Screen Resolution and Timezone in Browser Fingerprints: Real Users vs Bots

Real user browser fingerprints show screen resolution and timezone values that fit the device and location. Bots often use default values like 1024x768 for resolution and UTC for timezone, or produce mismatches that real sessions rarely create. A single mismatch is not proof of a bot, but it is a strong signal when paired with other checks.

Attribute	Real User	Bot	Takeaway
Screen resolution	Common, plausible values like 1920x1080 or 1366x768 that match the actual display and browser window.	Often 1024x768 or another fixed default, disconnected from window size or device type.	A mismatch between resolution and window size is a red flag.
Timezone	Reflects the user's locale and IP geolocation; varies by location and travel.	Often UTC or a fixed offset regardless of IP address or language.	Inconsistency with IP or language is suspicious.
Consistency with other signals	Fits with hardware, GPU, fonts, and OS details that naturally belong together.	Often disconnected from spoofed data; e.g., a Mac GPU with a Windows fingerprint.	Cross-checking multiple attributes catches most spoofs.
Variability	Changes with device, screen, and location; sessions show natural variation.	Identical values across many visits from the same bot farm.	Uniform values across sessions indicate automation.
Detection risk	Rarely flagged unless using VPNs or privacy tools that alter values.	Easily flagged when combined with behavior and network checks.	Single signals are weak; combined checks are strong.

Choose to trust a fingerprint when the resolution and timezone match the user's device and location. Be suspicious when they contradict other signals or appear in rigid patterns.

Why screen resolution and timezone matter in fingerprinting

Screen resolution and timezone are two of many data points that make up a browser fingerprint. Websites and anti-fraud systems use them to recognize returning visitors, detect fraud, and separate humans from automated scripts.

Real users have plausible combinations. A person in New York likely sees a resolution matching their monitor and a timezone of UTC-5 or UTC-4. A bot pretending to be that user might report UTC and a resolution of 1024x768 because those are the defaults in a headless browser. This mismatch is a clue.

Detection services like BotRefund use these signals as one of many checks. As the source pack states: “A normal browser reports hardware, graphics, fonts, and operating-system details that naturally fit together for that device.” A real fingerprint is internally consistent. A bot fingerprint often is not.

How real users present screen resolution and timezone

Real users use real hardware. The screen resolution reported by the browser comes from the actual monitor or device. It matches the width and height of the browser window, the device category (phone, tablet, desktop), and the operating system's expected defaults.

Timezone comes from the device's clock and location. It tracks daylight saving changes, travel, and user preferences. A real user's timezone aligns with their IP geolocation, language, and locale settings. For example, a user in Berlin sees UTC+1 or UTC+2, and the website might display German content.

Real sessions also vary. A user might move from home to a hotel, changing timezone. They might plug in an external monitor, changing resolution. These changes are natural and occur over time. A fingerprint that never changes across hundreds of sessions is abnormal.

How bots and spoofed browsers present these values

Bots often run in headless browsers like Puppeteer, Playwright, or Selenium. These tools have default viewport sizes and timezone settings that are easy to spot. Common defaults include a screen resolution of 1024x768, a timezone of UTC, and no variation between launches.

Sophisticated bots try to spoof these values. They might fake a resolution of 1920x1080 and a timezone of Asia/Tokyo, but they often miss the connections. For example, the browser's language might still be English, the IP might be US-based, and the GPU might be a low-end model inconsistent with a high-end monitor.

BotRefund's detection checks look for these mismatches. The CPU Concurrency Lie check, for instance, looks for a mismatch where a spoofed profile claims one device while graphics, fonts, audio, or processor behavior tells another story. Screen resolution and timezone are part of this story. A bot that says UTC while the IP is in New York is telling a conflicting story.

How to detect mismatches (step-by-step)

If you want to check a fingerprint manually, follow these steps. They assume you have access to the browser's JavaScript environment or a fingerprinting tool.

