# WhiskerJS

> WhiskerJS is an open-source (Apache-2.0) browser library that reads device and browser signals in a web page and returns them as one plain, versioned JSON result: 46 components, a 128-bit visitorId, a group-by-group structuredId and a list of integrity flags. It is a collector, not a scoring engine: it never sends anything, never stores anything and never decides "human or bot". The site that uses it sends the result to its own server, which decides.

Key facts (version 0.1.0, signalsVersion 5, idVersion 2):

- Status: in development. Not yet published to npm or any registry; build it from source. The npm package is coming.
- Licence: Apache License 2.0. Two small parts are adapted from MIT-licensed projects (Math operations from FingerprintJS 5.3.0, media MIME lists from fpscanner 1.0.8) with their notices kept.
- 46 components; 37 stable ones form the visitorId, each in one of 7 groups (gpu, audio, fonts, device, browser, locale, prefs), the parts of the structuredId; 9 are reported but kept out of both ids.
- 14 integrity flags (signs of automation or tampering). Flags are hints for the server, never a verdict.
- Privacy: no network requests, no telemetry, no storage (no cookies, localStorage, sessionStorage or IndexedDB), no permission prompts, no console output. Large values leave the page only as the first 128 bits of SHA-256.
- Optional anti-replay binding: the server's nonce and timestamp are echoed in the result with a digest over the whole result. It stops replay of an old result; it is not a signature.
- Privacy browsers are not worked around: Brave farbling and Firefox resistFingerprinting (also Tor Browser) make WhiskerJS exclude the affected components.
- No accuracy, stability or uniqueness figures are published yet: the head-to-head measurement against other libraries has not run.
- Ids describe a browser setup, not a person, and are comparable only within the same signalsVersion and idVersion.

This file concatenates every documentation and guide page of https://whiskerjs.com as Markdown, in reading order. Each page starts with its title and its source URL.


---

# Overview

> What WhiskerJS is, what it returns, and how to read the live demo.

Source: https://whiskerjs.com/docs/ (last updated 2026-10-26)

> **In plain words:**
>
> WhiskerJS is an open-source (Apache-2.0) script for web pages. It reads technical characteristics of the visitor’s browser and device, such as screen size, fonts and how a test image is drawn, and returns them as one JSON object. Your own server then decides what to do with it: recognise a device it has seen before, or notice that something looks automated. WhiskerJS itself never decides, never sends anything and never stores anything.

## What you get from one call

```ts
import { load } from 'whiskerjs';

const agent = await load();
const result = await agent.collect();
```

| Field | What it is |
| --- | --- |
| `components` | 46 measurements, each with a status (`ok`, `unavailable`, `blocked`, `noisy`, `excluded`, `timed_out`) and, when not ok, a reason code |
| `visitorId` | a 32-character hash of the 37 stable components: equal ids mean the same browser setup |
| `structuredId` | seven 12-character hashes, one per signal group, so two results can be compared group by group |
| `integrityFlags` | names of the 14 checks for automation and tampering that fired |
| `binding` | your server’s nonce and timestamp, bound to the result with a digest (only if you pass them) |
| `version`, `signalsVersion`, `idVersion` | `0.1.0`, `5`, `2`: store them with every id |
| `durationMs` | how long the collection took |

## What it is and is not

| WhiskerJS is | WhiskerJS is not |
| --- | --- |
| a collector of device and browser signals | a bot verdict or a risk score |
| a library that runs in your page | a hosted service or an API |
| stateless: every call starts from nothing | a tracker: it stores no cookie or id |
| silent on the network | telemetry: it never phones home |
| open source under Apache-2.0 | on npm yet (build it from source) |

## The pages

- [Getting started](https://whiskerjs.com/docs/getting-started/): Build it, add it to a page, collect once.
- [How it works](https://whiskerjs.com/docs/how-it-works/): The pipeline, timeouts, statuses, hashing, noise.
- [Signals](https://whiskerjs.com/docs/signals/): All 46 components and what they read.
- [Identifiers](https://whiskerjs.com/docs/identifiers/): visitorId, structuredId and comparing results.
- [Integrity checks](https://whiskerjs.com/docs/integrity/): 14 flags and their false positives.
- [Privacy](https://whiskerjs.com/docs/privacy/): What is and is not collected; the notice to give.
- [Integration](https://whiskerjs.com/docs/integration/): Your server, the onResult hook, anti-replay.
- [FAQ](https://whiskerjs.com/docs/faq/): Short answers to common questions.
- [API reference](https://whiskerjs.com/docs/api/): Every export, option and type.

## Reading the live demo

The [live demo](https://whiskerjs.com/demo/) runs the real library (the build of commit `1100e48`, signalsVersion 5, idVersion 2) in your browser and shows exactly what it returns. Nothing is sent anywhere; the demo page keeps a history of your runs in your own browser so it can compare them.

- **visitorId** (top left): the id for this browser setup. The chip under it says whether it matches your previous run on this device.
- **Version tiles**: `version`, `signalsVersion` and `idVersion` of the library, the run’s duration, how many components are `ok`, and how many times you have loaded the page.
- **structuredId**: the full value and one tile per group. After a second run, a group whose part changed is highlighted, which tells you *what* moved (for example `gpu` after a graphics driver update).
- **Integrity flags**: usually empty on a normal browser. “What every flag means” explains each one; see [Integrity checks](https://whiskerjs.com/docs/integrity/) for the false positives (privacy extensions often set `native_tampering`).
- **Components table**: every component with its status, the reason code when it is not ok, whether it counts in the visitorId, and its value. Values that are 32 hex characters are digests, not raw data. Common non-ok rows are normal: `device_memory` and `heap_limit` are `unavailable` outside Chromium-based browsers, `audio_latency` is `unavailable` with `skipped` outside Safari and Android, and under Brave several components are `excluded` with `brave_farbling`.
- **History**: newest first, with the groups and components that changed since the run before. Runs from different library versions are never compared; the list marks the boundary.
- **Lab testing mode**: label the device, load the page a few times, and copy one tab-separated line per run into a sheet to measure stability on your own devices. “Copy full JSON” includes the anti-replay binding (the demo makes its own nonce; a real site gets it from its server).

What to try: run it twice (the id should hold), open a private window (some browsers add canvas noise there, and `canvas` or `webgl_image` turn `noisy`), or change the browser language (usually only the `locale` part of the structuredId changes).


---

# Getting started

> From the source code to a first result in your page.

Source: https://whiskerjs.com/docs/getting-started/ (last updated 2026-10-26)

> **In plain words:**
>
> WhiskerJS is a small script you run in your web page. You call `collect()`, wait a moment, and get back one JSON object describing the browser and device: 46 measurements, two identifiers and a list of warning flags. You then send that object to your own server with a request you already make. The library is not on npm yet, so you build it from source first.

