Sense every device.
Keep the decision yours.

A few lines to start

Collect a result and send it with the request you already make. No extra endpoint, no third-party calls.

Not on npm yet: version 0.1.0 is built from source. The API may change before 1.0. Getting started

$ pnpm install && pnpm build   # in the WhiskerJS source folder

import { load } from 'whiskerjs'

const agent = await load()
const device = await agent.collect({ binding: { nonce, timestamp } })
await fetch('/login', { method: 'POST', body: JSON.stringify({ email, password, device }) })

Step 1

Collect in the browser

47 signals run in parallel, each with one second and the whole call with a budget. Signals a browser is known to randomise are left out instead of trusted, and canvas, WebGL and audio are checked twice and against known answers to catch noise.

Step 2

Hash, check and bind

Large values become SHA-256 digests in the page. 19 checks look for automation and tampering. The result is versioned and, if you pass your server's nonce, bound to it with a digest so old results cannot be replayed.

Step 3

Decide on your server

Send the result with a request you already make. Match visitorIds, compare structuredIds group by group, weigh the flags and set thresholds in your own code. Your rules stay private.

Inside a result

Built for browsers that fight back

Brave randomises some signals, Firefox and Safari fingerprinting protection add noise, resistFingerprinting and Tor fake others, and private windows can add canvas noise. WhiskerJS knows where, draws twice (and again when the two differ) and checks known answers to catch the rest, and gives every signal a status and a reason code, so your server knows what it could not trust.

• Noise-aware canvas and WebGL
• Per-browser exclusion rules
• 19 automation and tamper checks
• Versioned visitorId and structuredId
• Anti-replay binding to your nonce
• Self-hosted, zero dependencies

All 47 signals · All 19 checks

Live demo

See what it returns on your device

The demo runs the real WhiskerJS build (commit 44441d3, signalsVersion 11, idVersion 2) in your browser: the visitorId, the structuredId group by group, every component with its status, the integrity flags and, after a library update, the id under the previous signal version for linking. Run it again later to see whether your id holds, and if not, which group moved. The demo turns the diagnostics report off, so nothing is sent anywhere.

Open the live demoHow to read the results

Comparison

Feature by feature, with eleven other libraries

Which signals each open-source library collects at a named version, its licence, its own stability and uniqueness claims, and which ones send data home by default. The head-to-head measurement has not run yet, so the page makes no accuracy claim; it is coming.

Diagnostics: statuses only, easy to turn off

By default about 1 in 100 page loads send the WhiskerJS project one report of component statuses, never values or ids. diagnostics: false, a meta tag, Do Not Track or Global Privacy Control turns it off. What is sent.

No prompts, no WebRTC

No permission prompts. No WebRTC addresses, battery, location or media device labels.

Hashed in the browser

Images, audio, font lists and other large values leave only as SHA-256 digests.

Stores nothing

No cookies, localStorage or IndexedDB. Each call starts from nothing.