Are you a real browser —
or a bot?
The check below runs the moment this page loads. It reads around two hundred things about your browser, your device and your connection — the same readings bot-detection systems take — and explains every one of them in plain English.
Nothing is stored. Nothing is uploaded. Nothing asks you for permission.
Reading your browser…
Around two hundred readings, all of them ones any website can take without asking.
Six families of signal, and why each one says anything at all.
No single reading proves anything. A missing plugin list, an unusual graphics driver, a straight pointer path — each has an innocent explanation. It is the combination that carries the weight, which is why the check shows you all of it rather than a verdict on its own.
Automation frameworks
Selenium, Puppeteer, Playwright, PhantomJS and their relatives leave objects behind in the page. We look for every marker they are known to drop, including the ones stealth plugins usually miss.
Headless environments
A browser with no window on a screen answers questions differently. No window frame, no GPU, no fonts, no audio devices — each is weak alone and telling together.
Spoofing and tampering
Changing a user-agent takes a second. Changing everything else to match takes real effort. We cross-examine the claimed identity against the engine's own behaviour, the installed fonts and the graphics driver.
Device fingerprint
Canvas, WebGL, audio, fonts, codecs and screen metrics combine into a signature that identifies this machine without a single cookie. Seeing yours is the point of this page.
The connection itself
Half the picture arrives before any JavaScript runs. Headers, source address and the country the request came from — compared against what the page says about itself.
How you move
Pointer acceleration, path curvature, how long keys are held. The hardest part for a script to imitate, and the part you satisfy simply by using the page.
What this page does not do.
A page that reads two hundred things about your browser should be very clear about what happens to them. Here is the whole list.
- No storageNo cookie, no localStorage entry, no IndexedDB record. Reload the page and it starts from nothing.
- No uploadThe report never leaves the page. Copying or downloading it is something only you can do.
- No promptsEvery reading is one a site can take silently. Camera, microphone and location are deliberately excluded.
- No keystrokesThe behavioural check reads how long keys are held, never which keys. What you type is never inspected.
The ones people actually ask.
Is anything stored or sent anywhere?
No. The readings stay in the page, nothing is written to a cookie or to storage, and the report is never uploaded. One request does leave your browser — to our own endpoint, so the page can show you the address and headers your connection was already sending us. That request is not logged or kept.
Will this ask for permission to use my camera or location?
Never. Every reading on this page is one a website can already take silently. We deliberately excluded anything that would raise a prompt — no camera, no microphone, no location. That restraint is the whole point: what you see here is what any site sees without asking you first.
It says I'm a bot, but I'm not. What happened?
Usually one of three things: a privacy extension that randomises your canvas signature, a hardened or anti-detect browser that rewrites what it reports, or a virtual machine and remote desktop with no real graphics card. All three look like the techniques automation uses, because they are the same techniques. Open the flagged check and it will show you the exact reading it judged.
It says I look human, but I'm running a bot. Does that mean it's undetectable?
It means these particular checks found nothing. A well-configured automation setup can pass a browser-side test — that is exactly why real detection also uses network reputation, request patterns over time and server-side signals that a page like this cannot see. Treat a clean result as the absence of evidence, not proof.
What is the score out of 100?
It starts at 100 and comes down for each finding, weighted by how conclusive that finding is. A driver flag costs a lot. Something a privacy setting could explain costs half, and says so in its own note. So the score counts what we did not find, rather than claiming a confidence we could not justify.
Why does the result change while I'm on the page?
The behavioural checks keep running. When you arrive there is nothing to judge, so they sit out of the score. As soon as you move the pointer or type, they start contributing and the result settles.
Why does askFinz have a page like this?
We run a web crawler and a fleet of indexing nodes, so we spend a lot of time on both sides of this problem: identifying ourselves honestly to the sites we visit, and recognising automated traffic to our own. This page is the test rig we built for that work, opened up.
We run a crawler of our own. Every site it visits gets a browser it can identify, a rate it can live with, and rules it can refuse.