This page takes you from the source code to a first result in a page. It assumes you know how to run a JavaScript build and serve a web page.

## 1. Build the library

WhiskerJS is not on npm yet, and its source repository opens with the first public release. With the source in a folder named `whiskerjs`:

```sh
cd whiskerjs
pnpm install   # dev dependencies only: TypeScript and Node types
pnpm build     # writes dist/: ES2020 modules plus .d.ts type files
pnpm test      # optional: runs the test suite with node:test
```

Requirements: Node 18 or newer (tested on Node 22) and pnpm 10 (`corepack enable` gives you the pinned version).

## 2. Add it to your project

Pick one of these:

- **As a package.** In the WhiskerJS folder run `pnpm pack`. It writes `whiskerjs-0.1.0.tgz` with `dist/`, `LICENSE`, `NOTICE` and `THIRD_PARTY_NOTICES.md`. In your project: `npm install ../whiskerjs/whiskerjs-0.1.0.tgz` (or the pnpm or yarn equivalent). Your bundler then resolves `import { load } from 'whiskerjs'`.
- **As plain files.** Copy `dist/*.js` and `dist/collectors/*.js` (keep the folder layout) to your static files and load `index.js` as a module: `<script type="module">import { load } from '/vendor/whiskerjs/index.js';</script>`. This is how the live demo on whiskerjs.com runs it.

There are no runtime dependencies and no CDN.

## 3. Collect once

```ts
import { load } from 'whiskerjs';

const agent = await load();                 // cheap: no work happens yet
const result = await agent.collect();       // at most 5 s by default (1 s per component)

console.log(result.visitorId);              // '3feb3ead31e6b520459ad33ebc58f2d7'
console.log(result.integrityFlags);         // [] or e.g. ['automation_webdriver']
```

`collect()` never throws and never rejects, whatever the browser does. Collect in the browser, after the page has a `<body>`: several probes add hidden elements to the body for a moment, and without one they report `unavailable`.

The page must be a **secure context** (https, or `http://localhost` while developing). Hashing uses `crypto.subtle`, which browsers only offer there. Without it `visitorId` and `structuredId` are `null` and every large component reports `unavailable` with ruleId `no_digest`.

## 4. Read the result

```ts
for (const [name, c] of Object.entries(result.components)) {
  if (c.status === 'ok') console.log(name, c.value, c.hashed ? '(digest)' : '');
  else console.log(name, c.status, c.ruleId);
}
```

- `visitorId`: one hash over the 37 stable components. Equal ids mean the same browser setup, as far as these signals can tell.
- `structuredId`: seven short hashes, one per signal group, so you can see *which part* of a device changed. See [Identifiers](https://whiskerjs.com/docs/identifiers/).
- `components`: all 46, always present, each with a status. See [Signals](https://whiskerjs.com/docs/signals/) and [How it works](https://whiskerjs.com/docs/how-it-works/).
- `integrityFlags`: names of checks that saw signs of automation or tampering. A hint for your server, not a verdict. See [Integrity checks](https://whiskerjs.com/docs/integrity/).
- `signalsVersion` and `idVersion`: store them with every id; ids are only comparable within the same versions.

## 5. Send it to your own server

WhiskerJS has no network code. Add the result to a request you already make, for example the login form post:

```ts
const result = await agent.collect({
  timeoutMs: 3000,
  binding: await getNonceFromMyServer(),  // { nonce, timestamp }, optional
});
await fetch('/api/login', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({ email, password, device: result }),
});
```

The result is plain JSON, about 4 KB. Read [Integration](https://whiskerjs.com/docs/integration/) for what to check on the server, and [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding) for the nonce.

## 6. Tell your users

Device signals can be personal data. Before you deploy, read [Privacy](https://whiskerjs.com/docs/privacy/) and add a notice to your privacy policy.

## Try it without building

The live demo at [whiskerjs.com/demo](https://whiskerjs.com/demo/) runs the real library in your browser and shows every component, both ids and the flags.


---

# How it works

> The collection pipeline, step by step, with every limit and reason code.

Source: https://whiskerjs.com/docs/how-it-works/ (last updated 2026-10-26)

> **In plain words:**
>
> When you call `collect()`, WhiskerJS asks the browser 46 small questions at the same time (screen size, fonts, how a test image renders, and so on). Each question has one second to answer. Every answer gets a status: it worked, it is not available here, it was refused, it was random, it was skipped on purpose, or it took too long. Big answers are turned into short fingerprints (hashes) so the raw data never leaves. Then it checks the page for signs of robots or faked values, and builds two identifiers from the answers that rarely change.

In one sentence: `collect()` runs 46 small, independent probes at the same time, each against its own clock, turns whatever happens into a status, hashes anything large, checks the page for signs of automation or tampering, and derives two identifiers from the stable part.

This page explains each step in plain words first, then in exact detail. Everything here describes the code at signalsVersion 5 and idVersion 2.

## The pipeline

```text
load(options)             pick the window, clock, timers and crypto (once)
  |
collect(options)
  1. budget               overall deadline = now + timeoutMs
  2. browser class        brave, firefox_rfp, firefox, safari, chromium, other
  3. run 46 collectors    in parallel; each one: excluded? -> race(work, timer, abort)
  4. clean up             release the shared WebGL context
  5. finalise             sanitise each outcome; hash large or unprintable values
  6. integrity checks     14 checks, some against a fresh blank iframe
  7. identifiers          visitorId and structuredId from the stable components
  8. binding              echo your nonce and timestamp, digest over the result
  9. onResult hook        your optional callback gets a copy
  -> resolve with the result
```

### Step by step

1. **Budget.** `timeoutMs` (default 5000) sets the deadline for the whole call. A value that is not a finite number falls back to 5000; it is clamped to the range 0 to 60000.
2. **Browser class.** A cheap check of `navigator.brave`, the user agent, `navigator.vendor` and, for Firefox, the resistFingerprinting traits. The class picks a row of the exclusion table (below) and is itself the `browser_class` component.
3. **Collectors.** All 46 start at once (`Promise.all`). For each one, in this order:

   - named in `collect({ exclude })`: `excluded`, ruleId `caller_excluded`;
   - listed in the exclusion table for this browser class: `excluded` with the table’s ruleId;
   - the abort signal has already fired: `timed_out`, ruleId `aborted`;
   - otherwise its work races three things: its own result, a timer, and the abort signal. The timer is the smaller of the collector’s inner timeout (1000 ms for every collector today) and the time left before the overall deadline. A collector that loses the race is not cancelled; its late answer is simply ignored.
4. **Clean up.** Collectors that share a resource release it once all of them have settled. Today that is the single WebGL context, which is released with `WEBGL_lose_context`. Probes that add elements to the page (font measurement, font preferences, content-blocker baits) remove them in their own `finally` block.
5. **Finalise.** Each outcome becomes the public component shape (see “Hashing” below).
6. **Integrity checks.** Fourteen read-only checks, two of them against a clean iframe realm. See [Integrity checks](https://whiskerjs.com/docs/integrity/).
7. **Identifiers.** See [Identifiers](https://whiskerjs.com/docs/identifiers/).
8. **Binding.** Only when you pass `binding`. See [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding).
9. **Hook.** When `load({ onResult })` was given, it is called with a deep copy of the result. See [Integration](https://whiskerjs.com/docs/integration/).

