[/tools/bot-detectors/creepjs]
← all providersvendor site ↗script2builtins ↗

creepjs (reference impl)

abraham juliot's open-source fingerprinting probe. not a detection vendor itself, included as the canonical reference for what the surface area actually looks like end-to-end. the catalog inside script2builtins is calibrated against this script.

  • creep.js (full probe)

    [ok]

    https://abrahamjuliot.github.io/creepjs/creep.js ↗

    last ran
    2026-05-19 22:32 utc
    (2d ago)
    last updated
    2026-05-15 04:50 utc
    (6d ago)
    size
    537.2kb
    sha256
    9679d2b616e1
    apis touched
    681
    681 raw
    bot tells
    178
    sinks
    3
    0 leaked
    hazards
    9
    structural
    0
    anti-debug
    0
    L3/L4 hazards
    consistency
    0
    cross-checks
    providers
    0

    categories probed (21)

    click a row to drill into every api the script probes in that category.

    • [+] navigator29 apis · 12 tells · 62 hits
      • [+] *.getHighEntropyValueshigh · bot-tell×4
        details + source hits (4)
      • [+] navigator.userAgentData.getHighEntropyValueshigh · bot-tell×4
        details + source hits (4)
      • [+] navigator.bravehigh · bot-tell×2
        details + source hits (2)
      • [+] navigator.permissionshigh · bot-tell×2
        details + source hits (2)
      • [+] navigator.webdriverhigh · bot-tell×2
        details + source hits (2)
      • [+] *.requestAdapterhigh · bot-tell×1
        details + source hits (1)
      • [+] *.requestAdapterInfohigh · bot-tell×1
        details + source hits (1)
      • [+] navigator.userAgentDatamedium×8
        details + source hits (8)
      • [+] navigator.mediaDevicesmedium×2
        details + source hits (2)
      • [+] navigator.mimeTypesmedium×2
        details + source hits (2)
      • [+] navigator.pluginsmedium · bot-tell×2
        details + source hits (2)
      • [+] navigator.connectionmedium×1
        details + source hits (1)
      • [+] navigator.deviceMemorymedium×1
        details + source hits (1)
      • [+] navigator.getBatterymedium×1
        details + source hits (1)
      • [+] navigator.gpumedium×1
        details + source hits (1)
      • [+] navigator.hardwareConcurrencymedium×1
        details + source hits (1)
      • [+] navigator.maxTouchPointsmedium · bot-tell×1
        details + source hits (1)
      • [+] navigator.userAgentData.platformmedium×1
        details + source hits (1)
      • [+] navigator.userAgentlow×7
        details + source hits (7)
      • [+] navigator.bluetoothlow×3
        details + source hits (3)
      • [+] *.getAvailabilitylow×2
        details + source hits (2)
      • [+] navigator.appVersionlow · bot-tell×2
        details + source hits (2)
      • [+] navigator.storagelow×2
        details + source hits (2)
      • [+] navigator.oscpulow · bot-tell×1
        details + source hits (1)
      • [+] navigator.pdfViewerEnabledlow×1
        details + source hits (1)
      • [+] navigator.platformlow×1
        details + source hits (1)
      • [+] navigator.vendorlow×1
        details + source hits (1)
      • [+] navigator.webkitTemporaryStoragelow · bot-tell×1
        details + source hits (1)
      • [+] navigator.serviceWorkerinfo×4
        details + source hits (4)
    • [+] webgl20 apis · 5 tells · 43 hits
      • [+] *.getParameterhigh · bot-tell×8
        details + source hits (8)
      • [+] *.getContexthigh · bot-tell×4
        details + source hits (4)
      • [+] *.getExtensionhigh · bot-tell×2
        details + source hits (2)
      • [+] *.getSupportedExtensionshigh · bot-tell×1
        details + source hits (1)
