# plugins

> The browser's plugin list: each plugin's name, file name and MIME types, sorted and hashed. Excluded under Brave.

Source: https://whiskerjs.com/signals/plugins/ (last updated 2026-10-26)

**plugins at a glance (from the library code, signalsVersion 9)**

| Field | Value |
| --- | --- |
| Component name | `plugins` |
| In the visitorId | yes |
| structuredId group | [browser (engine and build)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | always a digest, except the plain value none when nothing is found |
| Excluded under | Brave (brave_farbling) |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Browsers used to list add-ons such as Flash for web pages. Today the list is short and mostly describes the built-in PDF viewer, but it still differs between browsers, and automated browsers often show an empty or odd list. WhiskerJS records the list as a short hash, or the word `none` when it is empty.

## What it reads

`navigator.plugins`: for each plugin, its `name`, its `filename` and the `type` of each MIME type it handles.

## How the technique works

1. If `navigator.plugins` is missing or has no numeric `length`, the component is `unavailable`.
2. Each plugin becomes `name|filename|mime1,mime2,...` with its MIME types sorted.
3. The entries are sorted and joined with `;`. The result is always hashed (SHA-256, first 128 bits).
4. An empty list reports the plain value `none`, unhashed.

## Why it helps

Current Chromium, Firefox and WebKit builds expose different fixed lists (different names, file names and MIME types), embedded and older browsers expose others, and many headless setups expose none. That makes the value a cheap way to separate engine families and unusual setups.

## Stability

Stable for a given browser build. It changes when the browser changes its fixed list in an update or when a setting such as the PDF viewer is turned off.

## Browser support and what blocks it

- Available in all current browsers, including [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Firefox](https://whiskerjs.com/browsers/firefox/), [Safari](https://whiskerjs.com/browsers/safari-macos/) and [Edge](https://whiskerjs.com/browsers/edge/).
- [Brave](https://whiskerjs.com/browsers/brave/): `excluded` with ruleId `brave_farbling`, because Brave randomises the list. See [the exclusion table](https://whiskerjs.com/docs/how-it-works/#the-exclusion-table).
- Headless and embedded browsers often report `none`.

## Privacy

The list describes the browser build, not the person. In current browsers it no longer reveals installed third-party software the way old plugin lists did. It is reported only as a digest or `none`.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | a digest, or plain `none` for an empty list |
| `unavailable` | `no_api` | `navigator.plugins` missing or without a length |
| `unavailable` | `no_digest` | no `crypto.subtle` for a non-empty list |
| `blocked` | `threw`, `security_error` | reading the list throws |
| `excluded` | `brave_farbling` | browser class `brave` |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

The [`plugins_inconsistent`](https://whiskerjs.com/docs/integrity/#plugins_inconsistent) check looks at the same data from another angle: it fires when `navigator.plugins` or `navigator.mimeTypes` are not the native `PluginArray` and `MimeTypeArray`, when only one of them is empty, or when a MIME type’s `enabledPlugin` is not one of the listed plugins. `native_tampering` and `navigator_own_property` also watch `navigator.plugins`.

## Example value

In the container test, headless Chromium and Firefox reported `none`, while headless WebKit reported the digest `0a49ecbdc428ee2eb82dc9f7e83cd2ef`.

## Questions and answers

### Browsers no longer support plugins. Why read them?

Current browsers still expose a fixed list, mostly PDF viewer entries, and that list differs between engines and some embedded browsers. Headless browsers often report none, and fake lists can be detected.

### Why is plugins excluded in Brave?

Brave's farbling randomises the plugin list per site and session, so reading it would only add noise. The exclusion table reports it as excluded with ruleId brave_farbling.

### What does none mean?

The list was empty. none is reported as a plain word, not a digest, so you can see it directly.

## Related pages

- [plugins_inconsistent flag](https://whiskerjs.com/docs/integrity/#plugins_inconsistent): Fires when the plugin and MIME type lists do not fit together.
- [pdf_viewer](https://whiskerjs.com/signals/pdf-viewer/): The built-in PDF viewer setting.
- [Brave](https://whiskerjs.com/browsers/brave/): Why twelve components are excluded there.
- [Farbling](https://whiskerjs.com/glossary/#farbling): Brave's per-site randomisation.