Browser fingerprint control, in the engine
A browser fingerprint is dozens of values that have to make sense together. Clearcote derives them from one seed and serves them from Chromium's own code paths, so a page reading the GPU, the screen, the fonts and the language gets answers that belong to one plausible machine: in the main frame, in iframes and in workers.
Full fingerprint control is in every tier, including the open build.
One seed, one identity
import { launch } from "clearcote";
// the same seed returns the same identity; a new seed is a new, unlinkable one
const browser = await launch({
fingerprint: "account-42",
lightStealth: true, // metadata identity; rendering, TLS and version stay real
timezone: "America/New_York",
acceptLanguage: "en-US,en",
});Highlights
One seed, one machine
--fingerprint derives a correlated persona: CPU and memory tier, screen, colour depth, GPU, voices, codecs, media devices and storage quota that fit together.
Per site, not global
Canvas and WebGL noise is derived per site, after Brave's farbling model, so one identity isn't trivially linkable across unrelated domains.
Native in every realm
Values come from C++ getters, so toString, property descriptors and a fresh iframe or worker all see native code and the same answer.
A GPU that agrees with itself
The WebGL vendor and renderer stay constant for the session, the getParameter limits match that GPU, and WebGPU describes the same adapter.
Import a real machine
Load a profile captured from a real Chrome, or pick one from the open profiles library, and its values replace the synthetic ones.
Dial it down where it matters
lightStealth varies only the safe metadata. fingerprintNoise: false keeps the identity and drops canvas and WebGL noise where the noise itself is scored.
Why consistency beats clever values
Detection rarely hinges on one unusual value. It looks for contradictions: a GPU string the pixels don't match, a timezone that disagrees with the IP, a worker that reports different hardware from the page. So the question Clearcote answers isn't which values to fake, but how to keep all of them consistent with each other and with the machine underneath.
The seed is deterministic. The same seed produces the same identity at every launch, like a returning visitor, and a new seed produces a fresh one. Canvas 2D and WebGL readbacks carry a small per-seed, per-site perturbation, because readback already varies between real machines. Rendered audio and client rects are deliberately left exact: perturbing them produces values no real browser emits, which is a louder signal than two profiles sharing a hash. The fingerprint docs go through each surface.
Some claims can't be backed by the host, and the docs say so plainly. A screen size that doesn't match the real window, or a GPU the machine can't actually render, gets tested against the host and fails. That's why screen spoofing is opt-in, why the canvas bridge exists, and why the recommended starting point varies less, not more.
What's covered
| Surface | What Clearcote does |
|---|---|
| Canvas 2D and WebGL readback | Per-seed, per-site noise inside the natural spread between real machines |
| WebGL renderer and limits | A session-constant GPU with the parameter limits that GPU reports |
| WebGPU | The same adapter as WebGL, so the two APIs never name different GPUs |
| Audio | AudioContext sample rate and latency follow the persona; rendered samples stay exact |
| Fonts and speech voices | The persona's font and voice sets |
| Hardware and screen | hardwareConcurrency, deviceMemory, pixel ratio, colour depth, touch points; screen size opt-in |
| Locale and time | Accept-Language, navigator.language, Intl and the timezone agree |
| User agent and client hints | Brand, version, platform, bitness and model, from the engine |
| TLS | The ClientHello follows the Chrome version the persona claims |
| Automation hints | navigator.webdriver and the headless tells |
The full switch list, with what each one does, is in the fingerprint flag reference.
What people use it for
Privacy
A stock browser's combination of values is often unique. A coherent persona sits in a common configuration instead.
Separate identities
Give each account its own seed, so accounts don't share a rendering fingerprint.
Testing fingerprint-aware code
See how your own fraud, analytics or personalisation code reacts to different hardware, GPUs and locales.
Fingerprinting research
Reproduce what a test page measures, with controlled and repeatable inputs.
Clearcote is built for privacy, testing, research and lawful automation. You're responsible for how you use it and for following the terms of the sites you visit.
Which plan includes it
Full engine-level fingerprint control is in every tier, including the open build. Nothing in a paid tier unlocks more spoofing; the licensed build adds behavioural realism and gets new Chromium majors first.
Compare plansFAQ
What is browser fingerprint spoofing?
Changing the values a website reads to recognise a browser: the GPU, screen, fonts, hardware, language and so on. Most tools do it by overriding JavaScript properties. Clearcote does it in the Chromium engine, so the values come from native code and stay consistent with one another.
Why not use a JavaScript fingerprint spoofer?
Overridden functions give themselves away. toString returns the override's source instead of [native code], property descriptors change, and a fresh iframe or worker brings back the original value. Clearcote has no such layer to find. See how detection works.
Does the same seed give the same fingerprint every time?
Yes. The seed deterministically derives the persona and the per-site noise, so the same seed is the same identity on every launch, and a new seed is a new one.
Can two accounts on one machine have different canvas fingerprints?
Yes, with different seeds: canvas and WebGL readbacks differ per seed. An imported device profile only changes reported values, not rendering, so use a per-account seed for render separation. Rendered audio and client rects come from the machine underneath and are the same for every identity on it.
Does this make automation undetectable?
No tool can promise that, and we don't. Clearcote removes the contradictions a spoofed browser usually carries. Behaviour, IP reputation and how you use it still matter. The fingerprint test shows what your own setup looks like.
Go deeper in the docs
Related features
One seed per account: the same device every session, a different one for the next account, with cookies and storage that persist between runs.
The TLS handshake and HTTP/2 frames come from Chromium's own network stack, and the version-dependent fields follow the Chrome version your persona claims.
Forward canvas and WebGL operations to a remote machine with a real GPU, so the pixels a page reads back match the GPU your persona claims.
Set a proxy with geoip on and the timezone, languages and WebRTC follow the exit IP. SOCKS5 with a username and password works directly.
Related reading
Try Clearcote
Open source, a drop-in for Playwright & Puppeteer, and coherent down to the TLS handshake.
Free for one browser with GitHub. No card.