`durationMs` is the whole time from step 1 to the end of step 7, rounded to whole milliseconds, read from the injected clock (`performance.now()` by default).

If anything outside every guard fails, `collect()` still resolves: with a fallback result where every component is `blocked` with ruleId `internal_error`, both ids `null` and no flags.

## Timeouts and budgets

| Limit | Value | What happens when it is hit |
| --- | --- | --- |
| Inner timeout | 1000 ms per collector | that component is `timed_out`, ruleId `timeout` |
| Overall budget | `timeoutMs`, default 5000, max 60000 | every component still pending is `timed_out`, ruleId `timeout` |
| Abort | `collect({ signal })` | every component still pending is `timed_out`, ruleId `aborted`; the iframe checks are skipped |
| Voices wait | up to 600 ms inside `speech_voices` | the list is read as it is then |
| Bait wait | 50 ms inside `content_blockers` | cosmetic filters get this long to hide the baits |

A `timeoutMs` of 0 still resolves with every component present (most of them `timed_out`). The other steps (finalising, integrity checks, hashing) are not under the budget, but they are short and do not wait on the browser except for `crypto.subtle.digest`.

## Statuses and reason codes

Every component is always present and has exactly one status.

| Status | Plain meaning | ruleIds you can see |
| --- | --- | --- |
| `ok` | the value was read | none |
| `unavailable` | this browser does not offer the API, or it gave nothing usable | `no_api`, `no_document`, `no_context`, `no_layout`, `no_match`, `no_value`, `no_digest`, `skipped` |
| `blocked` | the API refused or failed | `security_error`, `threw`, `empty_image`, `no_buffer`, `short_buffer`, `silent`, `bad_outcome`, `internal_error` |
| `noisy` | two identical renders differed, so the browser adds random noise | `render_mismatch` |
| `excluded` | not collected, on purpose | `caller_excluded`, `brave_farbling`, `firefox_rfp` |
| `timed_out` | it ran out of time or was cancelled | `timeout`, `aborted` |

What each ruleId means:

| ruleId | Meaning |
| --- | --- |
| `no_api` | the API or constructor does not exist here |
| `no_document` | there is no `document` (or no `document.body` where one is needed) |
| `no_context` | a canvas, WebGL or WebGPU context or adapter could not be created |
| `no_layout` | elements were added but the page laid nothing out (for example `display: none` on the body) |
| `no_match` | no media query option matched |
| `no_value` | the API answered with nothing usable |
| `no_digest` | the value had to be hashed but `crypto.subtle` is missing or failed |
| `skipped` | read only in some browsers on purpose (`audio_latency`, see [Signals](https://whiskerjs.com/docs/signals/)) |
| `security_error` | the browser threw a `SecurityError` or `NotAllowedError` |
| `threw` | the browser threw any other error |
| `empty_image` | the canvas export was empty or not an image |
| `no_buffer`, `short_buffer`, `silent` | the offline audio render gave no buffer, too few samples, or only zeros |
| `bad_outcome` | a collector returned something that is not an outcome (a guard; not expected) |
| `internal_error` | the fallback result: something outside every guard failed |
| `render_mismatch` | two renders of the same scene differed |
| `caller_excluded` | you excluded it with `collect({ exclude })` |
| `brave_farbling`, `firefox_rfp` | the exclusion table removed it for this browser class |
| `timeout`, `aborted` | inner timeout or overall budget; abort signal |
| `unknown` | a guard: a reason that is not a well-formed name is replaced with this |

A ruleId always matches `^[a-z0-9_]{1,32}$`.

Some `ok` components report a plain word instead of a measurement: `none` (nothing found, for example no plugins or no content blocker), `exact` or `altered` (`canvas_readback`), `he=blocked`, `he=failed` or `he=none` inside `ua_client_hints` and `ua_versions` (the detailed Client Hints were refused by a Permissions Policy, failed, or do not exist).

## Hashing

Plainly: anything big or unusual leaves the library only as a fingerprint of itself, never as the raw thing.

Exactly:

- The digest is SHA-256 from `crypto.subtle.digest`, cut to its first 128 bits and written as 32 lowercase hex characters. Strings are UTF-8 encoded first; byte values (audio samples, WebGL pixels) are hashed as bytes.
- Thirteen components are **large** and always hashed: `audio`, `canvas`, `font_preferences`, `fonts`, `fonts_canvas`, `math`, `media_codecs`, `permissions`, `plugins`, `speech_voices`, `webgl_image`, `webgl_params`, `webgpu`. The exception is a plain sentinel: `fonts`, `fonts_canvas`, `plugins` and `speech_voices` report `none` unhashed when they find nothing.
- Every other component is reported as is, **unless** its value is longer than 128 characters or contains a character outside printable ASCII (0x20 to 0x7e). Then it is hashed too. This is why a long `webgl_renderer`, a long `ua_versions` or a keyboard layout in a non-Latin script can arrive as a digest.
- `hashed: true` tells you the value is a digest; `hashed: false` that it is the plain value.
- Without a working `crypto.subtle` a value that must be hashed is never sent raw: the component becomes `unavailable` with ruleId `no_digest`.

## The exclusion table

Some browsers randomise or normalise certain signals on purpose. Reading them would only add noise to the id, so for those browser classes the components are not collected at all and report `excluded`.

| Browser class | Excluded components | ruleId |
| --- | --- | --- |
| `brave` | audio, canvas, fonts, fonts_canvas, hardware_concurrency, plugins, webgl_image | `brave_farbling` |
| `firefox_rfp` | canvas, hardware_concurrency, pixel_ratio, screen_frame, screen_resolution, time_zone, webgl_image, webgl_renderer, webgl_vendor | `firefox_rfp` |
| `firefox`, `safari`, `chromium`, `other` | none |   |

- **Brave** is recognised by `navigator.brave.isBrave` being a function. Its “farbling” adds per-site, per-session noise to these signals.
- **Firefox with resistFingerprinting** (also Tor Browser) reports fixed or normalised values. Firefox is classed `firefox_rfp` only when every one of these holds at once: the time zone is `UTC`, `Etc/UTC` or `Atlantic/Reykjavik`; the screen is exactly the size of the content area (`innerWidth` and `innerHeight`); the available screen area equals the screen (no taskbar); `devicePixelRatio` is 1; `screenX` and `screenY` are 0; and `navigator.webdriver` is not true. Each trait alone is common in stock Firefox, and stock Firefox under automation (Playwright runs it in UTC with the screen equal to the viewport) matches several, so the test errs towards plain `firefox`. A missed resistFingerprinting browser only leaves normalised values in; a false positive would drop nine components (seven of them in the visitorId).

