Open-source alternatives for browser fingerprinting

What these libraries do, and the kinds

All of them run JavaScript in the page and read browser APIs. What they hand back differs, and that matters more than the list of signals:

Kind	What you get	Examples below
Device identifier	one hash (sometimes with the parts) meant to stay the same for the same browser setup	FingerprintJS, ThumbmarkJS, ClientJS, fingerprinter-js, get-browser-fingerprint, device-uuid, TrustDevice-JS
Structured identifier	an id in sections, so two results can match in some parts and differ in others	fpscanner (fsid), WhiskerJS (structuredId)
Bot classifier	a verdict: bot or not, and which tool	BotD
Research site	a website that studies fingerprinting and lie detection; not packaged as a library	the research site described below
User-agent parser	browser, engine, OS and device type parsed from the User-Agent string	Bowser, ua-parser-js (not collectors, so not listed in detail)
Edge fingerprint	a fingerprint of the TLS handshake, computed on the server or proxy, not in the browser	JA4 (not a browser library)

A fingerprint describes a browser setup, not a person. Every project below that discusses limits says the same thing in its own words: client-side values can be spoofed.

How this list was made

Each library’s public repository was read at the version named on 2026-10-24 (code read, never installed or run). Licences come from each project’s LICENSE file and package metadata. Claims are quoted from each project’s README or docs; “not published” means the project gives no figure. If something here is out of date, the project’s own documentation is the reference. For a signal-by-signal view see the feature comparison.

The libraries

FingerprintJS 5.3.0 (and the 3.x and 4.x lines)

• Licence: MIT from 5.0.0 (its docs/licensing.md: “Starting from version 5.0.0, FingerprintJS is licensed under MIT license.”). 4.x (4.0.0 to 4.6.2, 2023 to 2025) was under the Business Source License 1.1; 3.4.2 (2023-07-06) was the last MIT release before it.
• Last release read: 5.3.0, 2026-10-07. Maintained.
• Collects: one of the broadest sets: Client Hints, fonts (52, span widths in a hidden iframe), font preferences, audio, canvas (with known-noise skips and a double render), screen frame, Math, CSS media features, WebGL basics and full parameters, Apple Pay, Private Click Measurement, audio base latency, content-blocker filter lists and more.
• Its claims: README: “the accuracy is significantly lower than in the commercial version” (no figure in the v5 README); the 3.4.2 README: “limited accuracy (40% - 60%)”. Version policy: “The library tries to keep visitor identifiers the same within a minor version”.
• Network by default: a sampled monitoring GET on about 1 in 1000 loads; off with load({ monitoring: false }).
• Project: github.com/fingerprintjs/fingerprintjs. Compared in detail: WhiskerJS and FingerprintJS.

ThumbmarkJS 1.12.0

• Licence: MIT. Last release: 2026-09-25. Maintained.
• Collects: audio, canvas rendered three times with the most common byte per pixel kept, a WebGL image, 89 fonts by canvas measureText in an iframe, permissions over 28 names, speech voices, WebRTC SDP details without addresses, screen and media queries, the JS heap limit and more.
• Its claims: README: “The client library achieves ~80% uniqueness across general browser populations. Mac/Safari users can show higher collision rates or higher noise depending on the audience.” Option stabilize (default ['private', 'iframe']).
• Network by default: sampled logging on about 1 in 10000 runs (a POST of the components and the page path to its logging API, which on the same run fetches and evaluates a remote script); with an API key, further API calls and a beacon. Off with logging: false, no api_key, collect_beacon: false.
• Project: github.com/thumbmarkjs/thumbmarkjs. In detail: WhiskerJS and ThumbmarkJS.

ClientJS 0.2.1

• Licence: Apache-2.0. Last release: 2021-10-25; last push 2023-01-08. Unmaintained.
• Collects: the User-Agent and its parse, screen values, plugins and mimeTypes, Java, Flash and Silverlight presence (obsolete today), 231 fonts by span width, storage and cookie availability, time zone offset, language and a canvas drawing. The fingerprint is a 32-bit MurmurHash3 of the joined values.
• Its claims: README: “It is not a full proof technique” (no figure).
• Network by default: none found in the code read.
• Project: github.com/jackspirou/clientjs. In detail: WhiskerJS and ClientJS.

BotD 2.0.0

• Licence: MIT. Last release: 2025-11-04. Maintained; README: “the near-term roadmap is stability-only”.
• Collects: automation and bot markers only (globals left by automation tools, navigator.webdriver, eval length, productSub, the notification permission quirk, plugin and mimeType prototypes, window size and others). It returns { bot, botKind }, not a device id.
• Its claims: no accuracy figure published.
• Network by default: a sampled monitoring GET on about 1 in 1000 loads; off with load({ monitoring: false }).
• Project: github.com/fingerprintjs/BotD. In detail: WhiskerJS and BotD.

fpscanner 1.0.8

• Licence: MIT. Last release: 2026-08-05. Maintained (a rewritten 1.x line).
• Collects: automation checks (webdriver, writable webdriver, Selenium and Playwright properties, Chrome DevTools Protocol detection), device and browser values, Client Hints, WebGL and WebGPU, media codecs, keyboard layout, media device counts, a canvas tamper check, iframe and Worker cross-checks, and a request context (time, nonce, page URL).
• Its claims: README: “Fingerprints are representations, not verdicts.” and “All client-side fingerprinting and bot detection techniques can be spoofed or emulated”. Its fsid is “a JA4-inspired, locality-preserving fingerprint identifier”.
• Network by default: none found in the code read.
• Project: github.com/antoinevastel/fpscanner. In detail: WhiskerJS and fpscanner.

