How CreepJS works
CreepJS collects a wide set of signals and then evaluates them on two axes. The first is uniqueness - how rare each value is, and how rare the combination is relative to the other visitors the page has seen, reported as a percentage where a lower number means the browser blends in with the crowd. The second, and the part it is known for, is consistency. It inspects JavaScript object prototypes to detect tampering - when a property or function has been overridden so its reported value no longer matches the behaviour of a genuine native implementation. In CreepJS terminology these contradictions are called "lies," but a lie is a technical inconsistency (the environment does not match the model of an unmodified browser), not an accusation about a person. A user-agent claiming one operating system while the GPU string, fonts and timezone point at another is the classic example.
What CreepJS reports
The report combines several outputs: an overall trust grade (shown as a letter grade with an associated percentage) that reflects how coherent the whole profile looks; a list of the specific "lies" it detected; a bot / headless rating that flags signals consistent with automated or headless browsers; and one or more fingerprint hashes (CreepJS computes both a strict identifier and a looser, more stable one to study how persistent a profile is across reloads). The exact mapping from percentage to letter grade, and the uniqueness baseline, are computed live and shift between CreepJS versions as its sample population grows - so the specific numbers a run shows are best read as relative indicators, not fixed constants.
Why CreepJS matters for web scraping
CreepJS is useful as a diagnostic. Because it surfaces contradictions rather than just collecting values, it is a fast way to check whether a browser environment tells one coherent story - the same question a lie-detection system on a protected site asks. A clean consumer browser typically scores a high trust grade with few or no lies; a headless or heavily patched environment tends to score lower and trip the headless flag. Passing CreepJS shows a profile is internally consistent, but it is not the same as the real-world verdict a live detector reaches, because that verdict also weighs server-side signals such as IP reputation and TLS fingerprint that a client-side page cannot see.