CreepJS Fingerprint Detection Explained: More Detailed Than Whoer

Anyone running multiple accounts has probably felt this frustration: Whoer scores near-perfect, IP, DNS and WebRTC are all green — and the account gets banned anyway. What went wrong? You may be missing a harsher test — CreepJS.

Unlike regular detection tools, CreepJS doesn't "score and rank" fingerprints; it does one thing: verifies whether your browser is "lying". This article explains why it's called one of the harshest fingerprint detectors, how to read its results, and where it belongs in your verification flow.

First, Distinguish Two Types of Detection Tools: Which Layer Are You On?

Fingerprint detection tools come in two schools (a full tool roundup with comparisons is in the Fingerprint Detection Tools Guide; here we focus on the layer difference):

• School one: reading "values". Tools like Whoer and BrowserScan check the values of each parameter — where's the IP, does the timezone match, does WebRTC leak — then give a score. They answer "what your disguise looks like".
• School two: verifying "authenticity". CreepJS belongs to this school. It doesn't care who you're pretending to be; it stares at another question — are your parameters self-consistent, have APIs been tampered with. It answers "does your disguise have cracks".

To put it plainly: regular tools are like medical checkups (measuring blood pressure and temperature), while CreepJS is like a polygraph (listening for contradictions in what you say). Someone who passes every checkup can still be caught by a polygraph — that's why "Whoer full score still gets banned": in platform risk-control logic, beyond parameters, they check whether parameters are trustworthy.

CreepJS's Killer Feature: Lies (Lie Detection)

CreepJS's most famous capability is Lies detection — specifically identifying whether native browser APIs have been tampered with by scripts. The principle in plain language:

• Faking fingerprints must modify code: to make Canvas output different images or WebGL report a different GPU, fingerprint browsers must "modify" these functions' behavior at the JS level.
• Modifications leave traces: every native JS function has original code, and modified functions can't pass two probes — ① toString() checks (a native function's toString should return function xxx() { [native code] }; wrapped ones expose custom code); ② abnormal call behavior (e.g., calling the same collection function twice in a row yields inconsistent outputs, meaning it was intercepted in between).
• CreepJS lists these traces: how many APIs in your environment have been hooked and which functions — it tells you item by item.

For multi-account operators this information is enormously valuable: platform risk control uses exactly this kind of detection logic — the more "lies" in an environment, the more easily its user gets identified as a fingerprint browser user. A perfect score on ordinary tools only means parameters are complete; the Lies count shows disguise quality.

Its Unique Dimensions: Cross-Verifying the Real Engine

Beyond Lies, CreepJS has several angles nobody else covers (all centered on "authenticity"):

• Worker comparison: re-collects the fingerprint in a Web Worker's independent thread and cross-checks against the main thread's results — if they disagree, the main thread's data has been tampered with.
• Engine trait verification: uses known browser-engine quirks to judge whether your claimed UA matches real engine behavior — e.g., the UA claims a certain Chrome version, but some JS behavior traits don't match that version.
• Prototype chain and data integrity: checks whether object prototype chains have been polluted and cache data stays consistent — layer upon layer of cross-checking, hunting for "surface-consistent, detail-revealing" spots.

The common thread across these dimensions: not checking whether a value is right, but whether the whole environment "is a genuine browser" — a capability Whoer/BrowserScan don't cover at all.

How to Read CreepJS Results? Watch Three Spots

Visit the CreepJS page and wait for detection to finish (the first run takes tens of seconds; it runs heavy cross-validation in the background), then watch three spots (specific layout follows the actual page):

• Lies list: fewer is better, ideally near zero; each entry notes which API was tampered with and the suspected reason — this is your most direct window into your environment's "disguise quality".
• Trust Score / trust grade: CreepJS gives a composite trust evaluation — combining Lies data and other verification results. Don't panic over a low grade; focus on what got deducted.
• Consistency across dimensions: how well the Canvas, fonts, worker, engine blocks agree with each other — modules showing obvious contradictions deserve attention.

An important reminder: CreepJS is extremely strict — nobody gets a "perfect report" from it — even excellent fingerprint browsers expose some modification traces. So don't chase "zero Lies"; use it as a comparison tool: compare multiple environments on the same machine, before-and-after comparisons — the environment with fewer Lies is the better environment.

Found Lies. Now What? Can Fingerprint Browsers Solve It?

