Skip to content
Anti-Bot

What Are Locale and Glyph Tells? Flag Emoji, Historical Timezones and Intl Strings

Pim

Pim · Scrappey Research

October 28, 2026 4 min read

What Are Locale and Glyph Tells? Flag Emoji, Historical Timezones and Intl Strings — conceptual illustration
On this page

Locale and glyph tells are small probes that read values from the layers under the browser, such as the emoji font, the timezone database, the ICU locale data and the keyboard driver, and compare them with what the session claims. Each produces only a few bits and is cheap to run, and each is rarely covered by tools that change the User-Agent or timezone from JavaScript. A flag emoji separates Windows from other systems, historical timezone offsets show whether a real timezone database stands behind the claimed zone, and Intl output has to fit the claimed languages.

Quick facts

Flag emojiWindows draws two letters; macOS, iOS, Android and Linux with a colour emoji font draw a flag
Historical offsetsParse "YYYY-12-01" (UTC) and "12/1/YYYY" (local) for years like 1937 and 1945
Intl stringsCompact numbers, list formats and display names follow the language and ICU version
Keyboardnavigator.keyboard.getLayoutMap() on desktop Chromium
FontsA 52-name list chosen to separate Windows, Apple, Linux and Office installs

The flag emoji

A country flag is two regional indicator symbols that a font may draw as one flag. Apple's emoji font does, Google's Noto Color Emoji does, and so does every Android device. The Windows emoji font does not: it draws the letters U and S side by side. A probe draws the US flag to a small canvas and reads the pixels; the colours present tell flag from letters without any reference image.

A session that claims Windows and draws a flag is running on something else, usually a Linux host with a colour emoji font installed. One that claims macOS and draws letters has the reverse problem. It is the same class of tell as font fingerprinting: text is rendered by the host, whatever the User-Agent says.

Five dates and the timezone database

JavaScript parses a date-only ISO string such as 1937-12-01 as UTC and 12/1/1937 as local time. Subtract the two and you get the local zone's offset from UTC on that day. One deployed widget does this for the years 999, 1060, 1937, 1945 and 1989 and reads the zone name from Intl.DateTimeFormat().resolvedOptions().timeZone.

Today's offset is easy to fake by overriding getTimezoneOffset and the Intl zone name. Historical offsets are not: before standard time most places used local mean time, with offsets in minutes and seconds set by longitude, and wartime years carry offsets that applied for a few months. Only a real timezone database knows them. If the zone name says Europe/Amsterdam and the 1937 offset is not Amsterdam's, the zone was set in JavaScript, not in the engine. This is the deeper version of a timezone and IP mismatch.

Intl strings, the keyboard and fonts

Intl output comes from locale data shipped with the engine. Format a few unusual things and the result depends on the language:

ProbeEnglish, UTCDutch, Amsterdam
Compact number 2.1e1621,000 trillion21.000 biljoen
List with "or"a, b, or ca, b of c
Display name eo-UAEsperanto (Ukraine)Esperanto (Oekraïne)

These have to agree with navigator.languages, with the Accept-Language header and with the timezone, and because locale data changes between releases they also have to fit the claimed browser version. Desktop Chromium adds navigator.keyboard.getLayoutMap(); the layout does not have to match the language, but it has to be plausible for it.

Font probes work the same way. One widget tests 52 names chosen to separate platforms, such as Segoe Fluent Icons for Windows, Apple Symbols for Apple, Cantarell and Ubuntu for Linux desktops and Carlito for Office or ChromeOS. One name proves little (an iPhone reports Carlito), but Segoe Fluent Icons next to Cantarell occurs on no real machine. The coherent answer is to run on a host whose OS, fonts, timezone and language really match the exit IP, which is how a managed web data API keeps these values consistent.

Code example

javascript
// Run the small probes in your own browser console.

// 1. Historical timezone offsets (minutes east of UTC) for the current zone
const offset = y => (Date.parse(`${y}-12-01`) - Date.parse(`12/1/${y}`)) / 60000;
console.log(Intl.DateTimeFormat().resolvedOptions().timeZone,
  [1937, 1945, 1989].map(y => [y, offset(y)]));

// 2. Intl output that depends on language and ICU data
console.log(
  new Intl.NumberFormat(undefined, { notation: 'compact', compactDisplay: 'long' }).format(2.1e16),
  new Intl.ListFormat(undefined, { type: 'disjunction' }).format(['a', 'b', 'c']),
  new Intl.DisplayNames(undefined, { type: 'language' }).of('eo-UA'),
  navigator.languages);

// 3. Flag emoji: does the font draw a flag (colour) or two letters?
const c = new OffscreenCanvas(32, 32), x = c.getContext('2d');
x.font = '24px sans-serif'; x.fillText('\u{1F1FA}\u{1F1F8}', 0, 26);
const px = x.getImageData(0, 0, 32, 32).data;
let coloured = 0;
for (let i = 0; i < px.length; i += 4) if (Math.abs(px[i] - px[i + 2]) > 40) coloured++;
console.log(coloured > 20 ? 'flag glyph' : 'two letters (Windows-style)');

Related terms

What Is a Timezone / IP Mismatch?
A timezone/IP mismatch is when the location a browser claims and the location of its IP address disagree. Anti-bot systems (the software sit…
What Is Font Fingerprinting?
Font fingerprinting identifies a device by working out which fonts are installed on it and measuring how that device draws text. The idea is…
What Is Clock Coherence Detection?
Clock coherence detection compares the several independent time sources a browser exposes and checks that they describe the same reality. A …
What Is Cross-API Coherence Checking?
Cross-API coherence checking is a detection method that asks the browser the same question through two or more independent APIs and compares…
What Is Canvas Fingerprinting?
Canvas fingerprinting is a way for a website to identify your device by asking the browser to draw a tiny invisible image, then turning the …
What Does a Bot-Check Widget Collect?
A bot-check widget is the small frame a site embeds to decide whether a visitor gets an automatic pass, a checkbox or a harder challenge, an…
Concept map

Concept map

How What Are Locale and Glyph Tells connects

The terms most directly tied to this one. Hover a node to see its neighbours, click to preview, drag to rearrange.

0 terms · 0 connections
You are here · Anti-Bot
Building map…

Tools & solutions for this topic

Frequently asked questions

Why does a flag emoji look like two letters on Windows?

A flag is two regional indicator symbols, and the Windows emoji font does not combine them into a flag glyph, so they are drawn as letters such as U and S. Apple, Android and Noto Color Emoji fonts draw a flag, which makes one canvas readback a reliable Windows-or-not check.

Is changing the timezone in JavaScript enough to match a proxy?

No. Overriding getTimezoneOffset and the Intl zone name changes today's offset, but historical dates still use the real timezone database, and Intl strings still follow the real locale data. Setting the timezone at the operating-system or engine level keeps all of them consistent.

Does the keyboard layout have to match the browser language?

Not exactly. Many people outside the US use a US layout. It has to be plausible for the language and platform, and some keys such as IntlBackslash differ between layouts and operating systems.

Last updated: 2026-10-28 · Facts last verified: 2026-10-28