Deep-dives on browser fingerprinting and anti-detect technology: canvas, WebGL/WebGPU, fonts, audio, TLS/JA3, cross-consistency and how modern bot detection really works.https://liarjs.dev/en-ushttps://liarjs.dev/blog/anti-detect-royal-rumble/https://liarjs.dev/blog/anti-detect-royal-rumble/Every vendor publishes a table where it wins. The one independent, controlled comparison inverts the marketing order, and the open-source tools tell a different story again.Sat, 31 Oct 2026 00:00:00 GMTBenchmarksbenchmarkgologinkameleooctonodriverpatchrighthttps://liarjs.dev/blog/emoji-rasterisation/https://liarjs.dev/blog/emoji-rasterisation/Apple Color Emoji, Segoe UI Emoji and Noto Color Emoji are three different fonts with three different pictures for the same codepoints. None of them is redistributable except the last, and canvas reads all of them.Wed, 28 Oct 2026 00:00:00 GMTFontsemojicanvaszwjos-detectionhttps://liarjs.dev/blog/anti-bot-vendor-stack/https://liarjs.dev/blog/anti-bot-vendor-stack/A site isn't hard because of the site. It's hard because of the anti-bot vendor behind it. Here's the difficulty ladder and the signature artifacts of each stack.Sat, 24 Oct 2026 00:00:00 GMTBot detectionkasadaakamaidatadomecloudflareperimeterximpervahttps://liarjs.dev/blog/keyboard-layout-map/https://liarjs.dev/blog/keyboard-layout-map/One promise, no permission prompt, and out comes a map of every key on the keyboard to the character it produces. It names your layout, and one entry names your operating system outright.Wed, 21 Oct 2026 00:00:00 GMTLocalekeyboardlayoutregionchromium-onlyhttps://liarjs.dev/blog/webrtc-ip-leaks/https://liarjs.dev/blog/webrtc-ip-leaks/WebRTC can hand a site your real IP from behind the proxy through ICE candidates. Blocking it is not the fix. The fix is making the exposed IP agree with your connection.Sat, 17 Oct 2026 00:00:00 GMTWebRTCicemdnsip-leakproxyhttps://liarjs.dev/blog/textmetrics-beyond-width/https://liarjs.dev/blog/textmetrics-beyond-width/Metric-compatible substitutes match advance widths by design. They do not match the font bounding box, the ink extents or the baselines, and measureText returns all of those from the same call.Wed, 14 Oct 2026 00:00:00 GMTFontstextmetricsmeasuretextmetric-compatiblebaselineshttps://liarjs.dev/blog/tls-ja3-ja4-network-layer/https://liarjs.dev/blog/tls-ja3-ja4-network-layer/Before a line of your JS runs, the TLS handshake and HTTP/2 frames have already fingerprinted the client. It's the wall a JS-layer spoof can't touch and the place where a real Chrome build pays off.Sat, 10 Oct 2026 00:00:00 GMTNetwork layertlsja3ja4http2ja4hnetworkhttps://liarjs.dev/blog/version-lag-fingerprint/https://liarjs.dev/blog/version-lag-fingerprint/Chrome ships a major every four weeks and updates itself without asking. A browser several versions back is not a user who forgot, it is a pinned build, and that narrows the anonymity set before anything else is read.Wed, 07 Oct 2026 00:00:00 GMTEngineeringversionuser-agentclient-hintsanonymity-setrelease-cadencehttps://liarjs.dev/blog/domrect-subpixel/https://liarjs.dev/blog/domrect-subpixel/getClientRects returns floating-point layout geometry that varies by device and CreepJS hides a hardcoded hash that only fires when devicePixelRatio equals 1.Sat, 03 Oct 2026 00:00:00 GMTGeometrydomrectgetclientrectssubpixeldatadomedevicepixelratiohttps://liarjs.dev/blog/bisect-the-block/https://liarjs.dev/blog/bisect-the-block/A rejection tells you nothing about which of forty signals caused it. One variable at a time, a control arm on both ends, and the discipline to accept that four fixes in a row changed nothing.Wed, 30 Sep 2026 00:00:00 GMTMethodmethodologybisectdebuggingdetectionexperiment-designhttps://liarjs.dev/blog/workers-offscreencanvas/https://liarjs.dev/blog/workers-offscreencanvas/Detectors re-read identity inside a Web Worker and re-run canvas in OffscreenCanvas, a favorite way to catch spoofs that only hooked the main thread.Sat, 26 Sep 2026 00:00:00 GMTWorkersoffscreencanvasworkernavigatorconsistencyhttps://liarjs.dev/blog/android-plugin-face/https://liarjs.dev/blog/android-plugin-face/Chrome on Android is built without the PDF viewer, so navigator.plugins is empty, mimeTypes is empty and pdfViewerEnabled is false. A desktop build wearing a phone persona reports 5, 2 and true.Wed, 23 Sep 2026 00:00:00 GMTNavigatorpluginspdfandroidmobilebuild-flagshttps://liarjs.dev/blog/plugin-face-version-consistency/https://liarjs.dev/blog/plugin-face-version-consistency/navigator.plugins looks vestigial, but its exact shape is pinned to the Chrome version, and a stale plugin face is a clean contradiction detectors love.Sat, 19 Sep 2026 00:00:00 GMTNavigatorpluginsmimetypesversion-consistencyuachhttps://liarjs.dev/blog/touch-that-never-touches/https://liarjs.dev/blog/touch-that-never-touches/A mobile persona sets maxTouchPoints and pointer:coarse and passes every static check. Then the page listens, and every event that arrives is a mouse event from a machine with a mouse.Wed, 