How We Test
WHOX analyzes 300+ signals across 9 categories to determine your real anonymity level. Fast Check completes in under 100ms. Deep Scan — 5-7 seconds.
Signals
Fast Check
Deep Scan
Categories
Performance
Analysis Speed
Fast Check
Instant analysis of 230 signals: IP, GeoIP, TLS fingerprint, device parameters, basic fingerprints. Results appear before the page finishes loading.
Deep Scan
Active probing of 80 additional signals: DNS leak test, WebRTC candidates, behavioral analysis, automation detection. Full system screening in 5-7 seconds.
Total Coverage
Combined signal count across fast check, deep scan, cross-signal consistency, and foresight analysis. The most comprehensive privacy analysis available.
Scoring
Trust Score
Trust Score is your final anonymity rating from 0 to 100. Calculated from 300+ signals across three axes: Anonymizer (A), Fingerprint (F), Consistency (C). Fast Check analyzes 230 signals in <100ms. Deep Scan adds 80 active probes in 5-7 seconds.
Exclusive
What Nobody Else Checks
Exclusive detection capabilities that exist only in WHOX
CSS Computed Style Fingerprint
We hash 500+ CSS computed properties to create a unique browser fingerprint that works even when Canvas and WebGL are blocked or spoofed.
Hardware DNA
WebGPU shader hashing, GPU timing fingerprints, WASM execution timing, GC patterns. These signatures are burned into hardware — antidetect browsers cannot spoof them.
Behavioral Entropy Analysis
Mouse curvature, jitter patterns, scroll momentum, click timing — 38 behavioral signals that distinguish humans from bots with mathematical precision.
Cross-Signal Consistency
19 cross-domain validation checks. Canvas vs GPU, Audio vs Platform, Timing vs Automation. Even advanced antidetect browsers fail consistency across signal domains.
Prototype Integrity Checks
We validate that browser APIs haven't been monkey-patched. Automation frameworks modify prototypes — we detect the modifications.
WHOX Foresight
Predictive risk analysis: Traceability score, Authenticity score, Digital Shadow, Hardware DNA profiling. Not just detection — prediction of tracking risk.
Foresight
WHOX Foresight
WHOX Foresight goes beyond simple pass/fail checks. It predicts your traceability risk and authenticity score using advanced signal correlation.
Traceability Score
How easily can websites track you across sessions? We analyze fingerprint uniqueness, cookie persistence vectors, and cross-site linkability.
Authenticity Score
Are you a real human on a real device? We correlate behavioral signals, hardware signatures, and timing patterns to determine authenticity.
Digital Shadow
What data trail does your browser leave? Privacy failures, hardware DNA signatures, and geo-verification analysis combined into one threat model.
Verification
WHOX Sigil
WHOX Sigil performs 5 cross-layer checks comparing what your network reveals against what your browser claims. Each signal is verified at the protocol level — TCP, TLS, tunnel, latency, geolocation. Antidetect browsers spoof JavaScript APIs, but they can't change TCP stack behavior or the speed of light.
TCP Stack Identity
Compares the TCP/IP stack fingerprint (window size, TTL, TCP options) against the claimed OS in User-Agent. Every operating system has a unique kernel-level TCP profile — it's impossible to spoof from within a browser.
Engine DNA
Cross-verifies TLS fingerprint (JA4), HTTP/2 pseudo-header order, H2 SETTINGS values, and CSS capabilities. If TLS says 'Chrome' but CSS says 'Firefox', the forgery is exposed.
Tunnel Forensics
Analyzes MTU, encapsulation protocol, and network anomalies to detect VPN/proxy tunnels. MTU below 1500 indicates an extra encapsulation layer — WireGuard, OpenVPN, or SSH tunnel.
CalcuLatency
Compares real TCP RTT latency (kernel-level) with JavaScript latency (application-level). A large discrepancy indicates a proxy chain or MITM interception between your browser and our server.
