What Is the Best CreepJS Alternative for Your Check?

Which CreepJS Alternative Fits the Check You’re Actually Running?

The best creepjs alternative depends on the question behind the search. CreepJS is a research audit: it checks whether a browser’s reported details match what its engine actually does, and it was never a fingerprinting library you install. To repeat that audit, run the official GitHub Pages build. For a fast pass/fail read, use Pixelscan, Iphey or IPFighter. For per-API detail, BrowserLeaks. For a stable visitor ID in production, Fingerprint’s paid platform.

Match the Tool to the Job, Not the Logo

Roundups present these scanners as one product with different names. They answer different questions. Three jobs dominate: consistency (does this browser contradict itself), forensics (which single value is wrong) and identification (is this the same visitor as last week). CreepJS covers the first, BrowserLeaks the second, Fingerprint the third. Pixelscan, Iphey and IPFighter sit between consistency and network checks, which is why they are the usual first stop when a profile looks fine but a site disagrees.

A browser profile manager such as Send.win is not on that list. It runs isolated profiles, each with its own cookies, storage, sessions, fingerprint settings and proxy, but it does not score them. You still verify each profile with the tools here.

First, Work Out Which CreepJS You Mean

Two products share the name. One is an MIT-licensed research project on GitHub; the other is a commercial service on a .org domain. Confusing them is the most common mistake in this search.

The GitHub research tool

Abraham Juliot’s CreepJS calls itself a research and education project, not a fingerprinting library. It is MIT licensed, but the name is trademarked and the repository’s policy forbids using it for commercial products or public websites. Its only official deployment is GitHub Pages, and the README now carries a security notice: any .org or .com domain claiming to be CreepJS is an unauthorised mirror.

Its test targets are privacy browsers and privacy extensions — Tor Browser, Firefox’s resistFingerprinting mode, Brave, ungoogled-chromium, CanvasBlocker, JShelter, uBlock Origin, NoScript and random user-agent add-ons. That list tells you what the output is for: finding browsers whose reported values contradict the engine underneath.

creepjs.org is a separate SaaS

The project at taoyadev/creepjs is documented as CreepJS 2.0: a REST API and a JavaScript SDK under 15 KB, fed by 40-plus collectors on Cloudflare Workers, with every collector optional in the payload. It claims a p95 API response under 50 ms and has a free tier. The original project’s trademark policy strictly prohibits that domain.

Judge it on its own terms. It is a commercial identification service with a broad collector set — canvas, WebGL, SVG, DOMRect, TextMetrics, audio, WebRTC, media devices, service workers, storage APIs, navigator and locale. It is not the audit people were reading about on GitHub.

What CreepJS Measures, and What the Score Tells You

CreepJS does not stop at collecting values. It compares what your browser reports against what the engine can be expected to do, then prints a trust report. Four groups:

• Engine and runtime: Gecko, Blink, WebKit, SpiderMonkey and V8 behaviour, including console error handling.
• CSS and layout: the reported CSS system, computed styles, emoji DOMRect, SVG output and TextMetrics.
• Graphics: WebGL parameters and GPU strings.
• Device surface: fonts, speech voices, screen metrics and timezone clues.

No single signal means much. The value is the cross-check: a Chrome user agent paired with Gecko-only console behaviour is a contradiction, and the report says so in plain text.

A trust report is not a fingerprint hash

The output is a lie-detection and tampering score, not a stable opaque ID you store and match on later. If your goal is “recognise this returning visitor”, CreepJS is the wrong instrument — and so is anything that only produces a trust score. If your goal is “does this profile contradict itself”, it does that job at no cost. That distinction explains much of the confusion around why browser profiles fail CreepJS audits: profiles are judged on internal consistency, not identity.

Uniqueness and stability are two different numbers

Every scanner here measures one or both. Uniqueness is the share of browsers distinguishable from all others: EFF’s original Panopticlick research found 83.6% of browsers had a completely unique fingerprint, and AmIUnique and Cover Your Tracks typically report roughly 70-85%. Stability is how often the same device produces the same result across visits.

Signal weight varies. Canvas 2D and the WebGL renderer carry very high entropy and stay stable for months. Fonts, screen resolution and CPU core count sit at medium entropy but very stable. User agent is low-to-medium entropy and changes with every browser update, which is why scanners leaning on it shift their answer every few weeks.

