CarlCloak

About

CarlCloak protects your browser identity by spoofing multiple fingerprinting vectors — from behavioral biometrics to static canvas/WebGL hashes and HTTP headers.

🛡️ WHAT IT DOES

• Behavioral noise — adds Gaussian noise to mouse coordinates, keystroke timings, touch events, and scroll patterns so behavioral biometric systems cannot profile you
• Canvas & WebGL spoofing — injects subtle pixel noise into toDataURL() and getImageData() calls; masks GPU vendor/renderer strings
• Navigator & Screen spoofing — reports consistent fake platform, hardware concurrency, memory, and screen resolution
• Audio fingerprint protection — adds noise to AudioBuffer processing
• Font detection noise — randomizes measureText() output
• HTTP header spoofing — replaces Accept-Language with your chosen locale at the network level (visible to server-side detectors like whoer.im, 2ip.io)
• Timezone spoofing — overrides Intl.DateTimeFormat and getTimezoneOffset() plus HTTP headers simultaneously
• Timer rounding — rounds Performance.now() and Date.now() to reduce timing-based fingerprinting
• Gyroscope zeroing — reports zero values for DeviceOrientation/DeviceMotion events

🌍 QUICK PROFILES

Switch your entire identity (timezone + language + HTTP headers) in one click:
Polish · Kazakh · Japanese · Austrian · UK English · Russian · French · German · US English · Ukrainian · Czech · Spanish

⚙️ THREE PROTECTION MODES

Off — no spoofing, full passthrough
Spoof — adds realistic noise; pages work normally
Block — drops behavioral event listeners entirely

🔒 PRIVACY FIRST

• No data collection — zero telemetry, no analytics, no remote servers
• All processing is local — your config stays in browser storage
• Open architecture — content scripts run in MAIN world for reliable interception
• Domain whitelist — exclude trusted sites (YouTube, Google accounts, Figma pre-added by default)
• Works in Vivaldi, Brave, Opera and any Chromium-based browser

💡 USE CASES

— Prevent cross-site behavioral tracking
— Test how websites see your browser identity
— Match your VPN's region with consistent language/timezone headers
— Reduce fingerprinting surface without breaking sites