Browser Fingerprint Consistency Check
Do Your Signals Agree?
Every other fingerprint test measures how unusual you are. This one measures whether you are possible. Your user agent claims an operating system, your GPU implies one, your timezone implies a place and your IP implies another — and a browser whose answers contradict each other is far easier to spot than one that is merely rare.
Reading your signals and cross-checking them…
—
Every raw value this used
Quick Answer: Uniqueness or Consistency?
Uniqueness asks how rare your browser is. Consistency asks whether it is possible. A Windows user agent reporting an Apple GPU is not rare — it cannot happen. Detectors act on impossible far faster than on rare.
Robert Harrison
OSINT and Network Utility Expert
Robert works on network diagnostics and the practical end of IP tooling — the conversions, lookups and calculations that sit underneath everything else.
Every fingerprinting tool I have used answers the same question: how rare are you. It is a real number and it is not the one that gets people blocked. What gets you blocked is a user agent claiming Windows while the GPU string says Apple, or a timezone in one hemisphere and an IP in the other. Nothing rare about either. Just impossible.
So this page scores coherence instead, and it is honest about which of the nine checks deserve weight. Engine detection is hard to fake and counts for a lot. Language against IP country is nearly meaningless on its own — plenty of people abroad run an English browser — and counts for little. A tool that treats those two as equal signals is telling you something it cannot know.
Last reviewed 25 August 2026 · The checks run in your browser · Country lookups are cached by network, never by address
View all articles by Robert HarrisonWhy Does Coherence Matter More Than Rarity?
Because a detector does not need to recognise you. It only needs to notice that your story does not hold together.
That is a much cheaper thing to check.
Uniqueness tools answer a genuine question: out of everyone who has visited, how many share your exact combination of values? If the answer is "nobody", you are trackable. That is worth knowing and it is what AmIUnique and Cover Your Tracks were built for.
But consider what a fraud system actually looks at. It does not have a database of every browser on earth to compare you against. What it has is a set of rules about what is possible, and those rules are cheap to write and almost impossible to argue with.
A Windows user agent reporting an Apple M-series GPU is not unusual. It is impossible. Apple does not make graphics hardware that runs under Windows, so no real machine produces that pair. There is no probability to weigh and no false-positive rate to worry about — the combination simply cannot occur, and any system that checks for it catches every instance.
One tool does measure this, and it is worth knowing about
It would be wrong to claim nobody checks coherence. CreepJS does, and it does it far deeper than this page — it inspects JavaScript object prototypes for tampering, runs signals across worker threads to catch disagreement between contexts, and reports what it calls "lies". It is open source, it is the benchmark privacy researchers and antidetect vendors measure their work against, and if you want the most thorough answer available you should run it.
So the difference here is not novelty. It is legibility.
CreepJS produces a research report — twenty-plus categories, several seconds of probing, a wall of technical output, and a trust score that even a clean unmodified browser rarely maxes out. That is the correct design for a benchmark and a poor one for somebody who just wants to know why a site keeps challenging them.
This page runs ten named checks, tells you what each one compared, how much it should count, and what to do about it. A clean browser should score 100 here, because every check is one that has no business failing on an ordinary machine. If you want depth, go to CreepJS. If you want to understand the answer, start here.
Where uniqueness and coherence disagree
They come apart in both directions, which is why one number cannot stand in for the other.
- Perfectly coherent, completely unique. A rare screen resolution on an unmodified laptop contradicts nothing and still identifies you across every site you visit.
- Perfectly ordinary, obviously modified. A user agent spoofed to the most common Chrome-on-Windows string in the world, running on a Mac. Low uniqueness, and the renderer gives it away immediately.
The second case is the one nothing else on the internet measures. It is also the one people run into when they cannot work out why a site keeps challenging them despite a fingerprint that looks unremarkable.
Who actually runs into this
Four groups, and they want opposite things from the same number.
- Privacy users who added a user-agent switcher and made themselves more distinctive rather than less. The tracking they were trying to avoid got easier, not harder.
- People doing multi-account work in an antidetect browser, who need a profile that holds together and want to know which part of it does not.
- QA and automation engineers whose Puppeteer or Playwright run keeps hitting a challenge page, usually because a headless browser reports a software renderer while claiming to be a desktop.
- Anyone behind a VPN or proxy wondering why one site is fine and another asks for a captcha every visit.
The first group usually wants to undo something. The second wants to fix it properly. The third has a bot detection problem and does not always know it. The fourth mostly needs reassurance that a location mismatch is normal.
What a mismatch actually costs you
Very little, if you are simply browsing with a VPN — the location mismatch is the VPN doing its job and nobody sensible treats it as fraud on its own. It costs a great deal if you are trying to present as an ordinary local user, because the contradiction is the single cheapest thing for a detector to key on.