Feature by Feature: How the Alternatives Compare

Each of these gives you a reading in a browser tab within seconds. Only Fingerprint and CreepJS 2.0 sell programmatic access on top of that reading.

Fast pass/fail checks: Pixelscan, Iphey, IPFighter

Pixelscan analyses fingerprint, IP and proxy status together in seconds, flags inconsistencies and automation indicators, and assumes you already know multi-profile terminology. Iphey puts user-agent data, canvas, WebRTC, AudioContext, fonts and plugins on one page, then adds IP, VPN and proxy checks, bot signals, DNS leaks and IP blacklists. IPFighter runs its fingerprint check client-side on page load, free and without signup, scoring eleven signal groups from user agent and screen through hardware, language, canvas, WebGL and audio — its IP and leak checks now live in separate tools.

Per-API forensics: BrowserLeaks

When a report says something is off and you need the exact value, BrowserLeaks exposes individual browser APIs in depth, with strong leak checks. It will not hand you a verdict: you need to know which page to open and what a normal value looks like.

Consistency scoring: BrowserScan

BrowserScan returns a trust score plus network, hardware, software and consistency categories, and checks for leaks and automation indicators. Reviewers who recommend alternatives most often cite false positives and less fingerprint depth. A decent second opinion, weak as the only one.

Production identification: Fingerprint

Fingerprint’s free demo shows a visitor identifier, IP geolocation, bot detection and VPN detection. The Smart Signals engineering teams want sit behind paid access, starting at Pro Plus for $99/month. If you need a returning-visitor ID inside an application, this is the category that solves it; CreepJS and the scanners do not.

How to Read a Report Without Chasing Ghosts

Scanners disagree, and reviewers report false positives on most of them. A single flagged category is weak evidence until a second tool confirms it. Run the same scan twice, ten minutes apart, and diff the output: signals that changed between runs are unstable, and unstable signals are the usual explanation when a profile behaves differently on one site than another.

Then compare fingerprint against network. A profile can be internally consistent and still mismatch its IP: a browser reporting Europe/Berlin behind a proxy exiting in Ashburn is a contradiction no canvas setting fixes. Scanners that combine fingerprint, IP and proxy checks catch it in one pass; CreepJS, being a browser audit, only sees timezone and screen clues.

Open-Source Libraries Solve a Different Problem

If you found CreepJS while looking for a library to embed, it was never that. The embeddable options are separate projects, and each returns a per-browser hash rather than a consistency report.

• ThumbmarkJS — MIT licensed and actively maintained, but it returns a per-browser hash and does not separate hardware signals from engine signals.
• ClientJS — Apache-2.0, last public release in 2021, and missing newer categories such as WebGPU.
• FingerprintJS (open source) — a per-browser hash; cross-browser identity and tamper detection exist only in the separate paid platform.
• ImprintJS — MIT licensed and early stage: fine for experiments, thin for anything load-bearing.

A hash answers “same browser as before”. It does not answer “is this browser internally consistent”. For the second question you need an audit, which is why headless browser fingerprint checks keep landing back on CreepJS-style tooling.

Pricing: What Each Option Actually Costs

Only a few options publish a price you can plan around. For the browser-based scanners, confirm current terms before you build a workflow on top of one.

One option here prices per request: Fingerprint, at $4 per extra 1,000 calls above the plan allowance. CreepJS is free and MIT licensed, CreepJS 2.0 has a free tier, and the tab-based scanners are a page you open. Anything that returns identifiers to your own application moves you into the first category.

Send.win sits at a different layer and is priced differently: Pro is $19/mo or $83.88/yr ($6.99/mo) for 150 saved profiles and 5 GB of proxy bandwidth a month, Team is $49/mo or $251.88/yr ($20.99/mo) for 500 profiles and 20 GB, with $6/GB and $0.05/profile add-ons and a 7-day money-back guarantee on the first card purchase. It is a browser profile manager, not a scanner: it gives each profile its own consistent fingerprint settings, cookies and proxy, and you test the result with the tools above.

Which Should You Pick?

You want to reproduce a CreepJS audit

Use CreepJS from the GitHub Pages deployment. No scanner in this list reproduces its engine-level contradiction checks, and its README says other domains are mirrors. Read the report as a consistency check, then dig into whichever category is flagged.

