liarjs

npx liarjs                                 # your local Chrome
npx liarjs --headless --min-score 60       # CI gate
npx liarjs --cdp http://127.0.0.1:9222     # any browser with a debug port

   18 / 100  Unverified · driver unchecked
  fingerprint −0  ·  network −12  ·  automation −60

  ✗ navigator.webdriver −40
    webdriver=true, the automation flag is set.

  ✗ Worker ↔ main-thread consistency −20
    A Web Worker reported different values than the main thread for userAgent, canvasHash.

  ! IP timezone ↔ browser timezone −12
    IP resolves to America/Los_Angeles but the browser reports Asia/Shanghai.

  22 checks · 2 critical · 1 warnings · 18 clean
  edge: 203.0.113.7 · AS4058 … · LAS · HTTP/2 · TLSv1.3

Packages

liarjs.dev runs these exact packages, so a score there and a score in your pipeline mean the same thing.

Why this exists

Fingerprint test pages tell you what you look like. They don't tell you whether you're coherent, and incoherence is what modern detection actually keys on. A profile can present a pristine Chrome in JavaScript and still negotiate a handshake no Chrome would send, from an IP whose timezone is twelve hours off.

The expensive version of that problem is regression: a rebase onto a new Chromium, a Chrome major that changes the plugin face, a patch that fixes canvas and quietly desyncs WebGPU from WebGL. Nobody catches it by looking. They catch it weeks later, in the ban rate. So the checks are a package with an exit code, a JSON payload and a diff: something you can put in front of a merge.

• 40 checks. 32 need nothing but the browser (--offline), 8 compare the JS story against what the wire actually carried.
• 19 probes. Canvas, WebGL + WebGL2, WebGPU, audio, 220 fonts across three independent detection paths, WebRTC, a cross-thread Web Worker comparison, and [native code] verification of 26 APIs.
• Attaches to anything speaking CDP. Your Chrome, a Chromium fork you patched, an anti-detect browser's per-profile debug port, or a Playwright/Puppeteer page you already have.
• Zero runtime dependencies. Node ≥ 22 and its built-in WebSocket. No Puppeteer, no Playwright.

Full check table, options, CI recipes and limitations: packages/cli/README.md.

Collect fingerprints from your own site

@liarjs/collect is not only the CLI's payload. It embeds standalone, in either of two modes.

Send mode: one tag, no code, POSTs each sample to your backend and dedups per browser:

<script src="https://stargazers.cn/raw/liarjsdev/liarjs/main/liarjs-collect.min.js"
        data-endpoint="https://api.example.com/fp"
        data-token="your-token"></script>

Export mode: collects and hands the visitor a JSON file, making no request at all:

<script src="https://stargazers.cn/raw/liarjsdev/liarjs/main/liarjs-collect.min.js" data-mode="export"></script>

Then score the samples server-side with the same rules the CLI uses:

import { computeVerdict, emptyServerData } from '@liarjs/checks';
const verdict = computeVerdict(sample, { ...emptyServerData(), ip, ipTimezone });

Configuration, the payload shape, the endpoint contract and the privacy defaults are in packages/collect/README.md.

Develop

pnpm install
pnpm build
node packages/cli/dist/cli.js --offline --headless --all
node packages/collect/scripts/smoke.mjs        # exercises both embed modes in headless Chrome

This repository is a read-only mirror

The canonical source lives in a private monorepo alongside the site; this repo is published from it with git subtree split, so pull requests here cannot be merged and will be closed with a pointer back to issues. Bug reports, check proposals and false-positive reports are very welcome. Open an issue and include the --json output if you can.

What this is not

It measures internal coherence, not whether a site will ban you. Real defences also weigh proxy reputation, account age and behaviour, none of which any fingerprint tool can see. It ships no evasions, profiles or proxies.

MIT © liarjs.dev