Full Fingerprint Spoofing: What 'Full' Actually Means in 2026

"We spoof Canvas, WebGL, and Audio." Every anti-detect's marketing copy. None of them lie outright, but each of them undersells what's missing.

A modern fingerprinting library (Castle, Cloudflare Bot Management, Akamai Bot Manager, Datadome) probes dozens of surfaces to build a confidence score. Spoofing three is not "full." Here's the inventory of what Afina covers, with notes on which surfaces are commonly missed by competitors.

The 47 surfaces

Device-level (12)

• Canvas 2D rendering — pixel-level hash with text and curves
• WebGL renderer + parameters — graphics card model, GLSL version, extensions
• WebGL shader precision — float precision per shader stage
• AudioContext oscillator output — float32 sample buffer hash
• ClientRects rounding — sub-pixel rounding model of layout
• Screen properties — dimensions, colorDepth, pixelDepth
• Device pixel ratio
• Battery API — even presence of the removed API leaks browser version
• Hardware concurrency — number of logical cores
• Device memory (deviceMemory) — heap memory in GB
• Touch points (maxTouchPoints)
• Pointer hover capability (CSS @media hover)

Browser-level (15)

• User-Agent + Client Hints — UA-CH headers must match UA string
• Accept-Language + navigator.languages
• Timezone — Date.getTimezoneOffset() and Intl.DateTimeFormat resolved zone (they leak independently)
• Locale — Intl.Collator, Intl.NumberFormat
• Plugins list — even though Chrome reports empty, empty in the right way
• Mime types
• Permissions API state for notifications, geolocation, push
• Speech synthesis voices list
• WebDriver flag
• Chrome runtime properties
• Window properties — outerWidth/outerHeight vs innerWidth/innerHeight relationship
• Document properties — document.hidden, visibilityState
• CSS @supports queries for browser-specific features
• Performance timing — connection start vs end nanosecond patterns
• Font enumeration — installed fonts list (most underestimated surface)

Network-level (8)

• TLS JA3 / JA4 fingerprint — cipher order, extensions, ALPN
• HTTP/2 frame ordering and SETTINGS — second JA-style fingerprint above TLS
• HTTP/3 / QUIC fingerprint — only matters if you support UDP
• Akamai-style behavioural signals — packet sizes, TCP options
• WebRTC ICE candidates — see our UDP article
• DNS resolver — DoH endpoint visible to authoritative servers
• IP geolocation consistency — IP, timezone, locale, font set must align
• CDN-specific Anubis / PerimeterX challenges

Behavioural (12)

• Mouse movement model — Bézier vs straight, jitter, micro-pauses
• Keystroke dynamics — dwell time, flight time distribution
• Scroll behaviour — wheel-deltaY distribution, momentum
• Touch event sequences (mobile)
• Pointer events ordering — pointerover before mouseover
• Focus/blur cadence
• Tab switching frequency
• Form fill timing — character cadence, paste vs type
• Selection events
• Visibility change handling
• Page visibility lifecycle
• Beforeunload / unload behaviour

Where most competitors stop

The majority of anti-detect browsers cover the first six device-level and first five browser-level surfaces. That's 11 of 47. Modern detectors expect all 47 to be coherent.

The most commonly missed:

• ClientRects rounding — even Multilogin's Stealthfox missed this until 2025
• AudioContext oscillator — Dolphin spoofs the value but not the per-channel correlations
• Font enumeration — almost no one ships per-region font sets
• HTTP/2 SETTINGS ordering — only Afina, Linken Sphere 2 and Octo get this right
• Behavioural surfaces — universally missing; you need a separate humaniser

What Afina ships

All 47 surfaces are spoofed at the engine level, with values derived from the chosen device profile (Win 11 / Chrome 132 / RTX 4060 / etc.) rather than randomised. Behavioural surfaces are covered by the Scenarios humaniser; if you build automations on Afina, you don't need a separate library like puppeteer-extra-stealth.

The injector is written in Rust (see our Rust article) and applies at Chromium's V8 layer before any page script runs, so detection scripts can't observe the swap.

How to test coverage

We use a fixed eight-tool battery to grade engines:

1. demo.fingerprint.com — ML scoring (detailed walkthrough)
2. iphey.com — should be all-green (100% guide)
3. pixelscan.net
4. browserleaks.com (canvas, webgl, audio, fonts, webrtc, tls)
5. creepjs
6. abrahamjuliot.github.io/creepjs
7. bot.sannysoft.com
8. arh.antoinevastel.com/bots/areyouheadless

A score of ≥9/10 on all eight is the standard we require for #1 placement on this site. Afina is currently the only product that clears that bar in our quarterly checks.

Bottom line

"Full" is a number: 47. Everything less is partial. Modern detectors look at the gaps as much as the values, so a half-spoofed profile signals "anti-detect" louder than a half-spoofed profile signals "real user." Cover everything or cover nothing.