Client hints on the wire carry the values JavaScript reports
Every client hint that arrives carries the value its JavaScript counterpart reports at the same moment, within Chrome's own variation for the network estimates. Hints that do not arrive are N/A, and so are non-Chromium engines (severity: warn).
What a detector infers
A server that asks for client hints with Accept-CH receives, on the next request, headers that describe facts JavaScript can also read: Sec-CH-DPR is devicePixelRatio, the device-memory hint is navigator.deviceMemory, ECT, RTT and Downlink are navigator.connection, the Sec-CH-Prefers-* hints are the matching media queries, and the platform version hint is userAgentData's. In Chrome both sides are filled from one source, so they agree.
A value overridden in the page — the usual way to change deviceMemory or the connection — moves the JavaScript side and leaves the headers telling the truth. The probe opts in to twelve hints, fetches an echo endpoint and compares each header with its JavaScript counterpart read at the same moment; the network estimates are allowed the small per-host variation Chrome adds to what a page sees, and everything else must match exactly.
All twelve agreed on Chrome and Edge on Windows, on Linux Chrome and on Playwright's Chromium. The failing side is a set of JavaScript overrides written for the test — device memory, pixel ratio and RTT each disagreeing between header and page — rather than a captured tool.
A hint that never arrives, because a policy or an extension withholds it, is N/A rather than a disagreement. sec-ch-ua-vs-uadata does the same for the brand hints sent on every request; this row covers the hints a server has to ask for.
How to resolve it
Change these values below JavaScript — at launch, for example --force-device-scale-factor for the pixel ratio — or not at all. A page-level override leaves the headers the browser sends describing the real device.
Nearby checks in HTTP request vs the runtime
- The image Accept header is the one the claimed Chrome major sends
image-accept-vs-claimed-majorThe Accept header Chrome sends for an <img> is compiled from the image formats the build decodes by default, and it changed at 155: JPEG XL… - A cacheable resource fetched twice comes from cache the second time
http-cache-honouredA browser that is allowed to cache a response does. The probe fetches an immutable, cacheable resource unique to this visit twice, then… - A WebSocket handshake carries the no-cache pair every browser sends
websocket-handshake-no-cacheA WebSocket connection starts as an HTTP request that is never cacheable, and browsers mark it that way. - Accept-Language leads with the same language as navigator.languages
accept-language-vs-navigatorAccept-Language and navigator.languages are two views of one browser preference: the header is serialised by the network stack, the array is… - Global Privacy Control reads the same in the page, in a worker and on the wire
gpc-header-vs-navigatorGlobal Privacy Control has three faces: navigator.globalPrivacyControl in the window, the same property in workers, and the Sec-GPC: 1… - The client-hint headers match navigator.userAgentData
sec-ch-ua-vs-uadataUser-Agent Client Hints exist in two places at once, which is what makes them checkable. - Sec-Fetch-* describes the request this page actually made
sec-fetch-metadataSec-Fetch-Site, Sec-Fetch-Mode and Sec-Fetch-Dest are attached by the browser to describe the request's own provenance — where it came from… - The order your browser emits its HTTP headers in
http-header-order-readoutA browser emits its request headers in a fixed sequence compiled into its network stack, and that sequence differs between engines…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on HTTP request vs the runtime checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in HTTP request vs the runtime — the family client-hints-wire-vs-js belongs to.