A browser fingerprinting research site

• Licence: MIT, plus a trade mark policy on its name (which is why this site describes it instead of naming it). No tagged releases; last push 2026-06-11. Maintained as a research site.
• Collects: a very wide set, from CSS and DOM measurements to audio, canvas, WebGL, fonts via document.fonts, Web Worker values and known privacy-resistance patterns, and extensive prototype and Proxy lie detection.
• Its claims: README: “The goal of this project is to conduct research and provide education, not to create a fingerprinting library.” No stability or uniqueness figures.
• Network: fetches its own script and a samples file from its own site (it is a website).
• Project: its repository.

fingerprinter-js 2.0.1

• Licence: MIT. Last release: 2026-01-30. Maintained, small.
• Collects: a “stable” set in the hash (user agent, languages, time zone, screen, plugins, canvas, WebGL, fonts, hardware, Client Hints, storage, touch, Math, media device counts) and an “unstable” set outside it (WebRTC, battery, connection, permissions, audio); optional bot analysis with a riskLevel.
• Its claims: README: “Only stable data contributes to fingerprint hash”, with per-collector entropy estimates (for example canvas “~10 bits”).
• Network by default: its WebRTC collector contacts Google’s STUN server; skip that collector to avoid it.
• Project: github.com/Lorenzo-Coslado/fingerprinter-js.

get-browser-fingerprint 5.2.4

• Licence: package.json declares MIT; the repository at this tag has no LICENSE file. Last release: 2026-04-02. Maintained, small.
• Collects: UA and Client Hints, Intl and locale details, preferences, screen (size on mobile only), network type, hardware, media codecs, canvas, WebGL, WebGPU, audio, fonts and two permission states; a 32-bit MurmurHash3.
• Its claims: README: “The script does not try to bypass intentional randomization or hardening.”
• Network by default: none found in the library code.
• Project: github.com/damianobarbati/get-browser-fingerprint.

device-uuid 3.0.6

• Licence: MIT. Last release: 2026-09-28. Maintained.
• Collects: by default a User-Agent parse, screen, language and feature flags (MD5 hash); canvas, WebGL, audio, fonts, media devices, network information and incognito detection only when asked for.
• Its claims: no figures; README: “privacy-by-design (fingerprinting is opt-in)”.
• Network by default: none found.
• Project: github.com/biggora/device-uuid.

TrustDevice-JS 1.0.6

• Licence: MIT. Last release: 2025-03-07. Historical; the open “basic version” of a commercial vendor.
• Collects: screen, many navigator values, canvas, WebGL, audio, fonts, storage availability and a developer-tools guess. The id is an MD5 kept in a cookie.
• Its claims: README: “Will remain the same after uninstalling and reinstalling or clearing browser data.” (the cookie cache).
• Network by default: none found.
• Project: github.com/trustdecision/trustdevice-js.

WhiskerJS 0.1.0 (this site)

• Licence: Apache-2.0. Status: in development, not yet published; build from source, npm package coming.
• Collects: 46 components at signalsVersion 5 (37 in the visitorId, in seven groups that form the structuredId), 14 integrity checks without a verdict, and an optional anti-replay binding. Every component always has a status and a reason code. See Signals.
• Its claims: none about accuracy, stability or uniqueness yet: the measurement harness has not run.
• Network: none. No network code, no telemetry, no storage, no permission prompts, no console output.
• More: Docs, facts, live demo.

How to choose

These questions sort the options by what you need, not by which is “best”:

1. Licence. Can you ship it? MIT and Apache-2.0 both allow commercial use with the notice kept; Apache-2.0 adds an explicit patent grant. A Business Source License version needs its own terms checked. A package without a LICENSE file needs the author’s text first.
2. Network defaults. Does the library contact anyone by default? If your privacy notice promises that device data goes only to you, check the defaults and turn off any monitoring or logging.
3. Identifier, structured identifier or classifier? A single hash answers “same or not”. A structured id answers “what changed”. A classifier answers “bot or not” for you, with its own rules. Decide which decision you want to keep on your server.
4. Maintenance. Browsers change every few weeks. An unmaintained library keeps reading APIs the way they worked when it stopped.
5. Similarity and anti-replay. If you need to match devices across small changes, look for an id in parts. If you worry about recorded results being replayed, look for a nonce and timestamp bound into the result (and remember that a client-side digest is not a signature).
6. Privacy browsers. Brave and Firefox with resistFingerprinting randomise or normalise some values on purpose. Check how the library treats them: skipped, reduced, or read anyway.
7. Measure on your own traffic. Published figures are not comparable with each other. Run the candidates on your own devices and users before relying on any of them.

No head-to-head measurement has run. This page describes features and each project’s own words. It does not say that WhiskerJS or any other library is more accurate, more stable or more unique. A measurement harness that runs the libraries side by side on the same devices is planned; its results will be published on the comparison page.

Questions and answers

Related pages