied'. Test after each fix using this page.

Yes, via the WebGL UNMASKED_RENDERER_WEBGL extension, sites can read your real GPU vendor and model. Headless browsers running in cloud VMs typically report things like 'Google SwiftShader' or 'llvmpipe', which is an instant bot signal. Spoofing this requires patching the WebGL extension at the driver level.

A site draws text and shapes onto a hidden HTML canvas, then reads back the pixel data and hashes it. Tiny differences in your GPU, drivers, anti-aliasing, and font rendering produce a stable hash unique to your hardware. Two clean Chrome installs on identical OSes will still produce different hashes if the GPUs differ.

Almost entirely client-side. Canvas, WebGL, audio, fonts, WebRTC, hardware, screen, permissions, storage, plugins, timezone, and locale all run in your browser and never leave it. Two sections do call the server, /http-headers and /tls, because HTTP request headers and TLS handshake data aren't visible to JavaScript. Those endpoints (/api/headers.php and /api/tls.php) reflect the request back to you and store nothing.

Yes, but disclosure is regulated under GDPR (EU) and similar privacy laws, sites using fingerprinting for tracking generally need consent. For bot detection (your case as a scraper) it's universal and unregulated.

Don't randomize blindly, bot detectors check whether your User-Agent string matches your other signals. A Windows UA with a macOS timezone and Linux WebGL renderer is a giveaway. Pick a real, current UA (Chrome on Windows is safest), then make sure platform, languages, timezone, and screen size all match a real machine with that UA. The /user-agent page on this site shows what your current UA actually claims.