Rarity fingerprinting vs coherence checking
Classical browser fingerprinting is an entropy problem: collect many values, hash them, and ask how many other visitors share that hash. The measure of interest is rarity, quantified in bits of fingerprint entropy. Coherence checking is a different question entirely. It does not care whether your configuration is rare. It cares whether your configuration is possible.
The distinction matters because the two produce opposite failure modes. A rarity check flags you for being unusual - which real users with unusual hardware also are, so it carries false positives and is usually scored probabilistically. A coherence check flags you for being self-contradictory, and a real browser is essentially never self-contradictory, because a single engine computes both answers from the same underlying state. That makes contradictions cheap to act on: a site can block on one hard contradiction with far more confidence than on a rare hash.
The practical consequence is that a value can be perfectly ordinary and still fail. A User-Agent string claiming a current desktop Chrome release is the most common string on the web. It fails instantly if the same request arrives without the matching Sec-CH-UA client hints, or if window.chrome is missing, or if the CSS engine does not support a Blink-only feature that shipped in the version being claimed.
The main coherence pairs
Most checks in this family fall into a handful of structural patterns. Each pair below is a question with two independent answer paths inside one browser:
| Pair | Question asked twice | Contradiction it exposes |
|---|---|---|
| Wire vs runtime | What browser is this? Read the User-Agent header, then navigator.userAgent | A header rewritten by a proxy or client library while the JS runtime still reports the original |
| JS vs CSS | How big is the screen? Read screen.width, then ask matchMedia | A patched screen object; the CSS layout engine is a separate code path and is rarely patched too |
| Window vs worker | What is the timezone / GPU / platform? Ask the page, then ask a Worker | Page-world patches that never reach other realms |
| API vs API | What GPU is this? Read the WebGL renderer, then the WebGPU adapter | One graphics API edited, the other left at its real or default value |
| Claim vs capability | You say you are Chrome 1xx - do you have what that build has? | A version claim not backed by the matching JS globals, codecs, or CSS features |
| Clock vs clock | What time is it? Compare Date.now() with the monotonic timer | A wall clock moved without the performance clock, or vice versa |
| Network vs locale | Where are you? Compare the exit IP against the browser timezone and languages | A timezone that no country on that IP observes |
None of these require novel measurement. They reuse surfaces the glossary already documents individually; the detection value comes entirely from reading two of them together.
Why a partial edit scores worse than no edit at all
This is the counterintuitive result that shapes the whole field. A default headless browser is identifiable - it has known tells, and a site can score it as automation. A browser with one surface edited and the rest untouched is incoherent, which is a stronger and more actionable signal, because incoherence has no innocent explanation. Rare hardware explains a rare hash. Nothing explains a screen.width of 1920 that CSS measures as 800.
That is the same conclusion the corpus reaches from every other direction: a believable identity is a coherent set of values harvested from one real machine, not a pile of individually plausible edits. It is why lie detection and fingerprint clustering have displaced per-field property overrides, and why engine-level tools that generate every surface from one internally consistent device profile behave differently from JavaScript patches applied after the page loads.
For teams collecting public web data at scale, the takeaway is that coherence is an infrastructure property, not a script you can add. A managed web data API keeps browser sessions, network egress, and locale settings aligned by construction, so the answers agree no matter which path a page uses to ask.