What CreepJS and Pixelscan Measure, and Why Consistency Matters
Fingerprint checkers get quoted a lot and explained rarely. People paste a score into a chat and move on, without asking what the tool was looking at. This post explains what the common checkers read, why they care about the settings agreeing with each other, and what that means for anyone configuring browser profiles for QA, agency work or privacy.
It deliberately does not rank browsers by how they score. A reading from one tool on one day is a snapshot of a configuration, and those tools change.
Check your own browser first. JustBrowser has a public checker at justbrowser.app/fingerprint-checker that runs client-side, with no signup. It compares WebRTC candidates against your public IP, and it checks whether the IP's location has a UTC offset that agrees with your browser's timezone. Running it before reading on puts your own numbers next to the signals below.
What a Fingerprint Is
When a page loads, it can read a lot from the browser without asking: how the graphics stack draws a hidden canvas, which WebGL renderer is reported, how the audio stack processes a test signal, which fonts are installed, the screen size, the language and the timezone. Together these form a fingerprint. Site owners use it for fraud prevention, analytics and abuse detection. Privacy-minded users care because it can recognise a visitor without cookies.
These checkers read what JavaScript on the page can see. The network connection carries a fingerprint of its own, which the server reads from the TLS handshake; the JA4 TLS fingerprinting guide covers that layer.
The part that matters for configuration is that these signals are checked against each other. A browser that reports one graphics card while its canvas output looks like another is inconsistent. So is a profile whose timezone says Chicago while the proxy exits in Frankfurt.
The Four Checkers People Mention
CreepJS is a research-style tool. It reads canvas, WebGL, audio, fonts, screen and navigator values and looks for places where the values disagree with each other or with what the platform would normally report. It is a good way to see how many signals a page can read at all.
Pixelscan concentrates on agreement between layers: WebRTC against the public IP, timezone against location, and whether the reported browser details form a coherent whole.
BrowserScan runs a long list of individual checks, including the WebGL renderer, audio context and hardware concurrency, and reports on each one.
IPHey looks at the network side: IP and proxy quality, DNS leaks, and how those relate to the browser's own reported settings.
None of them is authoritative. Each weights things differently, so two tools can read the same profile differently and both can be right about what they measure. Production detection systems combine signals like these with behaviour and network data; how AI-driven bot detection works explains that side for site owners.
Why Consistency Matters
The same few mismatches show up again and again when a profile is misconfigured:
- Rendering versus reported hardware. If the WebGL renderer string names one GPU but the canvas output or the list of supported extensions belongs to another, the pieces do not agree. Changing a reported string is easy. Making the rendering pipeline agree with it is harder, which is why engine-level changes differ from extension-level ones. JustBrowser applies its identity parameters inside a custom Chromium engine with native C++ integration, patched on every upstream release, rather than as a script injected into a page.
- Audio. The audio stack exposes several values. If one is changed and a related one is not, the pair disagrees.
- Timezone, locale and network. A timezone offset that does not match the proxy region, or one that ignores daylight saving rules for the stated location, is a plain configuration error.
- Stability across runs. A profile that returns a different canvas result every time it opens looks unstable, not private. A profile should present the same identity each time.
- WebRTC. If WebRTC exposes an address different from the proxy, the network layers disagree. JustBrowser's WebRTC protection exists so the profile's WebRTC does not expose the real IP.
For the lesser-known signals, see the audio, font and hardware fingerprinting deep-dive.
Using a Checker the Right Way
Treat a checker as a linter for your own configuration:
- Create a fresh profile and assign the proxy it will use.
- Set timezone and language to match the proxy region.
- Open one or two checkers and read the specific flags, not just the headline.
- Fix the mismatch the flag points to, then re-check.
- Re-check later. The tools update, and so do browsers. A profile set up once does not stay current forever, one of the multi-account browser myths worth knowing.
Do not read a clean result as a promise about how any website will respond, and do not read a flag as proof of anything beyond the specific disagreement it names. A browser does not make anyone invisible, and what people get wrong about multi-account browsers starts there. JustBrowser also exposes a consistency report through its local API at GET /profiles/{id}/fingerprint/validate, which is useful in a setup script; the Playwright and Puppeteer guide shows how to connect a script to a profile over that API.
Where This Applies
- QA teams testing a site across regions, timezones and devices need profiles whose settings agree, or the test measures the configuration rather than the site. The ad verification workflow applies the same idea to checking ads across geos.
- Agencies working in client accounts keep each client in its own profile with its own cookies, storage and proxy, and use team sharing so colleagues can open a profile without logging in again. Each client account should be one the agency has permission to use, under that platform's rules. For Meta, see what Facebook fingerprinting reads and what Business Manager allows.
- Site owners can use the same checkers to see which signals their own pages can read.
- Privacy-minded users can see how much a page learns without any cookie.
If you run ads on your own sites and care about the traffic hitting them, a bot-detection layer such as ClickzProtect looks at the visitor side of the same signals. For platform rules about multiple accounts, read each platform's own policy and use its official appeal route if an account is restricted.
Frequently Asked Questions
What does a fingerprint checker actually measure?
It reads signals the browser exposes, such as canvas and WebGL rendering, audio processing, fonts, screen size, language, timezone and WebRTC behaviour, and checks whether they agree with each other. A checker is mostly asking whether the pieces tell one coherent story, not whether any single value is unusual.
Why do different checkers give different readings?
Each tool looks at different signals with different weights. One leans on rendering consistency, another on network and timezone agreement, another on a long list of individual checks. A reading from one tool says little about what another, or a real site, would conclude.
Should I treat a checker's score as a guarantee about any website?
No. Checkers are diagnostic tools for spotting configuration mistakes, such as a timezone that disagrees with the proxy region. They say nothing certain about how a particular site will treat a visit, and they change over time.
Where does JustBrowser fit in?
JustBrowser is a multi-account browser for teams. Each profile is its own browser with its own cookies, storage, proxy and identity parameters, and the engine applies those parameters at the Chromium level so the settings agree with each other. Its public fingerprint checker lets you see what a page can read from your own browser.
Try JustBrowser
A multi-account browser for teams, built on a custom Chromium engine with native C++ integration, not an extension. Real C++ engine patches at the canvas / WebGL / audio / font / screen layer, with 40+ identity parameters. Local REST API + CDP for Playwright, Puppeteer, Selenium. $9.99/month or $99.99/year. 7-day free trial, card required — cancel any time in the seven days and you are not charged. Unlimited profiles.
Get started → · How it differs from Multilogin / GoLogin / AdsPower
Ready to manage multiple accounts?
Seven days free, then $9.99/month — one plan, everything included.