glossary
fingerprint api reference
the 546 javascript and browser apis a bot detector reads, and what each one gives away. grouped into 27 surfaces, one page each.
191 of these are tells: touching one is itself the signal, whatever it returns. 498 link to mdn or a spec; 48 have no reference and say so rather than guessing.
want your own? the xray-scanner probe reads these surfaces in your browser and shows what they return, the same instrument our fleet runs against every tool in the matrix.
surfaces
every api is filed under the surface it reads. pick one for its rows, its severities and its references.
anti-debug
24 apis, 12 of them tells · L3
audio
25 apis, 8 of them tells · L1a
canvas
30 apis, 6 of them tells · L1a
css
9 apis, 4 of them tells · L1a
document
23 apis, 4 of them tells · L1a
dom-layout
11 apis, 1 of them tells · L1b · L3
events
31 apis, 10 of them tells · L1b
extensions
10 apis, 6 of them tells · L1a
fonts
5 apis, 1 of them tells · L1a
headless-tells
39 apis, 39 of them tells · L3
intl
11 apis, 3 of them tells · L1a
introspection
38 apis, 11 of them tells · L2 · L3
math
24 apis, 9 of them tells · L1a
media
9 apis, 3 of them tells · L1a
media-capabilities
7 apis, 3 of them tells · L1a
navigator
73 apis, 19 of them tells · L1a · L1b
screen
13 apis, 1 of them tells · L1a
sensors
13 apis, 2 of them tells · L1b
speech
6 apis, 3 of them tells · L1a
storage
19 apis, 1 of them tells · L1a
svg
7 apis, 2 of them tells · L1a
timing
14 apis, 3 of them tells · L1a · L4
wasm
18 apis, 2 of them tells · L4
webgl
28 apis, 9 of them tells · L1a
webrtc
27 apis, 13 of them tells · L1a
window
23 apis, 11 of them tells · L1a
workers
10 apis, 6 of them tells · L1a
how deep the question is
the same 546 apis, read the other way: what a script can learn about you without asking, then what it learns by watching, then what only the server can see.
- L1a · static introspection 358 · read a property and compare it to what a real browser reports. no interaction needed.
- L1b · dynamic introspection 55 · call something and watch how it behaves: timing, precision, the shape of an error.
- L2 · behavioral / proof-of-work 36 · make the client prove it is doing real work, or watch how it moves.
- L3 · server-side correlation 66 · correlate what the page said with what the connection said. the client cannot see this half.
- L4 · human verification 31 · ask a human.