Speed-of-Light Geo
Physical verification: RTT to the nearest edge server is compared with GeoIP-based distance. If the claimed location is Tokyo but latency matches New York — you can't fool the speed of light.
Check Categories
Check Categories
Anonymizer Detection
IP analysis against VPN providers, Tor network, public proxies and data centers. JA4/JA4H TLS fingerprinting, edge beacon RTT analysis, ECN support detection.
- VPN/Proxy detection via 7+ IP databases
- Tor exit node matching (real-time)
- Datacenter IP identification
- Residential proxy detection
- JA4/JA4H TLS fingerprint analysis
- Edge beacon RTT triangulation
- ECN support profiling
Fingerprint Analysis
80+ fingerprinting parameters: Canvas, WebGL, WebGPU, Audio, fonts, CSS computed styles, MathML, SVG filters, Intl.Segmenter, Worker timing, WASM timing, GC patterns.
- Canvas fingerprint (2D + WebGL)
- WebGPU shader hashing
- Audio context fingerprint
- CSS computed style fingerprint
- MathML layout fingerprint
- SVG filter fingerprint
- Intl.Segmenter fingerprint
- Worker startup timing
- WASM execution timing
- GC timing patterns
Consistency Checks
Cross-signal validation across 19+ dimensions. Anti-detect browsers spoof data, but mismatches between GPU ↔ Canvas, Audio ↔ Platform, Timezone ↔ GeoIP reveal the deception.
- User-Agent ↔ Client Hints
- Timezone ↔ GeoIP location
- Canvas ↔ GPU vendor consistency
- Audio ↔ Platform consistency
- Language ↔ IP country
- Mobile flags ↔ sensor presence
- Timing ↔ automation signals
Leak Detection
Active scanning of all leak channels. WebRTC candidates, DNS resolver analysis, IPv6 exposure, mDNS leaks, QUIC protocol testing.
- WebRTC local/remote candidates
- DNS resolver country mismatch
- IPv6 exposure detection
- DoH/DoT leak analysis
- mDNS leak detection
- QUIC protocol leak
Behavioral Analysis
Real-time analysis of 38+ behavioral signals. Mouse curvature, jitter entropy, scroll momentum, click timing distributions, focus/blur patterns. Bots can't fake human entropy.
- Mouse movement curvature analysis
- Jitter entropy measurement
- Scroll momentum patterns
- Click timing distribution
- Focus/blur pattern analysis
- RAF interval timing
- Scheduling drift detection
- Paint timing entropy
Automation Detection
48+ checks against Selenium, Puppeteer, Playwright, headless Chrome, undetected-chromedriver. Prototype integrity, global pollution, proxy traps, CDP markers.
- navigator.webdriver flag
- CDP (Chrome DevTools Protocol)
- Prototype integrity validation
- Global scope pollution scan
- Proxy trap detection
- Permission API anomalies
- Web Share API presence
- ContentIndex API check
Timeline
Detection Evolution
The arms race between detection systems and bypass tools continues. Every year new techniques appear — and we add new checks.
Depth
Detection Depth
From network layer to hardware signatures — WHOX analyzes every layer, including CSS fingerprinting without a single line of JavaScript.
Network
Where you connect from
Browser APIs
What your browser reveals via JavaScript
CSS-Only
Pure CSS fingerprinting — zero JavaScript
Hardware
Signatures burned into silicon
Behavioral
How you actually use the device
Cross-Signal AI
Correlation engine across all layers
Privacy
What We DON'T Do
We don't require registration. No accounts, no emails.
We don't sell data to anyone. WHOX is a verification tool, not a collection one.
We don't track you between sessions. Each visit is a clean slate.
IP addresses are stored hashed and automatically deleted after 30 days.
Collected data is used only to improve detection algorithms.
We don't train machine learning models on your data.
Methodology Transparency
We show what we check, but not exactly how. This lets you understand your weak points without giving anti-detect tool developers a way to bypass our checks.