# What does Pixelscan check?

> Pixelscan checks whether a browser's fingerprint agrees with itself and with its IP, then names the card that failed. What each card reads, with our dated runs.

Source: https://mosaicbrowser.com/guides/what-does-pixelscan-check

## What does Pixelscan check?

Pixelscan checks whether your browser's fingerprint is consistent: that the browser, operating system, hardware, fonts and locale it reports agree with each other and with your IP address. It shows one headline verdict, consistent or inconsistent, and cards for masking, automation and proxy use.

![3 in 20: Pixelscan called stock Chrome masked 3 times in 20](https://mosaicbrowser.com/covers/what-does-pixelscan-check.webp)

Pixelscan is a scanner built to catch anti-detect browsers, so it asks a narrower question than most fingerprint sites. It does not care how rare you are. It asks whether the browser in front of it could be a real machine: does the operating system match the fonts, does the graphics chip match the rest of the hardware, does the timezone match the IP. When something does not fit, it says which card failed.

We run Pixelscan when we test a build of Mosaic's engine, with an untouched Google Chrome on the same Mac as the control. Everything below comes from those runs, with the date of each.

## What Pixelscan checks, card by card

The scan lives at `pixelscan.net/fingerprint-check` and starts on its own when the page loads. While it works, the headline reads "Your Browser Fingerprint is scanning". It then settles on one of two words, consistent or inconsistent, above a row of cards. These are the four we read on every run:

| Card | What it compares | Clean label |
| --- | --- | --- |
| Browser | The browser and version the User-Agent claims, against what the page can test directly | the browser named, for example "Chrome 153.0.0.0 on Android" on one of our phone profiles |
| Masking | Whether reported values contradict the machine underneath them | "No masking detected" |
| Bot check | Signs that a program is driving the browser | "No automated behavior detected" |
| Proxy | The exit IP and its location, against the browser's timezone and language | "No proxy detected" |

Every clean label is a negation. That matters if you read results with a script: a pattern looking for "masking detected" also fires inside "No masking detected". Our own runner made exactly that mistake and recorded ten clean profiles as failures before we found it.

Below the cards, a table headed "What Websites See About You" lists the raw values: User-Agent, screen, WebGL renderer, a canvas hash and a font hash with the fonts it found. That table is where the cause of a red card usually shows.

Mosaic is a desktop app

Email yourself the link and open it on your computer.

[How it works: Its own Chromium](https://mosaicbrowser.com/features/engine)

## Why Pixelscan says masking detected

Masking means a value was changed and the change can be seen. Three causes came up in our own runs, each found by changing one field on one profile and running the scan again.

**The operating system claim.** In September 2026 we had a profile on a Mac claim Linux. Pixelscan's font row read one font, Abyssinica SIL, against 159 for the same Mac claiming macOS, and the verdict was "Masking detected". Claiming Windows was worse: three profiles left the headline on "scanning" for more than ninety seconds and never returned a verdict. Fonts and how they render come from the real computer, and no switch in a browser reaches them. For a while Mosaic refused such profiles. Since 3 November 2026 it allows them, drawn coherently for the OS they claim, and the editor shows a caution, because the fonts are still the Mac's and the computer's own OS is the strongest match.

**Hidden fonts.** An early build of our engine hid a few font families at random to vary the list. A bisect on one profile, switching off one surface at a time, showed the hiding was the whole cause: canvas, WebGL, audio and client rects could all stay on and pass. A Mac missing two system fonts is not a rare Mac. It is a Mac nobody owns. That build was changed to stop hiding fonts.

**A graphics chip the browser cannot back.** On a stock Chrome with a renderer string changed on top, claiming an Apple M2 Pro on an M4 Max machine failed Pixelscan every time while IPHey and BrowserScan did not move. The renderer string and the capability record the real driver wrote no longer agreed. Our engine changes both together in C++, and the same sweep on it passed every chip we tried.

![The fingerprint tab of a Mosaic profile: GPU, screen, fonts, timezone and language drawn to match its exit](https://mosaicbrowser.com/shots/fingerprint-detail.png)
*One profile's fingerprint, drawn as one machine and matched to its exit*

## What the proxy card measures

Half of a consistency scan is about the network. Pixelscan reads the exit address, places it on a map, and compares that place with the timezone and language list the browser reports. A profile claiming Europe/Berlin and German that browses from a Texas address is inconsistent whatever its hardware says.

That is why a result means little until you say what the profile was paired with. Our September runs used no proxy, so the scanner compared each profile with this Mac's own home connection. Mosaic draws a profile's timezone, language and geolocation from its proxy's measured exit; with no proxy it matches the computer's own location. Checking the exit before you trust it to an account is covered step by step in [how to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it).