The table is exported as `EXCLUSION_TABLE`. Changing it bumps `signalsVersion`.

## Noise handling: the double render

Some browsers and extensions add small random changes to canvas and WebGL readback, often only in private windows. WhiskerJS cannot know in advance, so it checks:

- `canvas` draws the same scene (text, an emoji, blending, an even-odd shape) twice on the same canvas and compares the two `toDataURL()` strings.
- `webgl_image` draws the same shaded triangle twice and compares the two `readPixels()` buffers byte by byte.

If the two differ, the component is `noisy` with ruleId `render_mismatch` and carries no value. In the visitorId it counts as “missing”, like any other non-ok status, so the id stays the same from run to run instead of changing every time. `canvas_readback` is a separate, simpler probe: it paints a known colour into a 1x1 canvas and reports `exact` or `altered`.

## The clean iframe realm

Several integrity checks need a second, untouched copy of the browser’s built-in objects to compare against. WhiskerJS makes one like this:

- after the collectors finish, it creates one `<iframe>` with **no `src`** (so it stays `about:blank` and makes no request), sets `display: none`, and appends it to the body;
- it reads from the iframe’s `contentWindow`: its own `Function.prototype.toString`, its navigator and screen getters, and a few values;
- it removes the iframe straight away, also when a check throws.

Nothing is written to either window. A script that overrides a navigator getter, patches `toString` to hide the override, or wraps a function in a Proxy usually does so only in the page’s realm, so the clean realm sees through it. The checks that use the realm are `iframe_mismatch` and `prototype_lie`. After an abort no iframe is created and these two do not fire.

## Design notes

- Each collector is a small object: a name, an inner timeout, a `large` flag (always hashed) and a `stable` flag (part of the visitorId).
- Collectors read the browser only through the injected window (`load({ env })`), which is how the tests run in Node against a hand-written fake browser (`test/fake-browser.ts`) that records every call.
- A collector that needs a resource another collector also uses shares it: one WebGL context per collection, one Client Hints request per collection.
- `load()` keeps no state between calls. Two `collect()` calls are fully independent.


---

# Signals

> All 46 components: what each one reads, why it helps and what a value looks like.

Source: https://whiskerjs.com/docs/signals/ (last updated 2026-10-26)

> **In plain words:**
>
> A signal (or component) is one measurement, such as the screen size or the list of installed fonts. Each one differs a little between devices; together they tell devices apart. 37 signals rarely change and form the visitorId, sorted into seven groups (graphics, audio, fonts, device, browser, locale, preferences). Nine change too easily (zoom, taskbar, permissions and so on), so they are reported but kept out of the ids.

Every component also has its own page, with how the technique works, stability, browser support, privacy and every status it can report: see [Signals](https://whiskerjs.com/signals/) and the [glossary](https://whiskerjs.com/glossary/).

WhiskerJS reports 46 components. 37 of them are **stable** and make up the visitorId; each stable component belongs to exactly one of seven groups (the parts of the structuredId). The other 9 are reported for your server to use but kept out of both ids, because they change too easily.

How to read each entry:

- **Reads**: the browser API and exactly what is taken from it.
- **Why it helps**: what makes it differ between devices.
- **Typical value**: the shape of an `ok` value. Values shown as “digest” are 32 hex characters (see [How it works](https://whiskerjs.com/docs/how-it-works/#hashing)).
- **Support**: where it is usually `ok`, and what it reports elsewhere.

Values in the examples are illustrative, not from a particular device.

## Overview

| Component | Group | In visitorId | Always hashed |
| --- | --- | --- | --- |
| [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) | browser | yes | no |
| [`audio`](https://whiskerjs.com/signals/audio/) | audio | yes | yes |
| [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) | none | no | no |
| [`browser_class`](https://whiskerjs.com/signals/browser-class/) | browser | yes | no |
| [`canvas`](https://whiskerjs.com/signals/canvas/) | gpu | yes | yes |
| [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) | none | no | no |
| [`color_depth`](https://whiskerjs.com/signals/color-depth/) | device | yes | no |
| [`color_gamut`](https://whiskerjs.com/signals/color-gamut/) | prefs | yes | no |
| [`content_blockers`](https://whiskerjs.com/signals/content-blockers/) | none | no | no |
| [`cpu_architecture`](https://whiskerjs.com/signals/cpu-architecture/) | device | yes | no |
| [`device_memory`](https://whiskerjs.com/signals/device-memory/) | device | yes | no |
| [`dynamic_range`](https://whiskerjs.com/signals/dynamic-range/) | prefs | yes | no |
| [`font_preferences`](https://whiskerjs.com/signals/font-preferences/) | fonts | yes | yes |
| [`fonts`](https://whiskerjs.com/signals/fonts/) | fonts | yes | yes (`none` plain) |
| [`fonts_canvas`](https://whiskerjs.com/signals/fonts-canvas/) | fonts | yes | yes (`none` plain) |
| [`forced_colors`](https://whiskerjs.com/signals/forced-colors/) | prefs | yes | no |
| [`hardware_concurrency`](https://whiskerjs.com/signals/hardware-concurrency/) | device | yes | no |
| [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) | device | yes | no |
| [`intl_locale`](https://whiskerjs.com/signals/intl-locale/) | locale | yes | no |
| [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) | none | no | no |
| [`languages`](https://whiskerjs.com/signals/languages/) | locale | yes | no |
| [`math`](https://whiskerjs.com/signals/math/) | browser | yes | yes |
| [`media_codecs`](https://whiskerjs.com/signals/media-codecs/) | browser | yes | yes |
| [`pdf_viewer`](https://whiskerjs.com/signals/pdf-viewer/) | browser | yes | no |
| [`permissions`](https://whiskerjs.com/signals/permissions/) | none | no | yes |
| [`pixel_ratio`](https://whiskerjs.com/signals/pixel-ratio/) | none | no | no |
| [`platform`](https://whiskerjs.com/signals/platform/) | browser | yes | no |
| [`plugins`](https://whiskerjs.com/signals/plugins/) | browser | yes | yes (`none` plain) |
| [`prefers_contrast`](https://whiskerjs.com/signals/prefers-contrast/) | prefs | yes | no |
| [`private_click`](https://whiskerjs.com/signals/private-click/) | browser | yes | no |
| [`reduced_motion`](https://whiskerjs.com/signals/reduced-motion/) | prefs | yes | no |
| [`screen_frame`](https://whiskerjs.com/signals/screen-frame/) | none | no | no |
| [`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/) | device | yes | no |
| [`speech_voices`](https://whiskerjs.com/signals/speech-voices/) | none | no | yes (`none` plain) |
| [`storage`](https://whiskerjs.com/signals/storage/) | browser | yes | no |
| [`time_zone`](https://whiskerjs.com/signals/time-zone/) | locale | yes | no |
| [`touch_support`](https://whiskerjs.com/signals/touch-support/) | device | yes | no |
| [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) | browser | yes | no |
| [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) | none | no | no |
| [`vendor`](https://whiskerjs.com/signals/vendor/) | browser | yes | no |
| [`vendor_flavors`](https://whiskerjs.com/signals/vendor-flavors/) | browser | yes | no |
| [`webgl_image`](https://whiskerjs.com/signals/webgl-image/) | gpu | yes | yes |
| [`webgl_params`](https://whiskerjs.com/signals/webgl-params/) | gpu | yes | yes |
| [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/) | gpu | yes | no |
| [`webgl_vendor`](https://whiskerjs.com/signals/webgl-vendor/) | gpu | yes | no |
| [`webgpu`](https://whiskerjs.com/signals/webgpu/) | gpu | yes | yes |

