Skip to content
All fingerprint checks
Input & behaviour

An upper-case letter was typed with Shift or Caps Lock

Pim· Clearcote Research 2 min readCheck id shift-less-capitals

Every upper-case letter typed on its own key arrives with shiftKey true or Caps Lock on. N/A when no such letter was typed; IME composition, paste and empty key codes are not counted (severity: warn).

What a detector infers

On a physical keyboard, a capital letter is the letter key pressed with Shift held or Caps Lock on: the key event for 'H' arrives with code 'KeyH' and either shiftKey true or the CapsLock modifier set. A key event that says key 'H', code 'KeyH', with Shift up and Caps Lock off describes a press no keyboard can make.

The DevTools protocol makes it easy to send, because Input.dispatchKeyEvent takes the key, the code and the modifiers as separate fields, and shiftKey comes only from the modifiers. Measured with Playwright on genuine Chrome: keyboard.type('Hi'), press('H') and pressSequentially('Ab') all delivered trusted keydowns for 'H' and 'A' with shiftKey false, while press('Shift+KeyH') sends a Shift keydown first and is fine.

Only the failing side is measured — no person typed here — and the passing side rests on how keyboards work. Only a letter arriving on its own key is counted — key 'H' with code 'KeyH' — so IME composition, paste and the empty codes that on-screen keyboards and some autotype tools send never enter the count.

How to resolve it

Type capitals the way a keyboard does, with Shift held around the key — in Playwright, press('Shift+KeyH'), or keyboard.down('Shift') before the letter and keyboard.up('Shift') after it. Sending the upper-case key on its own produces a capital no keyboard could have typed.

What is behavioural bot detection?

Nearby checks in Input & behaviour

See all 13 checks in Input & behaviour
Who builds this test

Clearcote is a browser built for fingerprint coherence

It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.

This audit takes no position on how Clearcote scores on Input & behaviour checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.

See the other checks in Input & behaviour — the family shift-less-capitals belongs to.