Fingerprints

Draws a complete identity — a machine, a browser build, a locale — from a catalogue of devices people can actually buy. The hardware half comes out of one catalogue row rather than three independent tables: the GPU and its ANGLE renderer string, the hardwareConcurrency values that model ships with, and the displays it actually has. Drawing them separately is how an Apple M3 Max used to arrive beside a 13-inch MacBook Air panel — each value the most popular in its own column, the combination a machine nobody sells. The result is validated before it is returned and redrawn if it fails, so you never receive a Direct3D renderer on macOS. Pass a seed to reproduce an identity exactly, or deviceId to pin the machine and let everything else vary.

Replaces the profile’s fingerprint with a new one, preserving any fields the profile has locked. Refused while the profile is running.

Answers two separate questions about the stored fingerprint. problems lists what is impossible on any machine — a GPU backend that does not exist on the chosen OS, a screen with no taskbar inset, a browser version that disagrees with its own User-Agent. warnings lists what is possible somewhere but not on this machine: a claimed platform the engine cannot back below JavaScript, a GPU vendor that contradicts navigator.gpu, a chip beside a core count it never shipped with. The generator never produces either; both come from hand-editing, and neither blocks a save.

The device catalogue, as choices. Each entry is one machine somebody can buy — its GPU as the driver names it, the hardwareConcurrency values that model ships with, the memory configurations it comes in, and the displays it actually has. Pass an id back as deviceId to POST /fingerprints/generate to draw that exact machine.

The Android rows are captured phones rather than entries assembled from tables: one row is one device, and its screen, DPR, thread count, touch points and whole WebGL record were read off the same handset. A phone id such as sm-s918u implies os: "android" on its own, so naming one is enough to draw a phone.

backed says whether this computer can stand behind the claim, and it turns on two things a page reads directly: the OS, because fonts and their metrics come from the real machine and no switch reaches them, and the GPU vendor, because navigator.gpu is not injected and reports the real adapter from a worker realm. The thread count is deliberately not one of them — Emulation.setHardwareConcurrencyOverride is applied by Chromium itself, so it holds in every realm. For a phone it is one question rather than three: whether this engine moves the whole mobile record below JavaScript. Machines that fail backed are still listed, because a profile may be destined for a different computer; they are marked rather than hidden, and choosing one raises a warning from the audit rather than an error.

The same two checks as /profiles/:id/fingerprint/validate, against a fingerprint in the request body rather than a stored profile. This is what the editor calls while someone is still choosing: it lets a draft identity be checked before it belongs to anything. Send a whole fingerprint, as returned by POST /fingerprints/generate — a partial object is refused rather than half-checked, because a missing field would silently read as a coherent one.

Drives the live browser through the probes a CreepJS-class detector uses: worker and iframe realm agreement, Function.prototype.toString integrity, property-descriptor shape, timezone against getTimezoneOffset, screen geometry, and automation traces such as navigator.webdriver, cdc_ symbols and window.chrome. Starts the profile headlessly if it is not already running, and stops it again afterwards.

A random seed value suitable for the generator, when you want to record it before generating.