Detector report
We run BrowserHat personas through ten public bot and fingerprint detectors on every core release and publish the result as measured, failures included. Detector vendors change their checks without notice, so a result holds for the date and build shown and only for them.
Build and stand
- Measured on
- 2026-11-05
- BrowserHat Core
- dev.61 (Chromium 156.0.8078.13, win-x64)
- Browser as the pages saw it
- Chrome/156.0.8078.13, Chrome/156.0.8078.80
- BrowserHat desktop
- 0.1.283 (main, built from source on the stand)
- Connection
- each persona on its own ProxyHat US residential sticky session (1 h), launched from the client with a fresh exit check; geo and language follow the exit. Control: stock Chrome on the stand's own VPN exit, no proxy, no persona.
Results
Product personas, first measurement: 22 clean, 10 fail, 8 not measured.
| Persona | BrowserScan | BrowserScan bot detection | CreepJS | Pixelscan | Fingerprint Pro playground | Iphey | bot.sannysoft.com | Brotector | Cloudflare Turnstile (real sitekey) | Cloudflare managed challenge |
|---|---|---|---|---|---|---|---|---|---|---|
| Android (Adreno 610) | Fail rerun: Fail | Clean rerun: Clean | Not measured rerun: Fail | Not measured rerun: Clean | Not measured rerun: Fail | Not measured rerun: Clean | Not measured rerun: Fail | Not measured rerun: Clean | Not measured rerun: Fail | Fail rerun: Fail |
| Stock Google Chrome 156 (control) | Fail | Clean | Clean | Fail | Clean | Fail | Clean | Clean | Clean | Fail |
| Linux (Intel UHD) | Clean | Clean | Clean | Clean | Fail | Clean | Clean | Clean | Fail | Fail |
| macOS (Apple M3) | Fail | Clean | Fail | Clean | Fail | Clean | Clean | Clean | Clean | Clean |
| Windows | Clean | Clean | Clean | Clean | Not measured | Clean | Clean | Clean | Fail | Fail |
Failures
- Android (Adreno 610) - BrowserScan: score 90 %
- Android (Adreno 610) - BrowserScan, rerun: score 85 %; IP addresses are different; Different operating systems
- Android (Adreno 610) - CreepJS, rerun: trash: suspicious gpu; trash: suspicious capabilities
- Android (Adreno 610) - Fingerprint Pro playground, rerun: tampering=true
- Android (Adreno 610) - bot.sannysoft.com, rerun: failed: Plugins Length (Old); failed: Plugins is of type PluginArray
- Android (Adreno 610) - Cloudflare Turnstile (real sitekey), rerun: not passed
- Android (Adreno 610) - Cloudflare managed challenge: not passed
- Android (Adreno 610) - Cloudflare managed challenge, rerun: not passed
- Stock Google Chrome 156 (control) - BrowserScan: score 90 %; Different time zones
- Stock Google Chrome 156 (control) - Pixelscan: Your Browser Fingerprint is inconsistent; Timezone spoofed
- Stock Google Chrome 156 (control) - Iphey: verdict Unreliable
- Stock Google Chrome 156 (control) - Cloudflare managed challenge: not passed
- Linux (Intel UHD) - Fingerprint Pro playground: tampering=true; anti_detect_browser=true
- Linux (Intel UHD) - Cloudflare Turnstile (real sitekey): not passed
- Linux (Intel UHD) - Cloudflare managed challenge: not passed
- macOS (Apple M3) - BrowserScan: score 90 %; IP addresses are different
- macOS (Apple M3) - CreepJS: trash: suspicious gpu
- macOS (Apple M3) - Fingerprint Pro playground: tampering=true; anti_detect_browser=true; virtual_machine=true
- Windows - Cloudflare Turnstile (real sitekey): not passed
- Windows - Cloudflare managed challenge: not passed
Not measured
A cell is not measured when the page never showed a positive readiness sign or measured nothing. That is a failure of our instrument, not a score.
- Android (Adreno 610) - CreepJS: the page never showed its readiness sign
- Android (Adreno 610) - Pixelscan: the page never showed its readiness sign
- Android (Adreno 610) - Fingerprint Pro playground: the page never showed its readiness sign
- Android (Adreno 610) - Iphey: the page never showed its readiness sign
- Android (Adreno 610) - bot.sannysoft.com: the page never showed its readiness sign
- Android (Adreno 610) - Brotector: the page never showed its readiness sign
- Android (Adreno 610) - Cloudflare Turnstile (real sitekey): the page never showed its readiness sign
- Windows - Fingerprint Pro playground: the page never showed its readiness sign
Notes on this run
- Android, first measurement: the client closed the persona's local proxy bridge after one slow answer from its daemon, so every page after BrowserScan failed with ERR_PROXY_CONNECTION_FAILED (its 'not passed' and 'not measured' cells there mean exactly that). A client defect found by this run and fixed the same evening; the rerun was taken on the fixed client, on a different exit node (Chicago). The first BrowserScan's 90 % is 'Different time zones' (next note); the probe of that moment did not yet read the phone layout's deduction line.
- Android BrowserScan 'Different time zones' on the Indianapolis exit: the page compares names, and Chrome answers the legacy ICU name America/Indianapolis for America/Indiana/Indianapolis. Stock desktop Chrome 156 answers exactly the same on the stand, so the persona matches Chrome here; changing it would make it differ from Chrome.
- 'IP addresses are different' (BrowserScan): the exit node answered that site over IPv6 and WebRTC over IPv4 despite the ipv4 option of the login. A property of the residential exit, seen on different personas in different rounds.
- fingerprint.com not measured on Windows ('JavaScript Agent Error: Client timeout'): the residential gateway answered 503 to fingerprint.com's endpoints and 403 to its TURN server during this run. Cloudflare Turnstile and the managed challenge did not pass on Windows, Linux and Android that evening; a follow-up on 2026-11-06 settled it as the exit, not the persona: on one sticky exit at a time we ran the persona, the bare Core and stock Google Chrome. Linux and Android then passed everywhere, Windows passed 3 of 4 Turnstile runs and every challenge, and on the macOS exit nobody passed, stock Chrome included.
- fingerprint.com reports tampering and anti_detect_browser on macOS, Linux and Android, and a virtual machine on macOS; Windows was not measured by it in this run: open work.
- The control's own failures (VPN time zone, Cloudflare challenge) belong to the stand's exit and are shown to separate detector behaviour from ours.
Method
Each persona is a fresh profile created with the client defaults (one per OS: Windows, macOS, Linux, Android), launched from the client the way a person launches it, each on its own residential exit with geo and language taken from that exit.
Every detector opens in a new tab and counts only after a positive readiness sign. The instrument reads pages over the DevTools protocol without the calls detectors are known to look for.
The control is a stock Google Chrome on the stand's own connection, with no persona. It separates what a detector does to everyone from what it holds against our core, and its failures are shown too.
A cell fails when the detector holds anything against the persona: BrowserScan below 100% or with a deduction, a bot verdict other than normal, CreepJS lies or trash, Pixelscan masking or a spoofed or inconsistent flag, fingerprint.com tampering, anti-detect browser or virtual machine signals, Iphey other than trustworthy, any failed SannySoft row, any Brotector detection, or a Cloudflare check not passed.
Page text, screenshots and IP addresses never leave the stand.