Skip to content

Can a browser hide which operating system it runs on?

Partly. Everything a browser says about its operating system is a string it controls: the user agent, navigator.platform, the User-Agent Client Hints. A patched engine can make all of those agree. But some of what a page reads is produced by the operating system underneath, and the browser only passes it along.

Text is the clearest case. Every glyph is sized by the OS's own font scaler: DirectWrite on Windows, FreeType on Linux and Android. Step a font size up by a hundredth of a pixel and measure a line of text: on Windows the width changes on 99% of steps, on Linux on about 66%, and a Linux browser presenting Windows still reads 66%. Fonts behave the same way. On Windows, a font that measures as installed also loads by name through local(); on Linux, look-alike fonts measure right but carry other names. Both measurements are in the font stack under the user agent.

So the reliable way to present an operating system is to run on it. Clearcote's Linux build claims Linux by default for this reason, and the Windows build and hosted browsers run on Windows. The fingerprint test checks both surfaces against whatever your browser claims.

Related reading

Q&AWhat is font fingerprinting?Font fingerprinting detects which fonts are installed — via measured text metrics or enumeration APIs. The set and their rendering are distinctive to your OS and configuration.Q&AWhat are User-Agent Client Hints (UA-CH)?UA-CH are structured headers and JS APIs that report browser brand, version, platform and bitness. They must agree with the User-Agent string — a mismatch is an easy tell.Q&AWhat is browser fingerprinting?Browser fingerprinting identifies a device by combining signals like canvas, WebGL, fonts, and hardware into a stable, often unique hash — without cookies.ResearchThe font stack under the user agent: two OS tells a persona cannot reachText is drawn by the operating system's own font scaler and font manager. Two measurements read them directly, and neither cares what the user agent says.DocsRecommended settings — what to spoof, what to leave aloneWhich Clearcote settings to use and which cost more than they buy: light stealth, one stable seed per identity, geoip-matched proxies — and the spoofs (screen size, a GPU the host cannot render) that get sessions blocked.

Clearcote puts this into practice

An open-source Chromium with fingerprint control compiled into the engine. A drop-in for Playwright & Puppeteer.

Get it freeRead the docs

Free for one browser with GitHub. No card.

All questions