How does the p0f checker test a proxy?

It opens a connection through your proxy to a passive TCP/IP fingerprinting server. The SYN packet that server receives is built by the proxy, so the result shows the operating system the proxy's network stack looks like, which is exactly what a website sees when you browse through it.

What do the scores mean?

Each operating system class (Windows, Linux, Mac OS and iOS) gets an average similarity score against the fingerprint database. The perfect score is the highest score possible. The OS with the highest score is the closest match, and the percentage shows how close it gets to a perfect match.

Why does my proxy look like Linux?

Most proxy servers run Linux, and the SYN a proxy sends comes from its own operating system, not from your computer. That is why a proxy often looks like Linux even when your browser runs on Windows or macOS. Some providers, including Roundproxies, let you change the TCP/IP fingerprint a proxy presents.

What is an OS mismatch?

An OS mismatch is when the operating system a connection's TCP/IP fingerprint points to differs from the one its User-Agent claims, for example a Windows browser arriving on a Linux SYN. Anti-bot and fraud systems use it as a sign that a proxy or VPN sits between the browser and the website.

Which proxy formats are supported?

HTTP and SOCKS5 proxies in host:port, host:port:username:password or username:password@host:port format. Prefix a SOCKS5 proxy with socks5:// (for example socks5://user:pass@1.2.3.4:1080); without a prefix the proxy is checked as HTTP. You can check up to 10 proxies at a time.

Is the p0f checker free?

Yes, the p0f checker is free and needs no account. Proxy credentials are only used for the test connection and are not stored.

Free p0f Checker

See which operating system your proxy looks like at the TCP/IP level. We connect through the proxy and score the SYN it sends against Windows, Linux, macOS and iOS fingerprints. No signup required. Results in seconds.

4OS families scored per proxy

Passive TCP/IP Fingerprinting Through Your Proxy

The check runs from the proxy's point of view, exactly as a website would see it:

•

A real connection is opened through your proxy to a fingerprinting server

•

The server records the SYN packet the proxy itself sends

•

No software to install and nothing runs on your machine

•

Authenticated proxies supported with user:pass credentials

Because the packet comes from the proxy server, the result reflects the proxy's network stack, not your own computer's.

Scores for Every Major Operating System

The SYN is scored against a database of fingerprints collected from real browsers:

•

Windows desktop stacks

•

Linux, including Android and Chrome OS, which share the kernel's SYN

•

macOS (Mac OS)

•

iOS and iPadOS

Every OS gets a score, so you can see not just the best match but how clearly it wins. Apple's two systems share one stack and often score close together.

Spot OS Mismatches Before Anti-Bot Systems Do

Fingerprint mismatches are one of the cheapest signals a website can check:

•

See whether a proxy looks like Windows, Linux or Apple

•

Compare the result with the User-Agent your traffic sends

•

Catch Linux-looking proxies behind Windows browser profiles

•

Re-check after changing a proxy's OS fingerprint

A Windows Chrome User-Agent arriving on a Linux SYN is a classic proxy giveaway. Knowing what your proxy looks like lets you keep the two consistent.

Check Several Proxies at Once

Enter a short list and compare proxies side by side:

•

Up to 10 proxies per check, separated by commas or spaces

•

HTTP and SOCKS5 proxies in host:port, host:port:user:pass and user:pass@host:port formats

•

Results appear as each proxy finishes

•

Copy any result as JSON for your own records

Checking a handful of proxies from the same provider quickly shows whether its whole fleet shares one fingerprint.

Trusted by millions.The p0f checker shows what anti-bot systems see before a single byte of HTTP is sent.

What is a p0f Checker?

A p0f checker tells you which operating system a connection looks like from its TCP/IP packets alone. Named after the classic p0f tool, it reads the first packet of a connection, the SYN, and compares it with fingerprints of known systems.

Why the SYN Gives the OS Away

Every operating system builds its SYN a little differently: the initial TTL, the TCP window size and scale, the maximum segment size and the order of the TCP options. Together they form a fingerprint that is hard to change without touching the network stack.

Proxies Have a Fingerprint Too

A website never sees your computer's packets when you use a proxy: it sees the proxy server's. Most proxies run Linux, so a browser that claims Windows but connects with a Linux SYN is an easy signal for anti-bot systems.

Reading the Scores

Each OS gets a similarity score against the best possible match, the perfect score. The highest bar is the OS the proxy most looks like. A clear winner means a consistent fingerprint; close scores mean the stack is ambiguous.

Match Your Browser and Your Stack

For the cleanest profile, the OS your proxy's TCP/IP stack resembles should match the User-Agent your browser or scraper sends. Check before you deploy, and again after changing a proxy's OS fingerprint setting.