“No” in the last column still means: hashed when the value is longer than 128 characters or not printable ASCII.

The exclusion table removes some of these under Brave and Firefox resistFingerprinting; see [How it works](https://whiskerjs.com/docs/how-it-works/#the-exclusion-table).

## gpu: graphics

Graphics output depends on the GPU, its driver, the operating system and the browser’s rendering engine together, which makes this the most distinguishing group and also the one that changes after a driver update.

### `canvas`

- **Reads**: a 260x80 2D canvas scene (a filled rectangle, the text “Whiskers twitch, jumpy fox” with a cat emoji in Times New Roman and Arial, three circles with `multiply` blending, an even-odd ring), exported with `toDataURL()`. Rendered twice.
- **Why it helps**: font rasterising, anti-aliasing, emoji images and blending differ between systems.
- **Typical value**: digest.
- **Support**: all browsers. `noisy` / `render_mismatch` where readback is randomised; `excluded` under Brave and Firefox resistFingerprinting.

### `webgl_image`

- **Reads**: a 32x32 WebGL drawing of one triangle with a procedural colour shader, read back with `readPixels()`. Drawn twice.
- **Why it helps**: shader maths and rasterising differ between GPUs and drivers.
- **Typical value**: digest.
- **Support**: where WebGL 1 is available. `unavailable` / `no_context` without WebGL; `noisy` when readback is randomised; `excluded` under Brave and Firefox resistFingerprinting.

### `webgl_params`

- **Reads**: 21 WebGL parameters (texture sizes, viewport limits, bit depths, shading language version and others), the range and precision of four float and int formats in both shader types, and the sorted list of supported extensions.
- **Why it helps**: limits and extensions follow the GPU, driver and browser.
- **Typical value**: digest.
- **Support**: where WebGL 1 is available.

### `webgl_renderer`

- **Reads**: the unmasked renderer string from `WEBGL_debug_renderer_info` where the extension exists, otherwise `gl.RENDERER`. In Firefox the extension is not requested (it prints a deprecation warning there) and `gl.RENDERER` already carries the unmasked string.
- **Why it helps**: names the GPU, often with the graphics back end.
- **Typical value**: `ANGLE (Apple, ANGLE Metal Renderer: Apple M2, Unspecified Version)`; hashed when longer than 128 characters.
- **Support**: where WebGL 1 is available. `excluded` under Firefox resistFingerprinting. A software renderer here also sets the `software_renderer` flag.

### `webgl_vendor`

- **Reads**: the unmasked vendor string, same method as `webgl_renderer`.
- **Typical value**: `Google Inc. (Apple)`.
- **Support**: as `webgl_renderer`.

### `webgpu`

- **Reads**: `navigator.gpu.requestAdapter()`, then the adapter’s `info` (vendor, architecture, device, description), its sorted feature list and seven limits (`maxBindGroups`, `maxBufferSize`, `maxComputeInvocationsPerWorkgroup`, `maxComputeWorkgroupStorageSize`, `maxStorageBufferBindingSize`, `maxTextureDimension2D`, `maxVertexBuffers`). No device is requested, and the deprecated `requestAdapterInfo()` (which warns in the console) is not called.
- **Why it helps**: a second, newer view of the GPU.
- **Typical value**: digest.
- **Support**: browsers with WebGPU, in secure contexts. `unavailable` / `no_api` without `navigator.gpu`, `no_context` when no adapter is returned.

## audio

### `audio`

- **Reads**: an `OfflineAudioContext` (1 channel, 5000 frames at 44100 Hz) renders a 10 kHz triangle wave through a dynamics compressor; the last 500 samples are taken. Nothing is played and no audio device is opened.
- **Why it helps**: the floating-point details of the audio stack differ between engines, operating systems and CPUs.
- **Typical value**: digest.
- **Support**: all current browsers. `blocked` / `silent` when the render is all zeros; `excluded` under Brave.

## fonts

Which fonts are installed, and how the default fonts are set, depend on the operating system, its language packs and installed software.

### `fonts`

- **Reads**: for each of 54 font families, text in that font with a generic fallback (`monospace`, `sans-serif`, `serif`) is measured in hidden spans and compared with the fallback alone. A family counts as present when any width or height differs. The spans sit in one hidden, off-screen container that is removed at once.
- **Why it helps**: installed fonts vary a lot between systems.
- **Typical value**: digest of the sorted list of found families, or `none`.
- **Support**: needs a `document.body` and layout (`unavailable` / `no_document` or `no_layout` otherwise). `excluded` under Brave.

### `fonts_canvas`

- **Reads**: the same 54 families, detected a second way: canvas `measureText()` widths at 72 px against the three fallbacks. No DOM layout, so page CSS cannot disturb it.
- **Typical value**: digest, or `none`.
- **Support**: all browsers with a 2D canvas. `excluded` under Brave.

### `font_preferences`

- **Reads**: the width of the text “Whiskers quietly judge 0123456789” in seven hidden spans: the browser default font, `serif`, `sans-serif`, `monospace`, `system-ui`, `-apple-system`, and the default font at 1 px (which reveals the minimum font size setting).
- **Why it helps**: follows the user’s font settings and the operating system’s system font.
- **Typical value**: digest.
- **Support**: needs a body and layout.

## device: screen, memory and CPU

### `screen_resolution`

- **Reads**: `screen.width` and `screen.height`, larger side first, so that rotating a phone does not change it.
- **Typical value**: `1920x1080`, `2560x1440`, `932x430`.
- **Support**: all browsers. `excluded` under Firefox resistFingerprinting.

