Pages you point a browser at to see what it gives away — lie-detection suites, attribute dumps, consistency scanners, handshake echoes and the classic headless grids. This is the section where a link register earns its keep, because test pages rot faster than repositories and this field keeps citing them long after they stop answering.
Pages you point a browser at to see what it gives away. This section is where a link register earns its keep: test pages rot faster than repositories.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://abrahamjuliot.github.io/creepjs/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://abrahamjuliot.github.io/creepjs/tests/workers.html
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
One page per surface — canvas, WebGL, fonts, WebRTC — with the raw values rather than a verdict.
https://browserleaks.com/ — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://browserleaks.com/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
JA3 and JA4 plus the full handshake, which is the half of your fingerprint JavaScript cannot change.
https://tls.browserleaks.com/ — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://tls.browserleaks.com/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Research-backed uniqueness checker from INRIA, and the rare case where the population behind the number is documented.
https://amiunique.org/fingerprint — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://amiunique.org/fingerprint
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
The canonical red-green grid for headless and automation tells. Old, small, and still the first thing everyone runs.
https://bot.sannysoft.com/ — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://bot.sannysoft.com/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Consistency scanner: checks whether IP, timezone and fingerprint tell the same story.
https://pixelscan.net/ — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://pixelscan.net/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Trustworthiness scan across browser, hardware, software and IP.
https://iphey.com/ — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://iphey.com/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Fingerprint plus bot-detection scoring, with the formula undisclosed.
https://www.browserscan.net/ — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://www.browserscan.net/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://demo.fingerprint.com/playground
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Successor to Panopticlick. Measures entropy against a corpus it publishes the methodology for.
https://coveryourtracks.eff.org/ — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://coveryourtracks.eff.org/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Large public attribute dump with machine-readable APIs beside it.
https://deviceandbrowserinfo.com/ — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://deviceandbrowserinfo.com/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
One JSON document containing your TLS, JA3, JA4, HTTP/2 and header fingerprints. The fastest way to see what you look like below the browser.
https://tls.peet.ws/api/all — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://tls.peet.ws/api/all
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
CDP-leak-focused tests — Runtime.enable and friends — rather than the usual navigator property grid.
https://bot-detector.rebrowser.net/ — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://bot-detector.rebrowser.net/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
A long-standing live Cloudflare challenge target, kept up specifically to be challenged.
https://nowsecure.nl/ — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://nowsecure.nl/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Grab-bag of individual surface tests, useful when you need exactly one of them isolated.
https://webbrowsertools.com/ — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://webbrowsertools.com/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
https://scrapfly.io/web-scraping-tools/browser-fingerprint — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://scrapfly.io/web-scraping-tools/browser-fingerprint
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
https://scrapfly.io/web-scraping-tools/ja3-fingerprint — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://scrapfly.io/web-scraping-tools/ja3-fingerprint
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Machine-readable request-fingerprint echo endpoint — scriptable, which most of this section is not.
https://tools.scrapfly.io/api/fp/anything — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://tools.scrapfly.io/api/fp/anything
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Lightweight JA3 echo service with no page around it.
https://check.ja3.zone/ — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://check.ja3.zone/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://fpmon.github.io/fingerprinting-monitor/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why NRND: pushed_at = 2024-12-03 — 619 days, inside the 365–1095 day NRND band.
Field
Value at this printing
pushed_at
2024-12-03
archived
false
latest_release
—
license.spdx_id
MIT
stargazers_count
288
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/ttlns/brotector
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why DEAD: The link check returned 502 at 2026-08-14T09:12:00Z. DEAD is tested first.
Field
Value at this printing
http_status
502
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://arh.antoinevastel.com/bots/areyouheadless
Bad Gateway. No earlier observation in this register, so no down-since date is printed.
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Listed precisely because other registries still list it without checking. A dead entry that is marked dead is more useful than a live entry nobody verified. — ED.
Why DEAD: The link check returned no response at all at 2026-08-14T09:12:00Z. DEAD is tested first.
Field
Value at this printing
http_status
no response
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://www.deviceinfo.me/
Connection failure — no HTTP response at all, from two attempts.
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
A test page reads your browser and prints what it saw. The useful ones print raw values and let you draw the conclusion; the less useful ones print a score computed by a formula they do not publish. This register prefers the first kind and says so, for the same reason it publishes no score of its own: a number with an undisclosed formula cannot be debugged, and when it tells you something is wrong you still have to go and find out what.
What none of them can tell you is whether you are safe. A page measures one browser at one instant against whatever the page's author chose to collect. It has no view of what a specific defence deployed on a specific site is collecting, and passing every test on this page is a statement about these tests.
Contradiction beats rarity, and that is what to look for
The research filed in section 05 keeps arriving at the same finding from different directions: what gets a spoofed browser caught is not being unusual but being internally inconsistent. A user agent that says one operating system while the font list says another; a page context that has been patched while the worker context has not; a browser-shaped JavaScript surface over a tool-shaped TLS handshake.
So the highest-value pages in this section are the ones that ask the same question through several routes and show you where the answers differ. Read a worker-scope result against a page-scope result. Read a handshake readout against what the page says the browser is. The disagreements are the findings; the individual values mostly are not.
State marks used in this section
ACTIVE — Shipping. Safe to build on today.
21 here
NRND — Not Recommended for New Designs. Works; do not start here.
1 here
DEAD — Unreachable, or untouched past the outer threshold.
2 here
Questions about detection test pages
Answered from the fields printed above, and from nothing this register has not checked.
Which fingerprint test page should I use?
Depends what you are debugging. A lie-detection suite that asks the same question from several contexts finds contradictions; an attribute dump that prints raw values is better for confirming a specific change; a scriptable echo endpoint is the only kind you can assert against in a test suite. This register prints the state and check date for each and ranks none of them.
Why are some test pages listed here without a link?
Because this register is kept by people who work on a browser some of those hosted services compete with, and a link to a rival's front door is a referral rather than a citation. Those entries keep every field they had and their address is printed in plain type instead. The policy is set out in full on the colophon.
Do these pages still work?
Some do not, and that is precisely why they are listed with an HTTP status and a check timestamp rather than as bare links. At the last field check this section contained entries that other registries still list as live and that returned an error or did not answer at all.
Donut Browser is filed in section 01 of this same catalogue, under the
same rubric, with the same fields printed against it and no exemption:
an open-source anti-detect browser under AGPL-3.0 whose Wayfern Chromium
fork applies fingerprint overrides at engine level over CDP rather than
by patching page JavaScript, with a local REST API and MCP server on your
own machine, self-hostable sync, zero telemetry, and a pre-launch gate
that refuses to start a profile when the proxy's exit geography
contradicts the profile's fingerprint. It is judged here the same way
everything in this section is judged.