Event.isTrusted separates page script from the input pipeline
Check id event-istrusted-provenance
What an ordinary browser yields
Contextual only: real input reports isTrusted=true, and an event dispatched by this page reports isTrusted=false.
What a detector infers
This row exists to debunk a check rather than to run one, which is why it can never fail. Event.isTrusted is true when the user agent generated an event and false when page script dispatched it via EventTarget.dispatchEvent — so the pad dispatches its own event beside your real one and shows the two side by side, one flag apart. The widespread belief that isTrusted therefore detects automation is wrong, and the reason is architectural: CDP's Input.dispatchMouseEvent — the mechanism underneath Puppeteer and Playwright — injects at the browser's input pipeline, above the renderer, so the event is generated by the user agent exactly as a real one is and reports isTrusted=true. The flag separates page script from the input pipeline. It says nothing about whether a human is at the other end of that pipeline, which is precisely why the geometric and timing checks above have to do the actual work.
How to resolve it
Nothing to fix, and nothing to read into a pass. Treat isTrusted=true as evidence only that an event arrived through the input pipeline rather than from page script — CDP-injected input satisfies it trivially. If you are evaluating detection techniques, this is a good example of one that is widely cited and carries far less information than its reputation suggests.
Other checks in Input & behaviour
- Pointer path curves the way a hand moves
pointer-path-linearityThe check captures the pointer path across the pad and measures two things about its geometry: the RMS perpendicular distance of every… - Pointer velocity and acceleration vary physically
pointer-kinematicsVelocity, acceleration reversals, direction changes, and timestamp quantisation catch constant-speed curved automation missed by linearity. - Pointer events arrive on hardware time
pointer-event-cadenceWhere the linearity check reads the path's shape, this one reads its clock. - Movement deltas agree with the coordinates they were derived from
pointer-movement-delta-coherenceEvery pointer event carries two independent accounts of the same displacement. screenX and screenY are where the pointer is; movementX and… - Keystrokes have dwell and flight time
keystroke-timing-distributionThe probe records only two timings per key: dwell, from keydown to keyup, and flight, from one key's release to the next key's press.
Clearcote is a browser built for fingerprint coherence
It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.
This audit takes no position on how Clearcote scores on Input & behaviour checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.
See the other checks in Input & behaviour — the family event-istrusted-provenance belongs to.