Request Headers & Fingerprint Inspector

User-Agent, Accept-Language, Accept-Encoding, Sec-CH-UA client hints, timezone from Date/Intl, and canvas/audio/WebGL fingerprints all pass through the SOCKS tunnel untouched. SOCKS5 only rewrites the network layer — every HTTP header and browser API remains fully visible to the target.

Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Mobile and Sec-CH-UA-Full-Version-List are the modern replacement for the User-Agent string. Anti-bot vendors cross-check them against the UA — a mismatch (Chrome 130 UA + Chrome 120 client hints) flags the session as a spoofed bot.

Set Accept-Language to a top locale of the exit country (fr-FR for France, ja-JP for Japan, de-DE for Germany), override the timezone via a browser extension or antidetect profile, and use a User-Agent that matches the exit country's most common OS+browser combination. Reload this tool to verify each change.

No. Every field is read from navigator, screen, Intl and WebGL APIs directly in your browser. Nothing is transmitted to Best SOCKS5. Open your browser's DevTools > Network tab to confirm zero outbound requests.

Chrome is gradually reducing the entropy of the classic User-Agent string and moving detail into Sec-CH-UA client hints. In 2026, sites that check both must find them consistent. Use this inspector to verify your antidetect profile is synchronized across both.

Yes — indirectly. Load your antidetect profile, reload this tool, and compare declared UA, resolved Sec-CH-UA, platform, timezone and language. Any mismatch is a red flag that will fingerprint the same way to a real anti-bot vendor.

WebGL exposes the GPU driver's vendor string ('Google Inc.') and renderer string ('ANGLE (NVIDIA GeForce RTX 3080 …)'). These strings are extremely unique — often narrowing to 1-in-100,000. Modern antidetect browsers spoof both consistently per profile.

Load this inspector through your SOCKS5 proxy. Compare the Accept-Language row to the country your proxy exit is in. US exit + Accept-Language: fr-FR is an instant flag on Cloudflare and DataDome. Align them via browser flags, extensions, or antidetect profile.

JA3/JA4 fingerprint the TLS ClientHello — cipher suites, extensions and elliptic curves — which cURL, Python requests and Node all send differently from real Chrome. Anti-bot vendors combine JA3 with header order and Sec-CH-UA to classify sessions. Matching only headers without matching TLS still fails against DataDome, PerimeterX and Kasada.

Chrome on a US locale sends `en-US,en;q=0.9`. Firefox sends `en-US,en;q=0.5`. Getting the q-value ordering wrong is a strong bot tell. Load this inspector from your target browser to copy the exact string it emits, then paste that into your scraper's headers dict verbatim.

For sites that request it via Accept-CH, yes — omitting a requested high-entropy client hint is itself a fingerprint. This inspector shows which client hints your browser sent unprompted (low-entropy) and which it would send on request (high-entropy). Match all of them or block the request entirely.

Load this inspector inside your headless browser. If the User-Agent row contains `HeadlessChrome/…`, override it via launch args (`--user-agent=`) or a patched build like puppeteer-extra with the stealth plugin. Verify the override in this tool before running any real scraping job.

navigator.language and navigator.languages should reflect the exit country's primary locale. Intl.DateTimeFormat().resolvedOptions().timeZone should match the exit region (e.g. Europe/Paris for a French exit). This tool surfaces both — mismatches are the fastest single signal Cloudflare and DataDome use to classify sessions.

Yes — the inspector renders a test canvas and reads its data-URL hash, then samples AudioContext output. Consistent hashes across incognito sessions on the same machine mean your antidetect browser isn't randomizing them. Compare the hash between profiles to confirm each has a unique canvas/audio fingerprint.