### `color_depth`

- **Reads**: `screen.colorDepth`.
- **Typical value**: `24`, `30`.

### `hardware_concurrency`

- **Reads**: `navigator.hardwareConcurrency` (logical CPU threads).
- **Typical value**: `8`, `12`.
- **Support**: all current browsers. Some browsers cap or round it. `excluded` under Brave and Firefox resistFingerprinting.

### `device_memory`

- **Reads**: `navigator.deviceMemory` (approximate GB, coarse buckets).
- **Typical value**: `8`, `4`.
- **Support**: Chromium-based browsers only. Safari, iOS browsers and Firefox do not offer it, so it is `unavailable` / `no_api` there by design.

### `heap_limit`

- **Reads**: `performance.memory.jsHeapSizeLimit`.
- **Typical value**: `4294705152`.
- **Support**: Chromium-based browsers only; `unavailable` elsewhere.

### `cpu_architecture`

- **Reads**: computes `Infinity - Infinity` in a `Float32Array` and reports the high byte of the resulting NaN’s bit pattern.
- **Why it helps**: x86 produces a NaN with the sign bit set, ARM one without, so it tells CPU families apart even when the user agent hides them.
- **Typical value**: `255` (x86), `127` (ARM).

### `touch_support`

- **Reads**: `navigator.maxTouchPoints`, whether `document.createEvent('TouchEvent')` works, and whether `ontouchstart` exists on the window.
- **Typical value**: `points=0,event=0,start=0` (desktop), `points=5,event=1,start=1` (phone).

## browser: engine and build

### `browser_class`

- **Reads**: WhiskerJS’s own class: `brave`, `firefox_rfp`, `firefox`, `safari`, `chromium` or `other`, from `navigator.brave`, the user agent, `navigator.vendor` and the resistFingerprinting traits.
- **Why it helps**: picks the exclusion row; separates browser families.
- **Typical value**: `chromium`.

### `math`

- **Reads**: 24 Math results (acos, acosh, asin, asinh, atanh, atan, sin, sinh, cos, cosh, tan, tanh, exp, expm1, log1p and polyfill forms of some, plus `PI` to the power -100) on fixed inputs. The operations and inputs are adapted from FingerprintJS 5.3.0 (MIT).
- **Why it helps**: the last digits of these functions differ between JavaScript engines and their versions.
- **Typical value**: digest.

### `media_codecs`

- **Reads**: for 8 audio and 12 video MIME types, `canPlayType()` on a new `<audio>` or `<video>` element (never given a source, never attached) and `MediaSource.isTypeSupported()`. The MIME lists are adapted from fpscanner 1.0.8 (MIT).
- **Typical value**: digest.

### `plugins`

- **Reads**: `navigator.plugins`: each plugin’s name, file name and MIME types, sorted.
- **Why it helps**: mostly a fixed PDF plugin list in current browsers, but it differs between engines and some embedded browsers.
- **Typical value**: digest, or `none`.
- **Support**: `excluded` under Brave.

### `pdf_viewer`

- **Reads**: `navigator.pdfViewerEnabled`.
- **Typical value**: `true` or `false`; `unavailable` where the property does not exist.

### `platform`

- **Reads**: `navigator.platform`.
- **Typical value**: `MacIntel`, `Win32`, `Linux x86_64`, `iPhone`.

### `vendor`

- **Reads**: `navigator.vendor`, with an empty string reported as `empty`.
- **Typical value**: `Google Inc.`, `Apple Computer, Inc.`, `empty` (Firefox).

### `vendor_flavors`

- **Reads**: which of ten browser-specific globals exist (`chrome`, `safari`, `webkit`, `opr`, `yandex`, `__crWeb`, `__gCrWeb`, `__firefox__`, `samsungAr`, `ucweb`).
- **Why it helps**: tells browser builds and in-app browsers apart.
- **Typical value**: `chrome`, or `none`.

### `storage`

- **Reads**: whether `localStorage`, `sessionStorage` and `indexedDB` are reachable (the property is only looked up, never read or written) and `navigator.cookieEnabled`. No cookie is read or set.
- **Typical value**: `local=1,session=1,indexed_db=1,cookies=1`.

### `ua_client_hints`

- **Reads**: `navigator.userAgentData`: brand names (without versions, with the deliberately changing “GREASE” brand removed), `mobile`, `platform`, and from one `getHighEntropyValues()` call: architecture, bitness, wow64, model and form factors.
- **Why it helps**: the device class and architecture, more reliably than the user agent string.
- **Typical value**: `brands=Chromium,Google Chrome;mobile=0;platform=macOS;arch=arm;bitness=64;wow64=0;model=;form=Desktop`. When the detailed hints are refused by a Permissions Policy, the end is the stable marker `he=blocked` (or `he=failed`, `he=none`).
- **Support**: Chromium-based browsers; `unavailable` elsewhere.

### `apple_pay`

- **Reads**: whether `ApplePaySession` exists, the highest version from 20 down that `supportsVersion()` accepts, and `canMakePayments()`. No payment sheet is shown and no request is made.
- **Typical value**: `none` (no Apple Pay), `version=14;can_pay=1`. `can_pay` is `blocked` where the call throws (insecure or cross-origin contexts).
- **Support**: Safari; `none` elsewhere.

### `private_click`

- **Reads**: `attributionSourceId` of a new `<a>` element that gets no `href` and is never attached (Safari Private Click Measurement).
- **Typical value**: `none` outside Safari.

## locale

### `time_zone`

- **Reads**: the IANA name from `Intl.DateTimeFormat().resolvedOptions()`, or, without Intl, `UTC+n` from the larger of the January and July offsets.
- **Typical value**: `Europe/Berlin`, `America/New_York`.
- **Support**: `excluded` under Firefox resistFingerprinting.

### `languages`

- **Reads**: `navigator.languages` joined with commas, or `navigator.language`.
- **Typical value**: `en-US,en`.

### `intl_locale`

- **Reads**: the resolved locale, calendar and numbering system of `Intl.DateTimeFormat`, its hour cycle, and the locale of `Intl.NumberFormat`.
- **Typical value**: `locale=en-US;calendar=gregory;numbering=latn;hour_cycle=h12;number_locale=en-US`.

## prefs: display and accessibility preferences

Each is one `matchMedia()` query list; the first match is reported, and `unavailable` / `no_match` when none matches.

| Component | Values |
| --- | --- |
| [`color_gamut`](https://whiskerjs.com/signals/color-gamut/) | `rec2020`, `p3`, `srgb` |
| [`dynamic_range`](https://whiskerjs.com/signals/dynamic-range/) | `high`, `standard` |
| [`forced_colors`](https://whiskerjs.com/signals/forced-colors/) | `active`, `none` |
| [`prefers_contrast`](https://whiskerjs.com/signals/prefers-contrast/) | `more`, `less`, `custom`, `none` |
| [`reduced_motion`](https://whiskerjs.com/signals/reduced-motion/) | `reduce`, `none` |

They follow the screen and the user’s accessibility settings, which rarely change.

