Skip to content
Identity · compiled into the engine

Browser fingerprint control, in the engine

A browser fingerprint is dozens of values that have to make sense together. Clearcote derives them from one seed and serves them from Chromium's own code paths, so a page reading the GPU, the screen, the fonts and the language gets answers that belong to one plausible machine: in the main frame, in iframes and in workers.

Full fingerprint control is in every tier, including the open build.

One seed, one identity

import { launch } from "clearcote";

// the same seed returns the same identity; a new seed is a new, unlinkable one
const browser = await launch({
  fingerprint: "account-42",
  lightStealth: true,          // metadata identity; rendering, TLS and version stay real
  timezone: "America/New_York",
  acceptLanguage: "en-US,en",
});

Highlights

One seed, one machine

--fingerprint derives a correlated persona: CPU and memory tier, screen, colour depth, GPU, voices, codecs, media devices and storage quota that fit together.

Per site, not global

Canvas and WebGL noise is derived per site, after Brave's farbling model, so one identity isn't trivially linkable across unrelated domains.

Native in every realm

Values come from C++ getters, so toString, property descriptors and a fresh iframe or worker all see native code and the same answer.

A GPU that agrees with itself

The WebGL vendor and renderer stay constant for the session, the getParameter limits match that GPU, and WebGPU describes the same adapter.

Import a real machine

Load a profile captured from a real Chrome, or pick one from the open profiles library, and its values replace the synthetic ones.

Dial it down where it matters

lightStealth varies only the safe metadata. fingerprintNoise: false keeps the identity and drops canvas and WebGL noise where the noise itself is scored.

Why consistency beats clever values

Detection rarely hinges on one unusual value. It looks for contradictions: a GPU string the pixels don't match, a timezone that disagrees with the IP, a worker that reports different hardware from the page. So the question Clearcote answers isn't which values to fake, but how to keep all of them consistent with each other and with the machine underneath.

The seed is deterministic. The same seed produces the same identity at every launch, like a returning visitor, and a new seed produces a fresh one. Canvas 2D and WebGL readbacks carry a small per-seed, per-site perturbation, because readback already varies between real machines. Rendered audio and client rects are deliberately left exact: perturbing them produces values no real browser emits, which is a louder signal than two profiles sharing a hash. The fingerprint docs go through each surface.

Some claims can't be backed by the host, and the docs say so plainly. A screen size that doesn't match the real window, or a GPU the machine can't actually render, gets tested against the host and fails. That's why screen spoofing is opt-in, why the canvas bridge exists, and why the recommended starting point varies less, not more.

What's covered

SurfaceWhat Clearcote does
Canvas 2D and WebGL readbackPer-seed, per-site noise inside the natural spread between real machines
WebGL renderer and limitsA session-constant GPU with the parameter limits that GPU reports
WebGPUThe same adapter as WebGL, so the two APIs never name different GPUs
AudioAudioContext sample rate and latency follow the persona; rendered samples stay exact
Fonts and speech voicesThe persona's font and voice sets
Hardware and screenhardwareConcurrency, deviceMemory, pixel ratio, colour depth, touch points; screen size opt-in
Locale and timeAccept-Language, navigator.language, Intl and the timezone agree
User agent and client hintsBrand, version, platform, bitness and model, from the engine
TLSThe ClientHello follows the Chrome version the persona claims
Automation hintsnavigator.webdriver and the headless tells

The full switch list, with what each one does, is in the fingerprint flag reference.

What people use it for

Privacy

A stock browser's combination of values is often unique. A coherent persona sits in a common configuration instead.

Separate identities

Give each account its own seed, so accounts don't share a rendering fingerprint.

Testing fingerprint-aware code

See how your own fraud, analytics or personalisation code reacts to different hardware, GPUs and locales.

Fingerprinting research

Reproduce what a test page measures, with controlled and repeatable inputs.

Clearcote is built for privacy, testing, research and lawful automation. You're responsible for how you use it and for following the terms of the sites you visit.

Which plan includes it

Full engine-level fingerprint control is in every tier, including the open build. Nothing in a paid tier unlocks more spoofing; the licensed build adds behavioural realism and gets new Chromium majors first.

Compare plans

FAQ

What is browser fingerprint spoofing?

Changing the values a website reads to recognise a browser: the GPU, screen, fonts, hardware, language and so on. Most tools do it by overriding JavaScript properties. Clearcote does it in the Chromium engine, so the values come from native code and stay consistent with one another.

Why not use a JavaScript fingerprint spoofer?

Overridden functions give themselves away. toString returns the override's source instead of [native code], property descriptors change, and a fresh iframe or worker brings back the original value. Clearcote has no such layer to find. See how detection works.

Does the same seed give the same fingerprint every time?

Yes. The seed deterministically derives the persona and the per-site noise, so the same seed is the same identity on every launch, and a new seed is a new one.

Can two accounts on one machine have different canvas fingerprints?

Yes, with different seeds: canvas and WebGL readbacks differ per seed. An imported device profile only changes reported values, not rendering, so use a per-account seed for render separation. Rendered audio and client rects come from the machine underneath and are the same for every identity on it.

Does this make automation undetectable?

No tool can promise that, and we don't. Clearcote removes the contradictions a spoofed browser usually carries. Behaviour, IP reputation and how you use it still matter. The fingerprint test shows what your own setup looks like.

Go deeper in the docs

Related features

Try Clearcote

Open source, a drop-in for Playwright & Puppeteer, and coherent down to the TLS handshake.

Free for one browser with GitHub. No card.