How the truth index is calculated

The truth index answers one question: does what your browser says about itself add up? It is not a measure of how private you are and not a verdict about you as a person. It starts at 100 and loses points for every contradiction our rules find. This page lists exactly how.

Check your browser right now

Checking your browser…

The formula

Index = 100 minus the penalties of all rules that fired. Each rule counts once, however many times it fires, and the index never goes below 0.

Contradiction: minus 30. Something that does not happen in an untouched browser, for example the user agent in JavaScript differs from the one in the HTTP header.
Suspicious: minus 12. Has innocent explanations (a VPN, travel, a laptop with two graphics cards), but is common in spoofed profiles.
Weak signal: minus 4. Worth noting, rarely meaningful alone, for example forwarding headers from a corporate proxy.
Privacy protection and information: 0. Brave, Firefox with resistFingerprinting and Tor Browser change some values on purpose; that is protection, not a lie, and costs nothing.

The report shows the penalty next to every finding and the whole calculation under the score, for example 100 minus 30 minus 12 = 58.

Verdicts

85 and above: your browser looks honest.
60 to 84: there are contradictions. Often a VPN or an extension; sometimes spoofing.
Below 60: looks like a spoofed browser. This is what antidetect browsers and bots look like.
Automation: a separate verdict whatever the score, when the browser is controlled by a program (navigator.webdriver, HeadlessChrome in the user agent).

Why the weights are what they are

A contradiction has to be strong evidence on its own: two of them already take an honest-looking 100 down to 40. That is why only checks that an unmodified browser cannot fail get 30. Anything a real person can trigger by accident gets 12, so a VPN user with a mismatched time zone lands in "contradictions", not in "spoofed". Protections get 0, because punishing people for protecting themselves would be both wrong and useless.

The rules

Grouped by what they compare. In brackets: the penalty.

Automation: navigator.webdriver is on (30); HeadlessChrome in the user agent (30); a zero-size browser window (12); window.chrome missing in Chrome (12); software rendering such as SwiftShader or llvmpipe (12).
Tampering: built-in functions replaced by a script (30); noise in canvas drawing (30, or 0 in Brave, Safari and other protected browsers); noise in audio (12, or 0 when protected).
One system, one story: user agent in JavaScript vs the HTTP header (30); values inside a Web Worker or an iframe differ from the page (30); navigator.platform vs the user agent (30); Client Hints version or platform vs the user agent (30); the Client Hints header vs JavaScript (30); the mobile flag vs the user agent (12); a graphics card that exists only on another system (30); fonts of another system (12); a mobile browser without touch (12); WebGPU and WebGL name different vendors (12); impossible hardware values (12); a window wider than the screen (12).
Time and language: the Date offset vs the Intl time zone (30); the time zone vs the IP country (12); Accept-Language vs the JavaScript language list (30); navigator.language vs the first language in the list (12).
Network: a Tor exit node without Tor Browser (12); a data center or VPN address (12); forwarding headers of a proxy (4); the local address visible through WebRTC (information, 0).
Seen by our own server: the TLS handshake comes from another browser than the user agent claims (30); the TLS handshake comes from no browser at all, which also happens behind an antivirus or a corporate proxy that inspects HTTPS (12); DNS requests go around the VPN (12); WebRTC shows another public IP than the page (12).
Privacy protection (0): Brave, Firefox with resistFingerprinting, Tor Browser.

Two examples

An honest person on a VPN: the time zone does not match the IP country (minus 12) and the address belongs to a data center (minus 12). 100 minus 12 minus 12 = 76, "there are contradictions". The browser itself is fine, the network is not what it seems.

An antidetect profile that claims macOS on a Windows computer: a Windows graphics card (minus 30), canvas noise (minus 30), Windows fonts (minus 12), a New York time zone with a European IP (minus 12). 100 minus 30 minus 30 minus 12 minus 12 = 16, "looks like a spoofed browser".

What the index cannot do

It measures consistency, not identity. A carefully built profile can hide most contradictions and still score well.
A few honest setups trigger rules: an antivirus that inspects HTTPS changes the TLS handshake, a laptop can switch graphics cards, travellers keep their home time zone. That is why those rules are "suspicious", not "contradiction".
The weights are not final. Each new check (TLS, DNS and WebRTC were added in October 2026) is weighed against the existing ones, and this page is updated with it.

The visibility score on My IP is a different thing

The My IP page shows how easy you are to recognize, not whether your browser lies. It adds up points for the traits sites can see, and the maximum points of all factors add up to 100: IP address 15 (8 for a shared VPN address), canvas 22 (5 when protected), graphics card 13 (5 for a generic name such as Apple GPU), screen 8 (5 for a common size), time zone 6 (1 for UTC), languages 6 (3 for a single language), CPU cores and memory 6, local IP through WebRTC 8, cookies 8, no tracker blocker 8.

70 and above is high, 45 to 69 medium, below 45 low. Do Not Track is not counted: it does not protect anything and only adds one more trait. Most ordinary browsers score high, and that is the honest answer; the breakdown under the score shows which factors to work on.

Frequently asked questions

Why do I get 76 when nothing is wrong with my browser?: Usually because of a VPN: the time zone does not match the IP country and the address belongs to a data center. Both are "suspicious" (minus 12 each), not contradictions.
Does a low index mean I am a bot?: No. It means the data your browser reports does not add up. Bots and antidetect browsers look like that, but so can an unusual setup. The automation verdict is separate and only appears when the browser is controlled by a program.
Why does Brave not lose points for canvas noise?: Because the noise is Brave's own fingerprint protection. We recognise privacy browsers and count their changes as protection, worth 0.
Will the weights change?: Yes, as new checks appear. Every change is reflected here and in the report.