Skip to content

CreepJS, explained

CreepJS is the fingerprinting test researchers and anti-detect developers use most. It doesn't give a pass or fail; it shows what your browser reveals, where values contradict each other, and three percentages for how headless or stealthy it looks.

An open-source research project by Abraham Juliot. Open CreepJS

What is CreepJS?

CreepJS is an open-source fingerprinting research page by Abraham Juliot, hosted on GitHub Pages. It collects a very wide set of signals, from WebGL and audio to fonts, workers and WebRTC, and hashes each section, so you can see exactly which part of a fingerprint changed between two visits.

What makes it stand out is that it looks for lies: values that have been altered by JavaScript, or that don't agree between the page and a Web Worker. Its "Headless" section summarises that into three numbers. Because it is open source, you can read exactly how each check works.

What CreepJS checks

Headless

Three percentages: how much the browser resembles a headless one ("like headless"), how many hard headless signs it shows ("headless"), and how many signs of stealth patching it shows ("stealth").

Lies

Browser functions that have been overridden in JavaScript, which is how most stealth plugins work and how CreepJS catches them.

Workers

Values read inside a Web Worker and compared with the page: user agent, GPU, time zone, language, cores and memory.

Rendering

Canvas, WebGL, audio, fonts and DOM rect measurements, each hashed.

WebRTC, time zone and more

Network candidates, time zone and locale, screen, and dozens of smaller sections.

How to read your CreepJS result

% like headless
Soft signals that are common in headless browsers but also appear in normal ones. A non-zero number here is normal.
% headless
Hard signs of a headless or automated browser. This is the number to watch.
% stealth
Signs of stealth patching, such as overridden functions. A JavaScript stealth plugin shows up here.
FP ID and fuzzy hash
Identifiers for your whole fingerprint. They change whenever anything changes, so they are for comparing visits, not for judging a browser.

What real browsers scored

Measured on 20 and 21 September 2026 on one Windows 11 PC (NVIDIA RTX 3070) on a home fibre connection in the Netherlands, with no proxy or VPN. Three browsers: a person's everyday Chrome 153 with an ad blocker, used by hand; the same genuine Chrome 153 driven by Playwright; and Clearcote 153 driven by Playwright with a fingerprint seed.

BrowserCreepJS said
Everyday Chrome 153, by hand19% like headless · 0% headless · 0% stealth
Genuine Chrome 153, Playwright25% like headless · 33% headless · 0% stealth
Clearcote 153, Playwright + seed25% like headless · 0% headless · 0% stealth

The "headless" number is where automation showed: 33% for the genuine Chrome under Playwright, 0% for Clearcote and for the person's own Chrome. Clearcote's 0% stealth is expected, because it changes values inside the engine instead of overriding functions in JavaScript, so there is nothing for the lie detection to find.

Results that show up on normal browsers

  • A non-zero "like headless" percentage. Even the person's own Chrome showed 19%.
  • A WebRTC host candidate ending in .local read as a leak. That is Chrome's mDNS protection hiding your local address, not exposing it; Clearcote's audit counts it as a pass for that reason.

FAQ

What is a good CreepJS result?

0% headless and 0% stealth are the numbers that matter. A "like headless" percentage in the teens or twenties is normal; a person's everyday Chrome showed 19% in our test.

Why does CreepJS show a different fingerprint ID each time?

The ID is a hash of everything it measured, so any change, from a new font to a different window size, changes it. It is meant for comparing two visits, not as a score.

Can CreepJS detect puppeteer-extra-plugin-stealth?

It is designed to catch functions overridden in JavaScript, which is how that plugin works; that shows up as lies and in the stealth percentage. See the stealth plugin comparison for why that approach reveals itself.

Is CreepJS the same as the Clearcote audit?

No. CreepJS is a research page that shows raw findings; the Clearcote audit runs 272 coherence checks and explains each result. They overlap, and they disagree in a few places, such as mDNS WebRTC candidates.

Want every check explained?

The Clearcote audit runs 272 coherence checks on whatever browser opens it, with a plain-English explanation and a fix for each one. Free, no account.

Run the audit Other test sites

Related reading

Q&AWhat is CreepJS?CreepJS is an open-source fingerprinting research tool that cross-checks browser signals for internal consistency and flags headless/automation and tampering.Q&AWhy does Function.toString() reveal a hooked function?Calling toString() on a native function returns “[native code]”; an override returns its own source instead — so detectors stringify APIs to catch JavaScript spoofs.ResearchCross-realm coherence: why a worker must agree with the pageA page is not one JavaScript realm but several — and the values they report about the same machine have to match.Test guideIphey, explainedIphey gives your browser a one-word trust verdict and a score out of 100. It is quick and popular, but the verdict is easy to misread: in our test every browser we tried, including a person's everyday Chrome, was called "Unreliable".Test guidePixelscan, explainedPixelscan tells you whether your browser fingerprint is "consistent" or "inconsistent", with four cards for location, proxy, masking and bots. In our test a person's everyday Chrome got "inconsistent" and "Masking detected", so a red result on its own proves very little.