What a page can read about your browser

Before your code clicks anything, a site has already read the TLS handshake, the header order and dozens of JavaScript properties, and compared them with each other and with your IP. This page maps those signals and what each browser on the fleet sends for each, as measured in our cases and comparisons.

The signals at a glance

Before any JavaScript: TLS and HTTP/2

The first packet a server receives is the TLS ClientHello: cipher suites, extensions and their order. Anti-bot systems condense it into a JA3/JA4 fingerprint, and the HTTP/2 SETTINGS and WINDOW_UPDATE frames into an Akamai HTTP/2 fingerprint, then check both against the browser the user agent claims to be. Measured on tls.peet.ws (case 01, 2026-09-30):

• Each engine sends its own real fingerprint: JA4 t13d1517h2_… for Chrome, t13d1516h2_… for Edge (one extension fewer), t13d1617h2_… for Firefox. Nothing is patched.
• Chrome and Edge share the HTTP/2 fingerprint; so do Chrome and Brave, while Brave's TLS drops an extension like Edge's (Chrome vs Brave, 2026-10-09).
• Camoufox's TLS is identical to Firefox's, whatever OS its persona claims, which is consistent: Firefox's TLS stack is the same on every OS.
• WebKit speaks HTTP/1.1 through a proxy, with 29 cipher suites (JA4 t13d2913h1_…): nothing like a browser on a real Mac.
• These come from the browser, not your code or the proxy: page.request and HTTP clients outside the browser send their own, different fingerprint.

Header order and values

Browsers send request headers in a fixed order, and some checks compare that order with the real browser's. Measured with real Chrome on tls.peet.ws (case 09, 2026-09-30):

• Chrome puts accept-language after accept-encoding. Both locale and extraHTTPHeaders move it up, right after user-agent, an order real Chrome doesn't send on a navigation.
• extraHTTPHeaders sends exactly what you wrote (de-DE instead of Chrome's de-DE,de;q=0.9).
• route.continue({ headers }) reorders everything and is the most visible of the four methods.
• TLS and HTTP/2 stay the same whichever method you use.
• Brave adds sec-gpc: 1, a header Chrome never sends (Chrome vs Brave).

Navigator, client hints and the host

The user agent string is one of several places a browser names itself. Client hints (Sec-CH-UA headers and navigator.userAgentData) carry brand lists, and a handful of navigator properties give headless and automated browsers away in a millisecond.

Canvas, WebGL and audio

Scripts draw text and shapes off-screen and hash the pixels (canvas), read the GPU strings and rendering output (WebGL), or process a tone through the audio stack. The result depends on the engine, fonts and GPU, so it identifies a device without any cookie.

• WebGL is the tell that outlives headful: Chrome, Edge, Chromium and Patchright all report Google's SwiftShader software renderer, headless or headful, because the servers have no GPU (case 16, case 05). bot.sannysoft.com flags exactly that on headful Chrome and Patchright (case 63). Playwright's Firefox reports llvmpipe (Firefox vs Camoufox).
• Chrome, Edge and Chromium draw the same canvas hash: switching between them changes the name, not the drawing (Chrome vs Edge, Chrome vs Chromium).
• Brave farbles: a different canvas hash, cores and screen per session and per site (Chrome vs Brave).
• Camoufox reports a consumer GPU string and re-seeds its canvas every launch: the same drawing hashes the same twice within a session, but differently in each new session, even with a persistent profile that brings back the rest of the device (case 49, 2026-10-15).
• Audio: we haven't published an audio-fingerprint measurement yet; vendors do read it (case 05).

Installed fonts

A script measures the width of text in each candidate font against a fallback; a family that changes the width is installed. Measured with a 46-family probe on Camoufox personas (case 52, 2026-10-16):

• The font list follows the persona and is stable between launches: two Windows launches gave the same 20 families and the same hash, unlike the canvas.
• Each OS shows its own families: Segoe UI, Calibri and Consolas on Windows; Helvetica Neue, Menlo and Avenir on macOS; only three on Linux, and a short list is unusual in itself.
• fonts adds only families the server has, and a width probe can't see the fallback face itself, so on the Windows persona it reports no Arial. A script that compares serif with monospace can notice that.

WebRTC

WebRTC gathers network candidates for peer connections, and a STUN request can reveal a public address other than the proxy's. Measured behind a sticky residential exit per setup (case 54, 2026-10-16):

• No setup leaked a second IP: a session that uses a proxy can't send UDP past it.
• Chromium, Chrome and Firefox keep WebRTC but expose only anonymous .local mDNS names, like a real visitor on a network that blocks UDP.
• Camoufox reports the proxy's exit as its public address, so WebRTC agrees with HTTP. Keep the exit sticky: the address is looked up at launch.
• block_webrtc: true removes the API entirely, which is itself unusual for a desktop browser.

Automation side effects (CDP)

An automation client changes how the page behaves: console messages are serialised for the client, and a page can time that. Measured with six setups (case 43, 2026-10-13):

• The old Error.stack getter trick fired in none of the six setups. The Error.message getter fires on every Chromium build whether or not a client listens, so it says "Chromium", not "automated".
• Logging a big object costs 3.1–4.8× more on Chrome and Playwright's Chromium than on Patchright (2.6–2.8×), because Playwright enables the runtime domain. It is a timing signal that sites can only use statistically.
• Public test pages look for the connection itself: fingerprint.com typed headful Chrome and Patchright as chromium_automation, and deviceandbrowserinfo flagged Chrome for CDP automation in the page and in a worker (case 63, 2026-10-20).

Timezone, locale and geolocation vs the IP

A risk engine compares the browser's clock, languages and position with where its IP is. Defaults that ignore the exit are the cheapest mismatch to spot.

• Playwright's Chromium and Patchright default to UTC and en-US whatever the exit: a German IP with a UTC clock, and geolocation refused. Setting timezoneId, locale and geolocation (plus the permission) on the context makes them agree (case 35, 2026-10-11).
• Camoufox's geoip sets timezone, locale and geolocation from the exit at launch (Camoufox vs Patchright); read them with main_world_eval, because a default page.evaluate runs in an isolated world that reports UTC (case 15).
• A rotating proxy can split the story: the timezone is set at launch and the next request may exit in another country. Pick the exit country to match the locale and use a sticky exit (case 04, case 49).

What each fleet browser changes

The same signals, by browser. "Real" means the browser sends its own values, unpatched.

Camoufox and Firefox are based on Firefox source; cdpfleet is not affiliated with Mozilla. Sources: case 01, case 16, case 63 and the comparisons linked above.

What public bot-test pages concluded

Four public test pages against five fleet browsers on 2026-10-20 (case 63): headless Chromium was flagged by every page; headful Chrome and Patchright passed bot.sannysoft.com except its WebGL renderer check but were still typed as automation by fingerprint.com; WebKit was caught on navigator.webdriver; Camoufox drew the fewest flags, with verdicts that varied from load to load. Which protection vendor a site runs, and the signals each one leaves, is in case 62.

Read next

• Web scrapingWhich browser for which protection, and what to do when a site pushes back.
• CamoufoxPersona options: os, geoip, fonts, fingerprint.
• ComparisonsBrowser vs browser, measured on the fleet.
• ProxiesSticky residential exits by country, per-host rules.