      • [+] *.readPixelshigh · bot-tell×1
        details + source hits (1)
      • [+] *.getExtensionmedium×6
        details + source hits (6)
      • [+] *.getShaderPrecisionFormatmedium×4
        details + source hits (4)
      • [+] *.compileShadermedium×2
        details + source hits (2)
      • [+] *.shaderSourcemedium×2
        details + source hits (2)
      • [+] *.drawArraysmedium×1
        details + source hits (1)
      • [+] *.createShaderlow×2
        details + source hits (2)
      • [+] *.getContextAttributeslow×2
        details + source hits (2)
      • [+] *.createProgramlow×1
        details + source hits (1)
      • [+] *.linkProgramlow×1
        details + source hits (1)
      • [+] *.useProgramlow×1
        details + source hits (1)
      • [+] *.bindBufferinfo×1
        details + source hits (1)
      • [+] *.bufferDatainfo×1
        details + source hits (1)
      • [+] *.getAttribLocationinfo×1
        details + source hits (1)
      • [+] *.getUniformLocationinfo×1
        details + source hits (1)
      • [+] *.vertexAttribPointerinfo×1
        details + source hits (1)
    • [+] audio12 apis · 5 tells · 40 hits
      • [+] *.getChannelDatahigh · bot-tell×11
        details + source hits (11)
      • [+] OfflineAudioContexthigh · bot-tell×10
        details + source hits (10)
      • [+] *.copyFromChannelhigh · bot-tell×2
        details + source hits (2)
      • [+] *.createDynamicsCompressorhigh · bot-tell×2
        details + source hits (2)
      • [+] *.startRenderinghigh · bot-tell×2
        details + source hits (2)
      • [+] *.createAnalysermedium×3
        details + source hits (3)
      • [+] *.createOscillatormedium×3
        details + source hits (3)
      • [+] *.getFloatFrequencyDatamedium×3
        details + source hits (3)
      • [+] *.copyToChannelmedium×1
        details + source hits (1)
      • [+] *.createBiquadFiltermedium×1
        details + source hits (1)
      • [+] *.getFloatTimeDomainDatamedium×1
        details + source hits (1)
      • [+] *.sampleRatemedium×1
        details + source hits (1)
    • [+] css8 apis · 4 tells · 82 hits
      • [+] *.getComputedStylehigh · bot-tell×8
        details + source hits (8)
      • [+] getComputedStylehigh · bot-tell×8
        details + source hits (8)
      • [+] CSS.supportsmedium · bot-tell×8
        details + source hits (8)
      • [+] *.blockSizemedium×1
        details + source hits (1)
      • [+] *.inlineSizemedium · bot-tell×1
        details + source hits (1)
      • [+] *.getPropertyValuelow×15
        details + source hits (15)
      • [+] document.styleSheetslow×1
        details + source hits (1)
      • [+] *.matchesinfo×40
        details + source hits (40)
    • [+] window7 apis · 4 tells · 16 hits
      • [+] chrome.runtimehigh · bot-tell×4
        details + source hits (4)
      • [+] outerHeightmedium · bot-tell×2
        details + source hits (2)
      • [+] *.visualViewportmedium×1
        details + source hits (1)
      • [+] outerWidthmedium · bot-tell×1
        details + source hits (1)
      • [+] devicePixelRatiolow×3
        details + source hits (3)
      • [+] innerWidthlow · bot-tell×3
        details + source hits (3)
      • [+] innerHeightlow×2
        details + source hits (2)
    • [+] workers5 apis · 4 tells · 9 hits
      • [+] OffscreenCanvashigh · bot-tell×4
        details + source hits (4)
      • [+] WorkerNavigatorhigh · bot-tell×1
        details + source hits (1)
      • [+] *.registermedium×2
        details + source hits (2)
      • [+] SharedWorkermedium · bot-tell×1
        details + source hits (1)
