How to check a browser profile before you trust it with an account

The most common mistake in this category is treating a detector's score as a grade. You run whoer.net, see a high percentage, and conclude the profile is safe.

Score pages are useful, but they answer "how unusual are you", and that is not the question a risk engine asks. It asks whether your signals agree with each other. A perfectly ordinary Windows machine that reports a MacBook's fonts is not unusual in any single dimension. It is impossible in combination, and impossible is far easier to detect than unusual.

Run through these before an account matters.

1. User agent against platform

Cheapest contradiction to create and to catch. If your UA claims Windows, navigator.platform must be Win32, and the Sec-CH-UA-Platform client hint has to agree. Three places, one answer.

console.log(navigator.userAgent, navigator.platform, navigator.userAgentData?.platform)

2. Timezone against exit IP

If your proxy exits in Frankfurt and Intl.DateTimeFormat().resolvedOptions().timeZone says America/New_York, that alone is enough. Worse, it is checkable server-side without any JavaScript, just by comparing your IP's geo to a timestamp you send.

console.log(Intl.DateTimeFormat().resolvedOptions().timeZone, new Date().getTimezoneOffset())

Bind the timezone to the proxy, not to your laptop. Anything that makes you set this by hand will eventually be set wrong.

3. Language against everything

navigator.language, the Accept-Language header and the IP's country should tell a plausible story. They do not have to match exactly, plenty of real people browse in a second language, but German IP plus en-US plus a US locale in Intl is a pattern that is common among proxies and rare among people.

4. WebGL renderer against the rest of the device

The most informative single field, and the one most often wrong. Check that:

• The renderer string is a GPU that actually ships. SwiftShader, llvmpipe or Mesa on a machine claiming to be a consumer Windows laptop is a headless tell.
• The vendor and renderer are consistent with each other, and both with the claimed OS. ANGLE (Intel, Intel(R) Iris(R) Xe Graphics ...) is coherent on Windows and nonsense on macOS.
• Reported screen resolution and device memory are plausible for that GPU class.

5. Fonts against the OS

Font lists are highly identifying, and cross-OS mistakes are obvious. A profile claiming Windows should have the Windows set (Segoe UI and friends) and should not have macOS-only faces. This is one of the strongest signals that a fingerprint was assembled from parts rather than sampled from one machine.

6. Canvas and audio: stable, not absent, not noisy

Three failure modes, and two of them are self-inflicted:

• Absent (blocked or spoofed to a constant): a tiny, suspicious population.
• Randomised per call: worse. Real hardware is deterministic. If your canvas hash changes between two reads in the same session, you have announced that you are spoofing it.
• Shared: thousands of profiles with an identical hash is its own cluster.

Read the value twice in one session. It must be identical. Read it in a fresh session of the same profile. Still identical.

7. WebRTC leaks

WebRTC can expose local and public addresses through ICE candidates independent of your proxy. If it reveals your real IP, nothing else on this list matters.

8. Automation tells

navigator.webdriver should be false. Beyond that, CDP artefacts, missing or wrong chrome object, permissions that answer inconsistently with the notification state, and an anomalous plugin array.

9. The one nobody checks: does it survive a restart?

Everything above is a snapshot. The question that decides whether an account survives is whether the profile is the same machine tomorrow.

Close the browser. Reopen the same profile. Re-run the checks. Canvas hash, WebGL renderer, fonts, audio and timezone must all be byte-identical. If any drift, the site sees a returning user whose hardware changed overnight, which is a stronger signal than most of the individual tells above.

This is where randomise-per-launch approaches fail. They optimise the snapshot and lose the identity.

Where to run these

• whoer.net for the IP, timezone and proxy-detection view.
• CreepJS at abrahamjuliot.github.io/creepjs for the deep consistency view, including lies detection across contexts, which is the closest public tool to what a real risk engine does.
• The site you actually care about. No general detector predicts a specific vendor's decision. If you have to get past a particular wall, that wall is the test.

Then check the same profile a week later

Run the list, use the profile normally for a week, run it again. Drift is the failure that matters and the one a single test cannot see.

If you want a profile that is coherent by construction rather than assembled by hand, AntiBrow samples each one whole and applies it in the browser engine. Unlimited local profiles, no card, so you can run this checklist against it before believing any of that.

Download it or see our own detector runs.