## Not in either id

These are reported so your server can use them, but they change too easily to be part of an identifier.

### `pixel_ratio`

- **Reads**: `devicePixelRatio`, rounded to 3 decimals.
- **Typical value**: `1`, `2`, `1.25`.
- **Why not in the id**: it changes with page zoom. `excluded` under Firefox resistFingerprinting.

### `screen_frame`

- **Reads**: the screen area the system keeps (taskbar, dock, menu bar) as `top,right,bottom,left` in CSS pixels, from `screen` minus the `avail*` values.
- **Typical value**: `0,0,48,0` (a 48 px taskbar at the bottom).
- **Why not in the id**: it changes when the taskbar moves or with a second monitor. `excluded` under Firefox resistFingerprinting.

### `ua_versions`

- **Reads**: full brand versions and the platform version from Client Hints.
- **Typical value**: `brands=Chromium/130.0.6723.58,Google Chrome/130.0.6723.58;platform_version=15.1.0`.
- **Why not in the id**: it changes with every browser or OS update. Chromium-based browsers only.

### `permissions`

- **Reads**: the state (`granted`, `denied`, `prompt`; `unsupported` or `unknown` otherwise) of 24 permissions through `navigator.permissions.query()`, which never prompts. No API that requests a permission is ever called.
- **Typical value**: digest.
- **Why not in the id**: it changes when the user grants or revokes a permission. The notifications state also feeds the `permissions_inconsistent` flag.

### `keyboard_layout`

- **Reads**: the character 19 physical keys produce in the active layout, from `navigator.keyboard.getLayoutMap()` (no prompt); `_` for a key the layout lacks.
- **Typical value**: `` qwyzam;'[]`\\-=,./2 `` (US English); hashed for layouts outside printable ASCII.
- **Why not in the id**: users switch layouts. Chromium only; `blocked` in cross-origin iframes, where the browser refuses it.

### `speech_voices`

- **Reads**: installed speech synthesis voices (name, language, local, default), sorted. Waits up to 600 ms for the `voiceschanged` event if the list is empty at first. No speech is produced.
- **Typical value**: digest, or `none`.
- **Why not in the id**: some browsers fill the list late.

### `audio_latency`

- **Reads**: `AudioContext.baseLatency`, and closes the context at once. Nothing is played.
- **Typical value**: a number of seconds such as `0.005333`.
- **Support**: read only in Safari and on Android. Elsewhere creating an `AudioContext` outside a user gesture prints an autoplay warning in the console, so it reports `unavailable` with ruleId `skipped`.
- **Why not in the id**: it follows the audio output device.

### `canvas_readback`

- **Reads**: paints two known colours into a 1x1 canvas and reads them back with `getImageData()`.
- **Typical value**: `exact`, or `altered` when something adds noise to canvas reads.
- **Why not in the id**: it is a diagnostic about the browser’s settings, not about the device.

### `content_blockers`

- **Reads**: adds eight 1x1 bait elements with ad-like class names and ids (for example `ad-banner`, `adsbox`) in an off-screen container, waits 50 ms, and lists the baits that cosmetic filters hid. Everything is removed afterwards; no request is made.
- **Typical value**: `none`, or `ad_banner,ad_box,banner_ad`.
- **Why not in the id**: users turn blockers on and off per site.

## Left out on purpose

WebRTC (even without addresses), media device lists, network information, battery, geolocation, storage quota and user-agent parsing are not collected. The reasons are in the roadmap in the library source (`docs/ROADMAP.md`).


---

# Identifiers

> visitorId for exact matches, structuredId for similarity, and what makes them change.

Source: https://whiskerjs.com/docs/identifiers/ (last updated 2026-10-26)

> **In plain words:**
>
> The visitorId is one code made from all the stable signals: if two visits give the same code, the browser setup is the same. The structuredId is the same idea split into seven short codes, one per group of signals. When only one of the seven changes (say, graphics after a driver update), you can still see that it is very likely the same device, and you can see what changed.

Every result carries two identifiers derived from the same 37 stable components:

- **visitorId**: one 128-bit hash. Two results either match or they do not.
- **structuredId**: seven short hashes, one per signal group. Two results can match in some groups and differ in others, which tells you *what* changed.

Neither is stored by the library, and neither is a person: they describe a browser setup. Two identical devices with identical settings can share an id, and one person with two browsers has two.

## visitorId

Plainly: put every stable component on its own line, in alphabetical order, and hash the lot. Same environment, same id.

Exactly (idVersion 2):

```text
whiskerjs/id/2
apple_pay=v:none
audio=h:0a4d8e691d7e59afff0d9a1a9d405e3b
browser_class=v:chromium
canvas=!
...
webgpu=h:862da19ca084b185c1d8c76af676a08b
```

- the first line is `whiskerjs/id/<idVersion>`;
- then one line per stable component in alphabetical order: `name=v:value` for a plain value, `name=h:digest` for a hashed one, and `name=!` for every status other than `ok`;
- lines are joined with `\n`, UTF-8 encoded, hashed with SHA-256, and the first 128 bits are returned as 32 lowercase hex characters.

Because every non-ok status gives the same `!`, a component that is `blocked` in one run and `timed_out` in the next does not change the id. A component that is `ok` in one run and not in the next does.

It is `null` when `crypto.subtle` is missing or fails (for example on a page that is not a secure context).

## structuredId

Format:

```text
2_2ac06a6b0b67_63695d5858ec_9c9b9c3f5a2e_5e78835d0b60_77ab287db153_8ad7c1a2e06b_4880096d1ea0
| gpu          audio        fonts        device       browser      locale       prefs
idVersion
```

`<idVersion>_<gpu>_<audio>_<fonts>_<device>_<browser>_<locale>_<prefs>`. Each part is the first 48 bits (12 hex characters) of SHA-256 over the line `whiskerjs/id/2/<group>` followed by the group’s components in alphabetical order, one line each in the visitorId encoding above.

| Group | Components |
| --- | --- |
| `gpu` | canvas, webgl_image, webgl_params, webgl_renderer, webgl_vendor, webgpu |
| `audio` | audio |
| `fonts` | font_preferences, fonts, fonts_canvas |
| `device` | color_depth, cpu_architecture, device_memory, hardware_concurrency, heap_limit, screen_resolution, touch_support |
| `browser` | apple_pay, browser_class, math, media_codecs, pdf_viewer, platform, plugins, private_click, storage, ua_client_hints, vendor, vendor_flavors |
| `locale` | intl_locale, languages, time_zone |
| `prefs` | color_gamut, dynamic_range, forced_colors, prefers_contrast, reduced_motion |

The groups and their order are exported as `ID_GROUPS` and `ID_GROUP_ORDER`, the part length as `ID_PART_LENGTH` (12). The structuredId is `null` without a digest.