## How often Pixelscan disagrees with itself

This is the number that changed how we read Pixelscan. In September 2026, on one Mac, with no proxy on any row:

| Browser | Runs | Clean | "Masking detected" | No verdict |
| --- | --- | --- | --- | --- |
| Untouched Google Chrome, fresh profile each run | 20 | 16 | 3 | 1 |
| Freshly drawn Mosaic profiles | 74 | 73 | 1 | 0 |

The one Mosaic profile that showed masking then passed nine runs in a row. So Pixelscan calls Google's own browser masked about one run in six, and a verdict that a stock browser of the same version also gets is not a finding about your profile.

Two habits follow. Run the scan three times before acting on a red card. And run an untouched browser of the same version from the same address beside it, so you can tell a site's bad day from a real fault.

We also found one real, rare failure that the rule above would otherwise hide. One profile failed every run while fresh ones passed. Copying its fingerprint to a new seed made it pass, and putting the old seed back made it fail again. Turning off canvas noise on that profile alone made it pass. Of 14 freshly drawn seeds tested after that, all 14 passed. If a single profile keeps failing and a fresh one does not, the variable is that profile, not the engine.

## What a Pixelscan pass does not tell you

A clean Pixelscan result says the fingerprint is believable and agrees with the IP on that run. It does not say the IP has a clean history, that your behaviour looks human, or that a platform will accept an account. Commercial bot protection such as Cloudflare reads TLS and request patterns that Pixelscan does not show you. The values Pixelscan compares are explained one by one in [what a browser fingerprint is](https://mosaicbrowser.com/glossary/browser-fingerprint).

## Running Pixelscan from a Mosaic profile

1. In the profile list, open the row's menu and choose **Check detectors**.
2. In **Check this profile**, stay on the **Consistency** tab and pick **Pixelscan**.
3. Mosaic starts the profile if it is not running and opens the scan in a new tab of that profile's own browser.
4. Read the headline and each card yourself. Nothing is scored in Mosaic; the dialog shows what a pass looks like on that page.

The same list is on the API as `GET /detection-tests`, and `POST /profiles/:id/detection-test` with `{"testId":"pixelscan"}` opens it.

Our last whole-catalogue run with a stock control, on 19 September 2026, read Pixelscan as consistent, no masking and no automated behaviour, and the untouched Chrome beside it read the same. The values it compares are set inside [Tesseract Chrome, our own Chromium](https://mosaicbrowser.com/features/engine), in C++, so the page, its workers and its iframes all see one machine.

## Sources

1. [Pixelscan: fingerprint check](https://pixelscan.net/fingerprint-check), read September 19, 2026

## Questions

### Is Pixelscan accurate?

It is a live site and it disagrees with itself. On our build Mac in September 2026, an untouched Google Chrome was called masked in 3 of 20 runs. One red result is a question to re-run, not a verdict.

### Why does Pixelscan say masking detected?

Usually because something the browser claims cannot be true of the computer it runs on. The clearest case we measured: a profile claiming Linux on a Mac showed 1 font where the Mac had 159, and Pixelscan named it masking.

### Does Pixelscan check my IP address?

Yes. It reads the exit address and compares its location with the browser's timezone and language. A run with no proxy compares the profile with your own connection, so say which exit a result came from.

### Does passing Pixelscan mean a site will not flag me?

No. Pixelscan is one public scanner with its own model. Commercial bot protection reads different signals, and every platform's own rules still decide what an account may do.

## Related

[Browser fingerprint: what a site can read about your machine](https://mosaicbrowser.com/glossary/browser-fingerprint): A browser fingerprint is the set of values a site reads about your browser and computer, which together recognize you without cookies. What goes into one.

[An anti-detect browser with its own Chromium engine](https://mosaicbrowser.com/features/engine): Mosaic is an anti-detect browser with its own Chromium engine, Tesseract Chrome: stock source plus 64 patches that change fingerprint values in C++.

[Match browser timezone to proxy exits, automatically](https://mosaicbrowser.com/features/exit-matching): No need to match browser timezone to proxy by hand: Mosaic sets each profile's timezone, language and location from the measured exit, before every launch.

[How to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it): Check that a proxy answers and tunnels, where its exit really is, whether the address is residential or blocklisted, and that the browser stays behind it.

[Why we built our own Chromium instead of injecting JavaScript](https://mosaicbrowser.com/blog/why-we-built-our-own-chromium): Mosaic changes fingerprint values in C++ inside its own engine. Three measured differences between Chrome and plain Chromium explain why that matters.







## Run this guide on your own accounts

Every Mosaic profile is a fingerprint, a proxy exit and a cookie jar that agree with each other, kept on your computer. Free holds 3 profiles. Pro is $49 a month for any number.

Mosaic is a desktop app

Email yourself the link and open it on your computer.