      • [+] Workermedium · bot-tell×1
        details + source hits (1)
    • [+] document9 apis · 3 tells · 45 hits
      • [+] *.contentWindowhigh · bot-tell×3
        details + source hits (3)
      • [+] document.currentScriptmedium · bot-tell×2
        details + source hits (2)
      • [+] document.fontsmedium×2
        details + source hits (2)
      • [+] document.createRangemedium · bot-tell×1
        details + source hits (1)
      • [+] document.createElementlow×21
        details + source hits (21)
      • [+] document.createEventlow×1
        details + source hits (1)
      • [+] document.styleSheetslow×1
        details + source hits (1)
      • [+] document.bodyinfo×13
        details + source hits (13)
      • [+] document.documentElementinfo×1
        details + source hits (1)
    • [+] intl7 apis · 3 tells · 17 hits
      • [+] Intl.DateTimeFormatmedium · bot-tell×6
        details + source hits (6)
      • [+] *.resolvedOptionsmedium×5
        details + source hits (5)
      • [+] Intl.RelativeTimeFormatmedium · bot-tell×2
        details + source hits (2)
      • [+] Intl.DisplayNamesmedium · bot-tell×1
        details + source hits (1)
      • [+] Intl.ListFormatmedium×1
        details + source hits (1)
      • [+] Intl.NumberFormatmedium×1
        details + source hits (1)
      • [+] Intl.PluralRulesmedium×1
        details + source hits (1)
    • [+] speech4 apis · 3 tells · 20 hits
      • [+] speechSynthesishigh · bot-tell×13
        details + source hits (13)
      • [+] *.getVoiceshigh · bot-tell×3
        details + source hits (3)
      • [+] speechSynthesis.getVoiceshigh · bot-tell×3
        details + source hits (3)
      • [+] speechSynthesis.onvoiceschangedmedium×1
        details + source hits (1)
    • [+] canvas18 apis · 2 tells · 55 hits
      • [+] *.toDataURLhigh · bot-tell×9
        details + source hits (9)
      • [+] *.getImageDatahigh · bot-tell×4
        details + source hits (4)
      • [+] *.getContextmedium×6
        details + source hits (6)
      • [+] *.fillTextmedium×2
        details + source hits (2)
      • [+] *.measureTextmedium×2
        details + source hits (2)
      • [+] *.strokeTextmedium×1
        details + source hits (1)
      • [+] *.createRadialGradientlow×1
        details + source hits (1)
      • [+] *.fillRectinfo×6
        details + source hits (6)
      • [+] *.beginPathinfo×5
        details + source hits (5)
      • [+] *.clearRectinfo×4
        details + source hits (4)
      • [+] *.strokeinfo×4
        details + source hits (4)
      • [+] *.addColorStopinfo×2
        details + source hits (2)
      • [+] *.arcinfo×2
        details + source hits (2)
      • [+] *.fillinfo×2
        details + source hits (2)
      • [+] *.moveToinfo×2
        details + source hits (2)
      • [+] *.bezierCurveToinfo×1
        details + source hits (1)
      • [+] *.ellipseinfo×1
        details + source hits (1)
      • [+] *.quadraticCurveToinfo×1
        details + source hits (1)
    • [+] timing6 apis · 2 tells · 34 hits
      • [+] performance.nowmedium×8
        details + source hits (8)
      • [+] performance.memorymedium · bot-tell×2
        details + source hits (2)
      • [+] *.getTimezoneOffsetmedium · bot-tell×1
        details + source hits (1)
      • [+] requestAnimationFramelow×1
        details + source hits (1)
      • [+] Dateinfo×21
        details + source hits (21)
      • [+] Date.parseinfo×1
        details + source hits (1)
    • [+] svg5 apis · 2 tells · 9 hits
      • [+] *.getComputedTextLengthhigh · bot-tell×5
        details + source hits (5)
      • [+] *.getBBoxhigh · bot-tell×1
