| Component name | plugins |
|---|---|
| In the visitorId | yes |
| structuredId group | browser (engine and build) |
| Hashing | always a digest, except the plain value none when nothing is found |
| Excluded under | Brave (brave_farbling) |
| Inner timeout | 1000 ms |
| Added in | signalsVersion 1 |
Browsers used to list add-ons such as Flash for web pages. Today the list is short and mostly describes the built-in PDF viewer, but it still differs between browsers, and automated browsers often show an empty or odd list. WhiskerJS records the list as a short hash, or the word none when it is empty.
What it reads
navigator.plugins: for each plugin, its name, its filename and the type of each MIME type it handles.
How the technique works
- If
navigator.pluginsis missing or has no numericlength, the component isunavailable. - Each plugin becomes
name|filename|mime1,mime2,...with its MIME types sorted. - The entries are sorted and joined with
;. The result is always hashed (SHA-256, first 128 bits). - An empty list reports the plain value
none, unhashed.
Why it helps
Current Chromium, Firefox and WebKit builds expose different fixed lists (different names, file names and MIME types), embedded and older browsers expose others, and many headless setups expose none. That makes the value a cheap way to separate engine families and unusual setups.
Stability
Stable for a given browser build. It changes when the browser changes its fixed list in an update or when a setting such as the PDF viewer is turned off.
Browser support and what blocks it
- Available in all current browsers, including Chrome, Firefox, Safari and Edge.
- Brave:
excludedwith ruleIdbrave_farbling, because Brave randomises the list. See the exclusion table. - Headless and embedded browsers often report
none.
Privacy
The list describes the browser build, not the person. In current browsers it no longer reveals installed third-party software the way old plugin lists did. It is reported only as a digest or none.
How WhiskerJS handles noise and failures
| Status | ruleId | When |
|---|---|---|
ok |
a digest, or plain none for an empty list |
|
unavailable |
no_api |
navigator.plugins missing or without a length |
unavailable |
no_digest |
no crypto.subtle for a non-empty list |
blocked |
threw, security_error |
reading the list throws |
excluded |
brave_farbling |
browser class brave |
excluded |
caller_excluded |
you excluded it |
timed_out |
timeout, aborted |
budget or abort |
The plugins_inconsistent check looks at the same data from another angle: it fires when navigator.plugins or navigator.mimeTypes are not the native PluginArray and MimeTypeArray, when only one of them is empty, or when a MIME type’s enabledPlugin is not one of the listed plugins. native_tampering and navigator_own_property also watch navigator.plugins.
Example value
In the container test, headless Chromium and Firefox reported none, while headless WebKit reported the digest 0a49ecbdc428ee2eb82dc9f7e83cd2ef.
Questions and answers
Browsers no longer support plugins. Why read them?
Current browsers still expose a fixed list, mostly PDF viewer entries, and that list differs between engines and some embedded browsers. Headless browsers often report none, and fake lists can be detected.
Why is plugins excluded in Brave?
Brave's farbling randomises the plugin list per site and session, so reading it would only add noise. The exclusion table reports it as excluded with ruleId brave_farbling.
What does none mean?
The list was empty. none is reported as a plain word, not a digest, so you can see it directly.