Verifying stealth

Before you build on a session, prove it is clean and coherent. This page shows how to check what a site actually reads, what a good result looks like, and the honest limits you should design around.

Quick self-check

The fastest check is to read back the values a site would see and confirm they describe your persona, not your real host, and that the automation tells are clean.

check.py

from capium import launch_context

browser, ctx, page = launch_context(seed=48217, platform="windows",
                                    url="https://fingerprint.com/demo/")

# The values a site reads should describe the persona, not your host.
print(page.evaluate("() => navigator.platform"))                       # Win32
print(page.evaluate("() => navigator.userAgent"))                      # ...Windows... Chrome/151...
print(page.evaluate("() => navigator.webdriver"))                      # False
print(page.evaluate("() => Intl.DateTimeFormat().resolvedOptions().timeZone"))
browser.close()

Test against detection sites

Drive a fingerprint or bot-detection test page and inspect the result the same way a real visitor would. Useful public checks include general fingerprint demos, WebRTC/DNS leak tests, and timezone/geo coherence pages. Look for:

Coherent identity. UA, UA-CH platform, and the GPU/WebGL strings all agree on one OS.
No automation tells. navigator.webdriver is false; no headless or CDP signals.
No network leaks. The WebRTC IP equals your proxy exit; the timezone and locale match the exit's region.
Stable hashes. The same seed reproduces the same canvas/audio hash across runs; different seeds differ.

A "maximum coherence" recipe

There is no magic flag that beats everything; the goal is a device whose every surface tells one story. This is a good default to start from and adapt:

clean.py

from capium import launch_context

# A solid "maximum coherence" starting point.
browser, ctx, page = launch_context(
    seed=48217,                 # a stable, matching-OS persona
    platform="windows",         # run this on a Windows host (see caveats)
    headless=False,             # headed is the recommended mode
    proxy="http://user:pass@host:port",
    geoip=True,                 # align WebRTC IP + timezone + geo to the exit
    humanize=True,              # human-like input for behavioral checks
    url="https://your-target.example/",
)

On a Windows persona running on a Windows host, also enable --fingerprint-windows-font-metrics (see Parameters).

Honest limits

In this space, documenting the limits is what builds trust. Design around these:

Run personas on a matching-OS host. A macOS persona on a Windows host (or vice-versa) can surface cross-OS rendering tells. Match the persona OS to the machine where you can.
GPU-less servers can leak. Hardware-bound WebGL/canvas checks expect a real GPU; a headless VM with software rendering may surface flags. Prefer hosts with a real (or virtualized) GPU for the hardest targets.
os_mismatch is network-level. Some systems compare your TLS/network signature against the claimed OS. That is not something a browser can fix; align your host and egress, don't expect the fingerprint layer to paper over it.
Reputation matters. A perfectly coherent device on a burned IP still gets challenged. Pair a clean persona with clean egress.

Behavioral checks

Many systems score how you interact, not just your fingerprint. Turn on humanized input and drive the page with the human_* helpers so timing and motion look human. Then re-run your detection check with humanize on and compare.

Async & persistent sessions

Deployment