        details + source hits (1)
      • [+] *.getExtentOfCharmedium×1
        details + source hits (1)
      • [+] *.getSubStringLengthmedium×1
        details + source hits (1)
      • [+] SVGRectlow×1
        details + source hits (1)
    • [+] media5 apis · 2 tells · 9 hits
      • [+] *.enumerateDeviceshigh · bot-tell×2
        details + source hits (2)
      • [+] *.canPlayTypemedium×2
        details + source hits (2)
      • [+] *.isTypeSupportedmedium×2
        details + source hits (2)
      • [+] Notification.permissionmedium · bot-tell×2
        details + source hits (2)
      • [+] crypto.subtleinfo×1
        details + source hits (1)
    • [+] introspection16 apis · 1 tells · 85 hits
      • [+] Object.getOwnPropertyNamesmedium×11
        details + source hits (11)
      • [+] Object.setPrototypeOfmedium×10
        details + source hits (10)
      • [+] Object.getOwnPropertyDescriptormedium · bot-tell×7
        details + source hits (7)
      • [+] Object.getPrototypeOfmedium×7
        details + source hits (7)
      • [+] Proxymedium×5
        details + source hits (5)
      • [+] Reflect.getOwnPropertyDescriptormedium×5
        details + source hits (5)
      • [+] *.__proto__medium×4
        details + source hits (4)
      • [+] Object.getOwnPropertyDescriptorsmedium×3
        details + source hits (3)
      • [+] Reflect.setPrototypeOfmedium×2
        details + source hits (2)
      • [+] Object.definePropertymedium×1
        details + source hits (1)
      • [+] Reflect.ownKeysmedium×1
        details + source hits (1)
      • [+] *.toStringlow×17
        details + source hits (17)
      • [+] Object.createlow×6
        details + source hits (6)
      • [+] *.hasOwnPropertylow×4
        details + source hits (4)
      • [+] *.constructorlow×1
        details + source hits (1)
      • [+] Reflect.deletePropertylow×1
        details + source hits (1)
    • [+] webrtc4 apis · 1 tells · 5 hits
      • [+] RTCPeerConnectionhigh · bot-tell×2
        details + source hits (2)
      • [+] *.createDataChannelmedium×1
        details + source hits (1)
      • [+] *.createOffermedium×1
        details + source hits (1)
      • [+] *.setLocalDescriptionmedium×1
        details + source hits (1)
    • [+] media-capabilities3 apis · 1 tells · 4 hits
      • [+] MediaSource.isTypeSupportedhigh · bot-tell×1
        details + source hits (1)
      • [+] MediaRecorder.isTypeSupportedmedium×1
        details + source hits (1)
      • [+] MediaSourcelow×2
        details + source hits (2)
    • [+] screen4 apis · 0 tells · 9 hits
      • [+] screen.widthlow×4
        details + source hits (4)
      • [+] screen.heightlow×3
        details + source hits (3)
      • [+] screen.availHeightlow×1
        details + source hits (1)
      • [+] screen.availWidthlow×1
        details + source hits (1)
    • [+] fonts3 apis · 0 tells · 5 hits
      • [+] *.checkmedium×2
        details + source hits (2)
      • [+] FontFacemedium×2
        details + source hits (2)
      • [+] *.loadlow×1
        details + source hits (1)
    • [+] dom-layout3 apis · 0 tells · 54 hits
      • [+] *.getClientRectsmedium×8
        details + source hits (8)
      • [+] *.getBoundingClientRectmedium×4
        details + source hits (4)
      • [+] matchMedialow×42
        details + source hits (42)
    • [+] storage2 apis · 0 tells · 74 hits
      • [+] *.keyslow×72
        details + source hits (72)
      • [+] *.estimatelow×2
        details + source hits (2)
    • [+] events1 apis · 0 tells · 4 hits
      • [+] *.addEventListenerinfo×4
        details + source hits (4)