This is the key question: detection found Lies in your environment, what next? Direct conclusion — mature fingerprint browsers like MasBrowser can mitigate and reduce them, but no one can promise zero. The reason is simple: CreepJS and fingerprint browsers are in constant back-and-forth — detectors keep finding new tamper traces (new probe methods), defenders keep improving injection so traces hide better; this isn't a match of "who wins eventually", but whose version iteration keeps up.

On the practical side, do four things by priority:

• ① Use the product's latest version. Fingerprint injection methods iterate continuously as platform risk control upgrades — old versions may perform visibly worse on CreepJS than new ones. Upgrading and re-testing is the cheapest optimization (update details available from the product's official site or support).
• ② Compare to find the best configuration. Build 2-3 environments on the same computer (same proxy, different configs), run CreepJS on each and compare Lies counts — the best-performing config is your "golden template", reused for all future environments.
• ③ Tiered usage strategy. Assign environments with fewer Lies to high-value accounts (main stores, ad accounts); routine operations (test accounts, temporary tasks) use normal environments — spend limited "cleanliness" where it matters.
• ④ Feed details back to the vendor. Screenshot the specific Lies items CreepJS reports and send them to your fingerprint browser's support — mature products fold such feedback into future optimization lists.

Note the final layer: after each config change, rerun CreepJS for a before-after comparison — confirm the change actually improved things, not that it "feels better". Data speaks louder than any trick.

Where Does It Fit? Building the Three-Layer Funnel

Where should CreepJS go in the verification flow? Recommended ordering (the first two layers have detailed flows in the "ip-api + BrowserScan dual-tool test" section of How to Verify Isolation):

1. Layer 1: ip-api checks the network layer — do IP region and timezone match? (cheapest cost; rules out basic errors first)
2. Layer 2: BrowserScan checks the parameter layer — are UA, Canvas, WebGL, fonts complete, any leak warnings?
3. Layer 3: CreepJS verifies authenticity — does the disguise look real? How many Lies?

The three layers map to "where you are → who you are → whether you're real" — only when all three layers are green dare you put high-value accounts in this environment. Teams building environments at scale can turn this funnel into an SOP: run three steps before each new environment goes live; logging into accounts is step four.

FAQ

Is CreepJS free?

Yes. CreepJS is an open-source project; the web version is free, no registration needed — which is why many people don't know it but everyone who tries it says it's brutal: it has zero commercial motive to give you "pretty" scores.

Is it normal to see many Lies?

Totally normal — almost all fingerprint browsers leave API modification traces somewhere; a target of exactly zero is neither realistic nor necessary. The right approach is using CreepJS as a comparison baseline: if environment A's Lies are fewer than B's, log more valuable accounts into A.

Can CreepJS detect which fingerprint browser I'm using?

It doesn't directly conclude "you're using XX browser", but the Lies details it exposes (which APIs were changed, how) do indirectly reflect the implementation quality of the product you use — which is why some vendors care about their products' performance on CreepJS.

What should I do seeing many Lies?

Follow the four steps above under "Found Lies, now what": upgrade to latest → compare configs for the best one → tier high-value accounts → feed details back to the vendor. Also, don't over-worry: Lies are universal across fingerprint browsers — your competitors have them too. Aim to be cleaner than competitors, not zero.

Does CreepJS replace Whoer?

No — they complement each other. Whoer-type tools are fast (seconds), cover network-layer items like IP/DNS/WebRTC, good for daily quick checks; CreepJS is slow but deep (tens of seconds per run), suited for deep checks before critical environments go live. Use Whoer daily, add CreepJS at key checkpoints — both layers are cheap.

Where do I download a safe fingerprint browser?

Always download from your fingerprint browser's official site — installers from third-party sites or file-sharing links carry bundled plugins or repackaging risks; once installed, however many tests you run won't help. Verify the official domain spelling before downloading (phishing sites often mimic official sites); if antivirus alerts after installation or the UI looks odd, stop immediately and re-download the genuine version from the official site.

Conclusion

CreepJS fills the hardest and most important gap in the fingerprint verification system: parameters can look pretty, but cracks hide in details — Lies detection, Worker cross-verification, engine trait checks, pressing layer by layer on "are you real".

Adding it to your verification flow costs little: ip-api for network, BrowserScan for parameters, CreepJS for authenticity — the three-layer funnel takes minutes and buys the confidence "high-value accounts can go in here". Remember the key mindset shift: don't chase zero cracks; use comparisons to make environments better and better.

The free plan's 2 environments make perfect comparison experiments: build two, run the three-layer funnel on each, see which has fewer Lies — download MasBrowser from the official website, and start auditing your environments with a "polygraph" today.