Spotting a returning browser without cookies or logins
FingerprintJS reads dozens of browser traits (canvas and audio rendering, installed fonts, WebGL, time zone, screen) and hashes them into a visitorId. No cookie is involved: the hash is rebuilt on every visit, which is why it holds in a private window and after browsing data has been wiped. A site can tell it has seen a browser before without asking anyone to sign up. The computation runs entirely client-side; storing and matching the IDs is up to the application's backend.
42 entropy sources, exposed and swappable
- Every signal in the result: besides the
visitorId,fp.get()returns the value of all 42 sources shipped in v5.3.0 and how long each took to read. One of them,domBlockers, detects ad blockers. - Rebuildable hash: drop a source that proves too unstable, add a custom one, and
hashComponents()derives a new identifier from the edited list. - Private windows covered: the hash survives incognito mode, Firefox included since v5.1.0, though not guaranteed once its Enhanced Tracking Protection is on.
- Upgrade path written down: each result carries the algorithm version, and the version policy shows how to load old and new releases side by side so stored IDs can migrate without losing known visitors.
- npm or CDN: the
@fingerprintjs/fingerprintjspackage, or ESM, IIFE and UMD builds served from openfpcdn.io.
Weeks-long IDs and opt-out telemetry in the npm build
An ID lasts a few weeks, and collisions are common. The repository's comparison with the paid product caps the open-source fingerprint's lifetime at a few weeks and calls collisions "quite common", since the hash needs every attribute to match exactly. The commercial service deduplicates visitors server-side with fuzzy matching instead. The library's confidence score is hard-coded per platform, from 0.3 on mobile WebKit and recent Safari to 0.7 on platforms such as desktop Linux, and its comment links to the paid tier. The README also concedes that a fingerprint built in the browser can be spoofed. Patched browsers such as Camoufox answer screen, WebGL, font and audio APIs in C++ with another device's values.
The npm build reports usage to Fingerprint unless told not to. Installed from npm, the library has a 0.1% chance on each load() call of contacting the vendor's servers, at most once a week per browser. Per the API reference, the request carries the library version, the client's HTTP headers (page origin and referrer included) and its IP address. Passing monitoring: false turns it off. Scripts from openfpcdn.io ship with it disabled, though the README warns that the CDN import fails behind ad blockers, in Brave and in Firefox.
The project pitches itself as a starting point for the paid platform. The README calls the library "great for getting started" and sends anyone after "production-grade accuracy" to Fingerprint Identification, the same company's closed-source commercial service, which processes signals server-side. Incognito detection and Smart Signals (bots, VPNs, tampered browsers) exist only there. For the free library, the comparison table leaves storage, data security and compliance to whoever deploys it, with no SLA.
Latest release: v5.3.0, 7 October 2026, MIT since v5. Version 5.0.0 (22 October 2025) moved the licence from BUSL-1.1 to MIT and the compile target from ES5 to ES2018. The 4.x line stays under BUSL-1.1, which only converts to MIT four years after each release. Four releases have followed, and the latest commit landed on 21 October 2026. The maintainers try to keep IDs unchanged within a minor version but promise nothing, so a minor upgrade can change them.