    bot-detection tells (54)

    strong indicators of bot-detection intent. drill into the categories section below to inspect description, evasion notes, and source snippets for any tell.

    • speechSynthesis ×13
    • *.getChannelData ×11
    • OfflineAudioContext ×10
    • *.toDataURL ×9
    • *.getComputedStyle ×8
    • getComputedStyle ×8
    • *.getParameter ×8
    • *.getComputedTextLength ×5
    • *.getImageData ×4
    • *.getHighEntropyValues ×4
    • navigator.userAgentData.getHighEntropyValues ×4
    • *.getContext ×4
    • chrome.runtime ×4
    • OffscreenCanvas ×4
    • *.contentWindow ×3
    • *.getVoices ×3
    • speechSynthesis.getVoices ×3
    • *.copyFromChannel ×2
    • *.createDynamicsCompressor ×2
    • *.startRendering ×2
    • *.enumerateDevices ×2
    • navigator.brave ×2
    • navigator.permissions ×2
    • navigator.webdriver ×2
    • *.getExtension ×2
    • RTCPeerConnection ×2
    • MediaSource.isTypeSupported ×1
    • *.requestAdapter ×1
    • *.requestAdapterInfo ×1
    • *.getBBox ×1
    • *.getSupportedExtensions ×1
    • *.readPixels ×1
    • WorkerNavigator ×1
    • CSS.supports ×8
    • Object.getOwnPropertyDescriptor ×7
    • Intl.DateTimeFormat ×6
    • document.currentScript ×2
    • Intl.RelativeTimeFormat ×2
    • Notification.permission ×2
    • navigator.plugins ×2
    • performance.memory ×2
    • outerHeight ×2
    • *.inlineSize ×1
    • document.createRange ×1
    • Intl.DisplayNames ×1
    • navigator.maxTouchPoints ×1
    • *.getTimezoneOffset ×1
    • outerWidth ×1
    • SharedWorker ×1
    • Worker ×1
    • innerWidth ×3
    • navigator.appVersion ×2
    • navigator.oscpu ×1
    • navigator.webkitTemporaryStorage ×1

    network sinks (3)

    every place the script could ship data off the page. expand a row to see headers and the traced payload entries.

    • [+] workerGET ./creep.jsno leaks

      location · L1958:50

      new Worker(scriptSource)
    • [+] shared-workerGET ./creep.jsno leaks

      location · L1971:47

      new SharedWorker(scriptSource)
    • [+] fetchGET urlno leaks

      url source · url

      location · L7510:15

      fetch(url)

    dynamic-execution hazards (9)

    anywhere the script puts code beyond static reach. eval, function, document.write, dynamic import. these are the holes script2builtins-runtime would fill.

    • FunctionL4311:22

      `new Function` constructor compiles a string into a function. common eval-equivalent in fingerprinting blobs.

      new Function('alert(")')
    • FunctionL4312:22

      `new Function` constructor compiles a string into a function. common eval-equivalent in fingerprinting blobs.

      new Function('const foo;foo.bar')
    • FunctionL4313:22

      `new Function` constructor compiles a string into a function. common eval-equivalent in fingerprinting blobs.

      new Function('null.bar')
    • FunctionL4314:22

      `new Function` constructor compiles a string into a function. common eval-equivalent in fingerprinting blobs.

      new Function('abc.xyz = 123')
    • FunctionL4315:22

      `new Function` constructor compiles a string into a function. common eval-equivalent in fingerprinting blobs.

      new Function('const foo;foo.bar')
    • FunctionL4316:22

      `new Function` constructor compiles a string into a function. common eval-equivalent in fingerprinting blobs.

      new Function('(1).toString(1000)')
    • FunctionL4317:22

      `new Function` constructor compiles a string into a function. common eval-equivalent in fingerprinting blobs.

      new Function('[...undefined].length')
    • FunctionL4318:22

      `new Function` constructor compiles a string into a function. common eval-equivalent in fingerprinting blobs.

      new Function('var x = new Array(-1)')
    • FunctionL4319:22

      `new Function` constructor compiles a string into a function. common eval-equivalent in fingerprinting blobs.

      new Function('const a=1; const a=2;')