Which is why the score here comes with a verdict rather than just a number. A 78 caused by a VPN and a 78 caused by a spoofed platform mean completely different things.
What Are the Ten Checks, and Which Ones Are Weak?
They are not equally trustworthy and it would be dishonest to weight them equally. Here is what each one compares and how much it deserves to count.
One note on what is not flagged. Android reports its platform as Linux armv8l, ChromeOS as Linux x86_64, and an iPad reports MacIntel whatever its user agent says. Those are ordinary and the checks know it — a tool that treated them as contradictions would fail every Android visitor on a strong signal.
| Check | Compares | Weight | Why |
|---|---|---|---|
| Engine vs claimed browser | CSS feature support vs user agent | Strong | A rendering engine cannot pretend to be another one from inside the page |
| GPU vs claimed OS | WebGL renderer vs user agent | Strong | Apple silicon does not run under Windows. No probability involved |
| Platform vs claimed OS | navigator.platform vs user agent | Strong | Two places the OS is stated; they should never disagree |
| Header vs JS language | Accept-Language vs navigator.language | Strong | Same setting read two ways. A gap means something rewrote one |
| Timezone vs clock offset | IANA zone vs getTimezoneOffset() | Strong | Catches a zone name set without the offset following it |
| Client hint vs device | userAgentData.mobile vs user agent | Strong | Set by the engine, not parsed from the string, so a switcher leaves it behind |
| Screen coherence | Resolution, pixel ratio, available area | Medium | Impossible combinations are clear; unusual ones are just unusual |
| Timezone vs IP country | IANA zone vs geolocated country | Medium | Real for detection, but a VPN produces it legitimately every time |
| Touch vs form factor | Touch points vs claimed device | Medium | A phone reporting no touch support is a strong tell; the reverse is not |
| Language vs IP country | Primary language vs country | Weak | Millions of people abroad run an English browser. Nearly meaningless alone |
The one that catches virtual machines
Buried in the GPU check is a signal worth knowing about on its own. If the WebGL renderer reports SwiftShader, llvmpipe or Mesa OffScreen, the page is being drawn by the processor rather than a graphics card.
That is completely normal in a container, a virtual machine or a headless browser, and distinctly odd on the desktop your user agent is claiming to be. It is one of the clearest available signals that a browser is not what it says, and it costs a detector nothing to check.
Two of these have pages of their own here. The timezone-against-IP check is covered in much more depth by the timezone audit, and the real-IP-behind-a-VPN question belongs to the WebRTC leak test. This page runs them as two of nine and points you there for the detail rather than repeating it.
What Should You Actually Do About a Low Score?
Start by deciding whether you care. For a lot of people the honest answer is no.
If you are just browsing privately
A VPN in another country will drop your score and that is the VPN working. Your IP says Amsterdam, your clock says Karachi, and no ordinary website is going to do anything about it. Fixing that mismatch would mean changing your system timezone to match your exit node every time you connect, which is a lot of effort to look slightly more Dutch.
The checks worth acting on here are the ones that are not about location: a platform that disagrees with your user agent, or a language header that disagrees with your JavaScript. Those usually mean an extension is rewriting something, and an extension rewriting your headers badly is making you more distinctive, not less.
The most common own goal is a user-agent switcher. Changing the string is one line; changing everything downstream of it is not. The extension rewrites your user agent and leaves navigator.platform, the WebGL renderer, the engine and the feature set exactly as they were.
So instead of looking like a common browser, you now look like a browser that is lying — a far smaller and far more interesting group to be in.
If you are trying to present as one coherent machine
Then the order to fix things in follows the weights, because effort spent on a weak signal is wasted.
- Platform and renderer first. These cannot be argued with and they are checked constantly. If they disagree with your user agent, nothing else you do matters much.
- Engine second. Claiming a browser whose engine features you do not have is the same class of error and just as cheap to detect.
- Timezone and language third — set them to match your exit location rather than your real one, and set both the header and the JavaScript value together.
- Screen metrics last. Genuinely impossible combinations are worth fixing; merely unusual ones are only a uniqueness problem, which is a different page's concern.
And check the layer below all of this. If everything here reads clean and something still challenges you, the answer is usually in the TLS handshake, which no JavaScript can reach — the JA3 fingerprint page reads that. The browser info page lists every value you expose if you want the raw enumeration rather than the cross-check.
What this cannot see
JavaScript reads what the browser chooses to expose. Several of the strongest signals sit below that.
TLS and HTTP/2 are invisible here
Your TLS handshake and HTTP/2 frame order are set by the network stack before any page code runs. That is precisely why detectors like them — a browser cannot lie about them from inside itself. The JA3 page reads that layer.
A high score is not anonymity
Coherent and unidentifiable are different properties. A perfectly consistent fingerprint can still be perfectly unique, and a unique one follows you across sites regardless of how well it holds together.