16 Sep 2026 00:00:00 GMTBehaviortouchpointer-eventsmobilecoalesced-eventsistrustedhttps://liarjs.dev/blog/native-function-integrity/https://liarjs.dev/blog/native-function-integrity/Every getter you redefine in JavaScript leaves a residue a lie-detector can read. The split between JS-patched and engine-level browsers shows up in one toString() call.Sat, 12 Sep 2026 00:00:00 GMTArchitecturestealthtoStringproxyengine-leveldetectionhttps://liarjs.dev/blog/gpu-capability-tables/https://liarjs.dev/blog/gpu-capability-tables/Rewriting UNMASKED_RENDERER takes one line. The extension list, the WebGPU feature set and the shader precision table underneath it are produced by the driver, and they name the chip that is really there.Wed, 09 Sep 2026 00:00:00 GMTWebGLwebgpuextensionsangleform-factorhttps://liarjs.dev/blog/timezone-vs-ip/https://liarjs.dev/blog/timezone-vs-ip/A US exit IP paired with an Asia/Singapore browser clock is one of the cheapest, most reliable bot tells there is, and two well-funded anti-detect browsers shipped exactly that.Sat, 05 Sep 2026 00:00:00 GMTGeolocationtimezonegeoipintlproxyconsistencyhttps://liarjs.dev/blog/window-screen-geometry/https://liarjs.dev/blog/window-screen-geometry/Screen spoofing usually rewrites screen.width and stops there. The window, its position, the menu bar inset and the multi-monitor flag all keep describing the real display, and they have to agree with each other.Wed, 02 Sep 2026 00:00:00 GMTScreenviewportgeometryisextendedwindow-managementhttps://liarjs.dev/blog/audio-fingerprinting-silence/https://liarjs.dev/blog/audio-fingerprinting-silence/The Web Audio fingerprint is stable to many decimal places and the fastest way to fail it is to add noise where a real browser outputs pure zeros.Sat, 29 Aug 2026 00:00:00 GMTAudiowebaudioofflineaudiocontextcompressornoisehttps://liarjs.dev/blog/api-surface-census/https://liarjs.dev/blog/api-surface-census/Chromium decides which Web APIs exist per platform, at build and configuration time. A desktop binary running a phone persona still answers typeof navigator.hid with 'object', and no identity layer moves that answer.Wed, 26 Aug 2026 00:00:00 GMTMobileapi-surfaceandroidpersonaform-factorruntime-featureshttps://liarjs.dev/blog/font-metrics-collapse/https://liarjs.dev/blog/font-metrics-collapse/An allow-list can put Segoe UI in the enumerable font set on a Mac. It cannot give it metrics. Every family the host has no file for measures the same width, and that one number is enough to call the persona a lie.Wed, 19 Aug 2026 00:00:00 GMTFontsmeasuretextcross-ospersonahost-leakshttps://liarjs.dev/blog/webgpu-gpu-triad/https://liarjs.dev/blog/webgpu-gpu-triad/WebGPU exposes a second, independent view of your GPU. If it disagrees with WebGL and the UA platform, the spoof falls apart. Most anti-detect browsers shipped that mismatch for years.Wed, 19 Aug 2026 00:00:00 GMTWebGPUgpuadapter-infoconsistencycross-interfacehttps://liarjs.dev/blog/webgl-whole-parameter-set/https://liarjs.dev/blog/webgl-whole-parameter-set/Spoofing UNMASKED_RENDERER is the easy 5%. Detectors read dozens of getParameter values, shader precision and the actual rendered pixels and 'self-consistent' is not the same as 'believable'.Wed, 12 Aug 2026 00:00:00 GMTWebGLgpugetparameterreadpixelsself-consistencyhttps://liarjs.dev/blog/automation-cdp-tells/https://liarjs.dev/blog/automation-cdp-tells/A flawless fingerprint won't hide the driver. navigator.webdriver, CDP execution-context leaks and headless tokens are a separate axis every serious detector checks.Fri, 07 Aug 2026 00:00:00 GMTAutomationcdpwebdriverplaywrightpuppeteerrebrowserheadlesshttps://liarjs.dev/blog/font-fingerprinting-offsetwidth/https://liarjs.dev/blog/font-fingerprinting-offsetwidth/The dominant font-enumeration technique never calls a font API at all. It measures span widths. That is why patching document.fonts alone gets you caught, and why CJK fonts leak your real OS.Wed, 05 Aug 2026 00:00:00 GMTFontsoffsetwidthmeasuretextcjkenumerationhttps://liarjs.dev/blog/creepjs-lie-detector/https://liarjs.dev/blog/creepjs-lie-detector/CreepJS doesn't only collect signals. It proves them self-consistent. Here are the four invariant classes that catch spoofers even when their noise is perfectly stable.Wed, 29 Jul 2026 00:00:00 GMTLie detectioncreepjsliesinvariantscanvasaudiodomrecthttps://liarjs.dev/blog/canvas-deterministic-noise/https://liarjs.dev/blog/canvas-deterministic-noise/Anti-detect browsers get caught on canvas because their noise changes between two identical reads. The size of the noise is almost beside the point. Determinism is the whole game.Wed, 22 Jul 2026 00:00:00 GMTCanvasnoisecreepjsdeterminismhttps://liarjs.dev/blog/two-layers-cross-consistency/https://liarjs.dev/blog/two-layers-cross-consistency/A perfect JavaScript fingerprint still fails if it disagrees with the network layer. Modern detection is a cross-layer consistency problem, not a collection problem.Wed, 15 Jul 2026 00:00:00 GMTFoundationsconsistencycross-layerdetectiontls