Hardware Attributes Used in Browser Fingerprinting to Detect Bots

What hardware attributes do fingerprinting systems check?

Fingerprinting systems collect a set of hardware-related details from your browser. The common list includes:

• GPU (Graphics Processing Unit) — the graphics card model and its reported capabilities via WebGL.
• CPU — the processor model, core count, and hardware concurrency.
• Screen resolution and color depth — the size and color quality of your display.
• Timezone — your local time offset, often set by the operating system.
• Installed fonts — the list of fonts your system has.
• WebGL data — rendering information like the GPU vendor and renderer strings.
• Device memory — the amount of RAM the browser reports.
• Hardware concurrency — the number of logical processors available.
• Touch support and pointer precision — whether the device has a touchscreen and its exact pointing capability.

A real browser reports these details in a way that naturally fits together for that device. A bot browser often reveals a mismatch — a spoofed profile may claim one device while the graphics, fonts, or processor behavior tell a different story.

Why a single hardware attribute is never a bot verdict

A single anomaly is not proof of automation. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. For example, a remote desktop session might show a screen resolution that doesn't match the physical monitor, or a VPN changes the timezone.

Good detection systems keep each hardware attribute as evidence — not a verdict. They cross-check it against independent browser, network, device, and behavior data. The CPU Concurrency Lie check from BotRefund is one of 106 independent checks that build a reliable picture of whether a visit is human or automated.

The core hardware attributes, explained

GPU and WebGL

WebGL exposes the GPU vendor and renderer strings. A real device returns a consistent name like "NVIDIA GeForce RTX 3080" or "Apple M1". Bots often fail to spoof this properly, either leaving a generic string or returning a combination that doesn't exist. Software rendering, which bots sometimes use, produces a different string that real users rarely see.

CPU and hardware concurrency

JavaScript can read the number of logical processors via navigator.hardwareConcurrency. A normal desktop might show 8, 12, or 16. A bot running in a virtual machine often shows a very different number — or tries to lie about it. The CPU Concurrency Lie check looks for a mismatch between the claimed processor and what the rest of the system reports.

Screen resolution and color depth

Your monitor size and color depth are stable attributes. A bot that sets a fake screen size but still sends a default color depth can create a mismatch. Also, the ratio between screen and available window size can reveal anomalies.

Timezone

The timezone comes from the operating system. A bot using a residential proxy in one country but a timezone from another is a red flag — unless the user is traveling, which is why it's only one signal.

Fonts

The list of installed fonts is surprisingly unique. Real devices have a mix of system fonts, apps, and user-installed fonts. Bots that try to fake this often miss the subtle variations, especially on Windows vs. Mac.

Device memory

navigator.deviceMemory reports RAM in gigabytes. It's often imprecise on real devices but bots may set it to unrealistic values or fail to align it with the CPU and GPU.

Audio and battery

Some fingerprinters also check the audio processing output, which is hardware-specific. Battery status used to be a signal but is now restricted in many browsers.

How to judge which hardware attributes are reliable

Not all attributes have the same weight. When deciding which to use or trust, apply these criteria:

1. Consistency within a session. Does the attribute stay the same across page reloads? A real device shows stable values; bots often vary.
2. Difficulty to spoof. GPU strings are harder to fake than screen resolution because they depend on complex rendering APIs.
3. Correlation with other signals. Does the CPU core count match the GPU vendor? Does the timezone align with the IP location? Mismatches increase suspicion.
4. Impact on real users. Will virtual machines, remote desktops, or corporate proxies produce false positives? Prefer attributes that are less disruptive.

A clear decision rule: Do not flag a user based on one mismatched attribute. Instead, require at least two or three independent inconsistencies that point in the same direction.

Trade-offs: accuracy vs. false positives

The more hardware attributes you check, the better you can separate bots from humans — but the higher the risk of blocking a real user.

• Broad fingerprints catch more sophisticated bots but also catch privacy-conscious visitors who use ad blockers or anti-tracking extensions.
• Narrow fingerprints reduce false positives but let many bots through.
• WebGL and CPU checks are powerful because they are hard to spoof, but they can trigger on older graphics drivers or unusual hardware.

The solution is to combine hardware signals with behavioral and network data. BotRefund uses 106 independent checks and feeds them into a prediction AI that weighs the entire pattern. This is why its accuracy claims are based on corroboration, not a single tell.

How BotRefund uses hardware attributes

BotRefund's CPU Concurrency Lie check is one example. It looks for a mismatch that a real browsing session does not normally create. For instance, a visitor claims a high-end CPU but shows a low-end GPU with a generic renderer — that combination is rare on real devices.

This signal is not used alone. BotRefund tests whether other signals support the same story: browser, network, device, and behavior data. Only when the whole picture points the same way does the system classify the visit as a bot. This approach keeps false positives low while catching sophisticated automation.

The same principle applies to GPU fingerprinting. BotRefund integrates these checks into a client-side script that runs in about one minute and produces an audit-ready report.

Key facts about hardware fingerprinting for bot detection

Limitations and when hardware fingerprinting does not apply

Hardware attributes are not foolproof. Advanced bots can spoof many of them. Virtual machines and remote desktops can produce mismatches for legitimate users. Privacy tools like Tor or strict fingerprinting protection (e.g., Firefox's Resist Fingerprinting) can make hardware details inconsistent across sites.

Also, some attributes are only reliable in certain contexts. For example, audio fingerprinting is less useful on mobile devices where the audio stack is uniform. Battery and memory are being restricted or removed in modern browsers for privacy reasons.

If you are running a high-security verification (like banking), you need more than hardware fingerprints — you should add behavioral biometrics and device binding. For ad-click fraud detection, hardware signals are one piece of a larger puzzle.

Frequently asked questions

Can a user be falsely flagged because of hardware fingerprinting?

Yes. A person using a corporate VPN, a remote desktop, or an older browser could have mismatched hardware signals. Good systems cross-check multiple independent signals to minimize these false positives.

How do bots spoof hardware attributes?

Bots use automation frameworks like Puppeteer or Playwright, which can override JavaScript APIs. They also use anti-detect browsers that spoof GPU, CPU, and other properties. However, they often miss subtle correlations, like matching the GPU vendor to the operating system.

Which hardware attribute is hardest for bots to fake?

WebGL and GPU strings are among the hardest because they rely on actual rendering calls. A bot can override the string, but the rendered output may not match the claimed hardware. CPU concurrency is also tricky because virtual machines often report a different core count than the host CPU.

Is hardware fingerprinting legal?

In many regions, yes, but it falls under privacy laws like GDPR if it can identify a specific user. In practice, most fingerprinting is used for fraud detection and is anonymized. Always check your jurisdiction and disclose the practice in your privacy policy.

What should I do if I suspect bot clicks on my ads?

Start by auditing your logs for anomalies like superhuman input speed, lack of pointer movement, or inconsistent hardware signals. If you have proof, you can file a refund claim with Google or Meta. BotRefund provides a free audit to detect these patterns and generate a report.