Some signals are being taken away
Browsers are steadily reducing what pages can read — navigator.platform is deprecated, font enumeration is restricted, renderer strings are being blurred. Checks that work today may quietly stop working, and a check that cannot run is reported as skipped rather than passed.
Country data is approximate
Geolocation is accurate at country level for most commercial address space and wrong often enough to matter for recently transferred blocks, satellite links and some mobile carriers. The two checks that depend on it are weighted accordingly.
For the individual signals in isolation, the canvas test and the font leak tester go deeper than a cross-check can.
And the full browser leak audit covers what escapes rather than what contradicts.
Frequently asked questions about fingerprint consistency
What is a browser fingerprint consistency check?
It tests whether the signals your browser reports agree with each other. Your user agent claims an operating system, your GPU renderer implies one, your timezone implies a location and your IP address implies another. When those answers contradict, something is rewriting them — and that contradiction is far more detectable than any single unusual value.
How is consistency different from uniqueness?
They measure opposite things. Uniqueness — what AmIUnique and Cover Your Tracks report — is how rare your combination of values is among their visitors. Consistency is whether your values are internally possible. A completely ordinary, low-entropy fingerprint can still be obviously modified, because a Windows user agent reporting an Apple GPU is not rare, it is impossible. Detectors act on the impossible far more readily than on the rare.
Is this the same as CreepJS?
No, and CreepJS is the deeper tool — it inspects JavaScript prototypes for tampering, compares signals across worker threads, and is the benchmark researchers and antidetect vendors measure against. If you want the most thorough answer available, run it. The difference is legibility: CreepJS produces a research report across twenty-plus categories, and even a clean browser rarely maxes its trust score. This page runs ten named checks and tells you what each compared, how much it counts and what to do — and a clean browser should score 100, because every check here is one that has no business failing on an ordinary machine.
What score should I be aiming for?
It depends entirely on what you are doing. If you are not trying to look like anything in particular, a score below 100 is worth understanding but not worth fixing — a VPN in another country produces a location mismatch, and that is the VPN working. If you are trying to present as one coherent machine, anything under 100 is a thread somebody can pull.
Why does my score drop when I use a VPN?
Because your IP now says one country and your timezone and language still say another. That is a genuine inconsistency and the check is right to flag it. Whether it matters is your call — for privacy it is usually irrelevant, and for anything where you are trying to look like a local user it is the first thing that gives you away. The timezone audit goes into that one check in more depth.
Which of these checks are actually reliable?
Not all of them, and the results say so per check. Strong: engine detection against the claimed browser, GPU renderer against the claimed operating system, the client hint that the engine sets rather than the string, and header language against JavaScript language. Weak: language against IP country — plenty of people abroad run an English browser and always will. The score is weighted so a weak signal cannot sink it on its own.
Why is my Android phone not flagged for reporting Linux?
Because Android is Linux, and reporting Linux armv8l is what every Android browser does. The same goes for ChromeOS, and for an iPad reporting MacIntel no matter what its user agent says. Those three pairings are permitted deliberately — a checker that treated them as contradictions would fail every Android visitor on a strong signal, which says more about the checker than the phone. A Windows user agent on a Mac platform is still flagged, because that one has no innocent explanation.
What is a software renderer and why does it matter?
It means the page is being drawn by the CPU rather than a graphics card — renderer strings like SwiftShader or llvmpipe. That is normal in a virtual machine, a container, or a headless browser, and unusual on a real desktop. Combined with a normal desktop user agent it is one of the clearest signals available that the browser is not what it claims to be.
Can this tool see my TLS or HTTP/2 fingerprint?
No, and no JavaScript can. Those are set by the network stack before any page code runs, which is exactly why they are useful to detectors — a browser cannot lie about them from inside itself. The JA3 TLS fingerprint page reads that layer. If your JavaScript signals are perfectly coherent and something still flags you, this is usually where to look next.
Does a perfect score mean I am anonymous?
No — it means nothing contradicts. Those are different claims. A perfectly coherent fingerprint can still be perfectly unique, and a unique fingerprint tracks you across sites whether or not it is coherent. Consistency is about not standing out as modified; uniqueness is about not standing out at all. You need to think about both, and this page only measures one.
Why does the IP country check sometimes not run?
Because the country lookup depends on an outside service, and when it does not answer the page says so rather than guessing. Everything computed in your browser still runs. The lookup is also cached by network block rather than by address — a privacy tool has no business writing individual visitor addresses to disk.
Is any of this sent to a server?
The nine checks run in your browser and the results are not transmitted or stored. The one thing the server sees is your IP address, which it already had by virtue of you loading the page, and it is used to look up a country and nothing else.
Related privacy tools
The individual signals, in depth.
Browse the full set on the TrustMyIP tools directory.
Last updated 25 August 2026 · Checks run in your browser · Country lookups cached by network, never by address