1. Read the raw values. Check screen.width, screen.height, screen.availWidth, and screen.availHeight. Also get Date.getTimezoneOffset() and the user's locale via navigator.language.
2. Compare with the window size. A real user's browser window is usually close to the screen resolution, but not always. If the window is larger than the screen, that's impossible. Bots often set the window to the same size as the viewport but forget to match the actual screen.
3. Check timezone against IP. Use a geolocation service to map the IP to a timezone. If the browser's timezone offset doesn't match, that's a red flag. Real users rarely see a mismatch unless they use a VPN.
4. Look for consistency with other signals. Timezone and resolution should align with the device's platform, GPU, fonts, and user agent. A Windows machine with a Serif font list and a Mac-only GPU is suspicious.
5. Test for variability. Run the same browser session again. Bots produce identical values every run. Real users see small variations (e.g., window resizing, timezone changes during travel).

This manual process is time-consuming. Tools like BotRefund automate it by running 106 independent checks and cross-referencing the results. The source pack notes that BotRefund treats each signal as evidence, not a verdict, and cross-checks it against browser, network, device, and behavior data.

Limitations and exceptions

A single mismatch in screen resolution or timezone is not proof of a bot. Real users can create mismatches legitimately:

• VPNs change the IP but not the timezone, causing a mismatch.
• Travel can delay timezone updates on a device.
• Privacy tools like browser extensions may spoof resolution or timezone to protect anonymity.
• Corporate networks sometimes route traffic through remote servers, altering IP geolocation.
• Unusual displays (e.g., projectors, virtual desktops) can produce odd resolution values.

Because of this, BotRefund explicitly says: “A single anomaly is not a bot verdict.” It keeps the signal as evidence and cross-checks it against independent browser, network, device, and behavior data. This approach reduces false positives.

Key facts from BotRefund's detection approach

Fact	Detail
Number of checks	BotRefund uses 106 independent checks to build a reliable picture.
Real browser behavior	A normal browser reports hardware, graphics, fonts, and OS details that fit together.
Mismatch detection	Checks like CPU Concurrency Lie look for mismatches real browsing doesn't create.
Behavioral variation	Real visitors produce pauses, hesitation, and natural movement.
Accuracy	BotRefund reports 99% accuracy based on corroboration across signals.

FAQ

Why do bots often use 1024x768 for screen resolution?

That's the default viewport size in many headless browsers and automation frameworks. It's also a common fallback when no real display is attached.

Can a real user have UTC as their timezone?

Yes, if they live in a region that uses UTC (like Iceland) or if they set their device to UTC manually. But if the IP is in a different timezone, it becomes suspicious.

How do VPNs affect these fingerprint signals?

VPNs change the IP address but not the device's timezone. That creates a mismatch that might flag a real user as a bot unless the detection system accounts for VPN usage.

Is screen resolution alone enough to identify a bot?

No. Bots can spoof any resolution. It's the combination of resolution, timezone, and other attributes that matters.

What other fingerprint attributes are worth checking?

GPU, fonts, audio context, WebGL renderer, and behavioral signals like mouse movement and typing speed. These are harder to fake consistently.

Can I see my own fingerprint?

Yes, many websites and browser extensions show you your fingerprint data. You can also use developer tools to inspect screen and timezone values.

How does BotRefund use these signals?

BotRefund runs each signal through a prediction AI that weighs the complete picture. It doesn't rely on a single check, which reduces false positives.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• Browser Fingerprinting Guide: Detection & Bypass Methods | Browserless
• How Browser Fingerprinting Works: a Full Breakdown of Parameters ...
• Browser Fingerprinting Techniques: 6 Top Methods Explained

How BotRefund can help

BotRefund uses 106 independent checks to evaluate screen resolution, timezone, and dozens of other signals. Each check is treated as evidence, not a verdict. The system cross-references these data points with browser, network, device, and behavior signals to distinguish real users from bots.

This approach reduces false positives. A VPN or travel can make a real user look like a bot, but BotRefund accounts for that by looking at the whole pattern. You can start with a free audit to see how your site's traffic is being fingerprinted.