You want a two-minute sanity check

Open Pixelscan or IPFighter. Both give a readable verdict fast, and IPFighter needs no signup. If DNS leaks and IP reputation matter too, Iphey puts them on the same page.

You need one API in detail

BrowserLeaks, page by page. Start with WebGL, canvas and WebRTC, then move to fonts and timezone if the mismatch is about locale rather than graphics.

You need a visitor ID in production

Fingerprint, or CreepJS 2.0 if you want a smaller collector payload and a free tier to prototype with. Neither replaces the audit, and the audit does not replace either. They sit at different layers.

You are checking accounts you manage for clients

Then the scan is half the job. Each profile needs its own consistent settings, its own cookies and storage, and a proxy whose exit IP matches the timezone and locale the profile reports. How sites flag a proxy IP covers what the network half of that comparison looks like.

When the Real Question Is Many Profiles, Not One

Everything above measures a single browser. Many people reach fingerprint testing because they run several accounts they are authorised to manage — client storefronts, brand social profiles, QA and support logins — and each one has to open in a stable, isolated environment.

That is the layer Send.win works at. Sendwin Browser is a Chromium-based desktop app for Windows 10/11 (64-bit), macOS 12+ and Linux, and each profile carries its own cookies, storage, sessions, fingerprint settings and proxy. Fingerprint handling runs inside the engine, so a profile keeps its own consistent browser fingerprint across sessions — the same principle as Firefox or Brave’s fingerprinting protection, applied per profile instead of per machine. Residential proxies are included on Pro and Team, bring-your-own HTTP/SOCKS5 works too, and timezone, locale, WebRTC and geolocation follow the proxy’s exit IP rather than your laptop’s. Cloud profiles run on Send.win’s server in Helsinki and open from any device with nothing to install, and sharing a profile with a paid teammate opens it already signed in.

What Send.win does not do is score browsers. Verification stays a manual step with the tools above: run the scan, read the contradictions, adjust the profile settings, then run it again. Keep the policy question separate from the technical one as well — how Google treats browser fingerprinting under its own ad policies is a different matter from whether a profile is internally consistent, and every account you open still has to follow that platform’s terms.

Frequently Asked Questions

What is the best CreepJS alternative?

It depends on the job. For the same trust-report audit, use the official CreepJS build on GitHub Pages. For a fast readable verdict, Pixelscan, Iphey or IPFighter. For per-API detail, BrowserLeaks. For a production visitor ID, Fingerprint’s paid platform.

Is creepjs.org the same as the GitHub CreepJS?

No. It is a separate commercial SaaS with its own API, SDK and collector set. The original project states that its only official deployment is GitHub Pages and that its trademark policy strictly prohibits that domain.

What does CreepJS actually measure?

Engine and runtime behaviour, CSS and computed styles, emoji and SVG rendering, TextMetrics, WebGL and GPU parameters, fonts, speech voices, screen metrics and timezone clues. It cross-checks them against each other and reports contradictions instead of producing one ID.

Can I use CreepJS for production fingerprinting?

Not the original. The repository describes the project as research and education rather than a fingerprinting library, and the trademark policy bars commercial products and public websites. For an API, you need the separate CreepJS 2.0 service or Fingerprint.

How do I read a CreepJS trust score?

As a consistency check, not a safety grade. A high score means the reported browser details and the engine behaviour agree with each other; a low score points to contradictions you can inspect one by one in the per-API output.

Is a low uniqueness score safer?

A low uniqueness score means your configuration resembles many others, so less information distinguishes it between sites. That is a privacy measure, not a forecast of how a platform will treat your session, and no public source provides detection or ban-rate data.

Does a VPN change my browser fingerprint?

Rarely in the way people expect. A VPN changes the IP address a site sees, but canvas, WebGL, fonts, screen metrics and user agent stay the same. Scanners that compare IP location against timezone and locale flag the mismatch instead.

Which fingerprint scanner is most accurate?

Accuracy has two parts, uniqueness and stability, and most tools report them as one number. A scanner is accurate for your purpose when the signals it weighs are the ones your workflow depends on: per-API detail for debugging profiles, a stable ID for recognising returning visitors.

Related Products & Resources

• Download
• Demo Browser
• Pricing
• Fingerprint Checker
• Canvas Fingerprint Test