Browser Fingerprint Checker - Canvas, WebGL and WebRTC Leak Test

Every value below is read live from your own browser. Start with the WebRTC leak result: it tells you whether your real IP is escaping past your proxy or VPN.

Why the WebRTC leak test matters most

WebRTC is the browser technology behind video and voice calls. To connect two people directly, it asks your operating system for your network addresses - and by design that happens outside the proxy tunnel your HTTP traffic uses. That means a browser can hand a website your real IP even while every page request goes through a proxy or VPN.

If the check above reports a leak, your proxy setup is not actually hiding you from any site that runs a few lines of WebRTC JavaScript. The usual fixes are disabling WebRTC in the browser, using an antidetect browser that patches the API, or routing traffic at the system level rather than only in the browser. Re-run this test after each change to confirm the leak is gone.

What a canvas fingerprint actually is

A canvas fingerprint is produced by drawing text and shapes to an invisible canvas element and reading the resulting pixels back out. Because GPU model, driver version, font rendering and anti-aliasing all differ slightly between machines, the pixel output is near-unique per device. Sites hash it into a short string and use it to recognise you across sessions, and across IP addresses.

This is why swapping IPs alone does not make you a new visitor. If your canvas hash, WebGL renderer string and screen metrics stay identical across ten different residential IPs, a serious anti-bot system can still cluster all ten sessions as one device. Proxy quality and fingerprint hygiene are two separate problems, and you need both solved.

Reading the WebGL and hardware values

The WebGL vendor and renderer strings expose your actual graphics hardware, often down to the exact GPU model. Values that read as software renderers, or as virtualised adapters, are a common tell for headless browsers and cheap virtual machines - and several anti-bot vendors score them accordingly.

CPU core count, device memory, screen resolution and colour depth are individually weak signals, but combined they narrow you down quickly. A useful sanity check: does the profile look like a plausible consumer machine? A 1x1 viewport, one CPU core or a missing renderer string is a stronger bot signal than any single IP-based check.

Timezone and language consistency

Mismatches are what get sessions flagged. If your IP geolocates to Germany but your browser reports an America/New_York timezone and en-US as the only accepted language, the two stories do not agree, and that inconsistency is trivially detectable. Compare the values above against the IP-based location shown by our what-is-my-ip tool.

For anything session-based - account management, checkout flows, ad verification - align timezone, language and locale with the proxy exit country before you start. It costs nothing and removes one of the easiest reasons to challenge your traffic.