performance.timeOrigin + performance.now() reconstructs Date.now()
Check id clock-origin-coherence
What an ordinary browser yields
performance.timeOrigin + performance.now() lands within a second of Date.now() — two independent clocks agreeing on one instant.
What a detector infers
A page has two clocks. performance.timeOrigin is the wall-clock moment its timeline began; performance.now() is the monotonic time elapsed since. Their sum therefore reconstructs Date.now() — the same instant, reached through an entirely separate mechanism. That redundancy is the check. Automation very commonly overrides Date.now(): to skip waits, to defeat timing analysis, or to make a session look older or newer than it is. It much more rarely touches performance, because performance.now() is monotonic, is used by the browser's own machinery, and breaks pages when it moves. Override one and not the other and the two clocks disagree by exactly the amount that was faked — a hidden time becomes a visible contradiction. The tolerance is deliberately loose, at a full second. Legitimate drift is real but small: an NTP correction or a user changing the system clock mid-visit moves the wall clock while the monotonic one keeps counting, and Firefox's resistFingerprinting and Tor Browser both round performance.now() to 100ms. None of those approach a second, whereas a faked clock is rarely subtle — it is usually minutes or hours. Severity is warn rather than critical for exactly that reason: a clock correction is an innocent explanation that exists, even if it is rare.
How to resolve it
Do not override Date.now() on its own. performance.timeOrigin plus performance.now() reconstructs the same instant from a separate monotonic clock, so moving one and not the other converts a hidden time into a contradiction that needs no baseline to spot. If the clock genuinely must differ, move the machine's clock rather than the page's Date.
Nearby checks in Automation surface
- timer handles are a real per-realm counter
timer-id-sequencingThe number setTimeout hands back is not a token, it is an index into the realm's own timer table — so it carries structure that a fabricated… - document.hidden agrees with document.visibilityState
document-visibility-coherencedocument.hidden and document.visibilityState are two views of one piece of state, and the specification defines the first in terms of the… - navigator.plugins is a real IDL collection, not a JavaScript object
plugins-idl-index-wraparoundA real navigator.plugins is a PluginArray — a C++-backed IDL collection — and its indexed getter runs the Web IDL unsigned-long conversion… - navigator.storage quota is the same in the window and a same-origin worker
storage-quota-worker-vs-mainnavigator.storage.estimate().quota describes one storage partition, and a same-origin worker shares that partition — a single QuotaManager… - the gesture that started this audit registered as a real user activation
user-activation-vs-interactionThis audit only runs when you press the Run button, and pressing a button is exactly what grants user activation — by pointer, by Enter or… - user activation only ever appeared after a real input event
activation-without-inputThe row above this one reads navigator.userActivation once and expects it to be true, because the audit is reached by pressing a button. - the clicks this page received were real clicks
interaction-click-trustEvent.isTrusted is set by the engine when it dispatches an event it generated itself, and it cannot be set from script - a constructed… - every keypress had a keydown behind it
interaction-keypress-without-keydownThe UI Events spec generates keypress as the DEFAULT ACTION of a keydown - it is not an independent event, it is what a keydown does when it…
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Automation surface checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Automation surface — the family clock-origin-coherence belongs to.