## Comparing two results

WhiskerJS only derives the parts. Deciding what counts as “the same device” is your server’s job. A simple, explainable approach:

```ts
import { ID_GROUP_ORDER } from 'whiskerjs';

/** Which groups match between two structuredIds of the same idVersion. */
function compareStructured(a: string, b: string): Record<string, boolean> | null {
  const pa = a.split('_');
  const pb = b.split('_');
  if (pa[0] !== pb[0]) return null;            // different idVersion: not comparable
  const out: Record<string, boolean> = {};
  ID_GROUP_ORDER.forEach((group, i) => {
    out[group] = pa[i + 1] === pb[i + 1];
  });
  return out;
}

// { gpu: false, audio: true, fonts: true, device: true, browser: true, locale: true, prefs: true }
// reads as: "same device and settings, the graphics changed" (for example a driver update)
```

Typical patterns, as hints and not rules:

| What differs | A likely cause |
| --- | --- |
| only `gpu` | GPU driver or browser graphics update, hardware acceleration switched |
| only `browser` | browser update (Client Hints brands, Math results, codecs) |
| only `locale` | the user changed language or time zone, or travelled |
| only `prefs` | an accessibility or display setting changed |
| only `device` | a different screen or a changed CPU or memory report |
| `fonts` | fonts installed or removed, a font setting changed |
| most groups | a different device, or a different browser on the same device |

When matching, weigh groups by how much they tell apart and how often they change on your own traffic. The components inside each group are in the result, so you can also compare them one by one.

## What changes the id

The visitorId changes when any stable component’s value or status (ok or not ok) changes. Common causes:

- browser or operating system updates (`math`, `media_codecs`, `ua_client_hints`, graphics);
- GPU driver updates, or turning hardware acceleration on or off;
- installing or removing fonts;
- changing language, time zone or accessibility settings;
- a different screen as the primary display;
- a private window or an extension that adds noise to canvas or WebGL (the component turns `noisy`);
- a component timing out on a slow or busy device in one run but not in another.

What does **not** change it: the pixel ratio (which follows page zoom), the taskbar or dock (`screen_frame`), permission grants, the keyboard layout, ad blockers, voices loading late, the audio output latency and exact browser version numbers (`ua_versions`). Those components are outside the id.

## Why versions bump

- **signalsVersion** goes up when a collector changes what it measures, an integrity check changes, or the exclusion table changes. Adding a stable component changes the visitorId of nearly every device; changing a check changes no id but changes which flags you see.
- **idVersion** goes up when the derivation itself changes: the line encoding, the prefix, the groups. The prefix contains the idVersion, so a new idVersion gives every device a new id.

Treat a visitorId as comparable only with ids of the same `idVersion` **and** `signalsVersion`. Across versions, re-link devices through something you already trust (a signed-in session, for example) and store the new id next to the old one. [What’s new](https://whiskerjs.com/whats-new/) lists what each version changed.


---

# Integrity checks

> 14 read-only checks for automation and tampering, and when they can be wrong.

Source: https://whiskerjs.com/docs/integrity/ (last updated 2026-10-26)

> **In plain words:**
>
> Besides measuring the device, WhiskerJS looks for traces of robots (browser automation tools) and of scripts that fake browser values. Each check that sees something adds a flag to the result. A flag is a hint, not a verdict: privacy extensions and normal setups can trigger some of them. Your server decides what a flag means for you.

`result.integrityFlags` is a sorted list of the checks that fired. Each one is a sign that the page may be driven by automation or that browser functions were changed. None of them is proof, and WhiskerJS never turns them into a verdict: that is your server’s decision, ideally together with other signals you have (account history, rate, network).

How the checks work, in short:

- they run after the collectors, read only, and never write to the page;
- a check that throws simply does not fire;
- two checks (`iframe_mismatch`, `prototype_lie`) compare against a fresh, hidden `about:blank` iframe that is removed straight away (see [How it works](https://whiskerjs.com/docs/how-it-works/#the-clean-iframe-realm)); they are skipped after an abort;
- the names are exported as `INTEGRITY_FLAG_NAMES`.

## The flags

### `automation_globals`

- **Fires when**: the window has a global left by an automation tool (32 known names from Selenium, WebDriver, Watir, Nightmare, Playwright, PhantomJS, CEF, CefSharp, Awesomium, FMiner, Geb, Phantomas, WebdriverIO and older drivers), a `document` property starts with `$cdc_`, `$wdc_` or `cdc_` (ChromeDriver), or `<html>` has a `webdriver`, `selenium` or `driver` attribute.
- **False positives**: a page script or extension that happens to define a global with one of these names (for example `geb` or `awesomium`). Rare.

### `automation_webdriver`

- **Fires when**: `navigator.webdriver` is `true`.
- **Meaning**: the browser itself says it is controlled through WebDriver or a similar protocol. Selenium, Playwright and Puppeteer set it by default.
- **False positives**: none in the strict sense, but your own end-to-end tests, accessibility scanners and monitoring robots set it too.

### `engine_mismatch`

- **Fires when**: the browser class says one engine but the code behaves like another: the printed source of `eval` is 33 characters in V8 and 37 in Gecko and WebKit, and `navigator.productSub` is `20100101` in Gecko and `20030107` elsewhere. Not checked for class `other`.
- **Meaning**: the user agent was probably changed to claim another browser.
- **False positives**: user-agent switcher extensions used by developers, and uncommon browsers whose user agent names another engine.

### `headless_markers`

- **Fires when**: `outerWidth` and `outerHeight` are both 0, or the user agent is desktop Chrome but `window.chrome` is missing.
- **False positives**: some embedded Chromium views and webviews that send a desktop Chrome user agent without `window.chrome`.

### `headless_user_agent`

- **Fires when**: the user agent contains `HeadlessChrome`, `PhantomJS` or `SlimerJS`.
- **False positives**: none expected; trivial to hide, so its absence means little.

### `iframe_mismatch`

- **Fires when**: any of these differ between the page and the fresh iframe: `navigator.userAgent`, `platform`, `vendor`, `language`, `languages`, `hardwareConcurrency`, `deviceMemory`, `webdriver`, `screen.width`, `screen.height`, `screen.colorDepth`, or the Intl time zone.
- **Meaning**: something overrode these values in the page but not in new frames, a common trait of spoofing scripts. A spoof applied the same way to both is not a mismatch (and may be caught by `prototype_lie`).
- **False positives**: it has been seen under WebKit automation (for example Playwright’s WebKit build), where the automation layer itself makes the page and a new frame disagree. The exact field depends on the setup; check which value differs before acting on it. Also possible with extensions that inject only into the top frame.

### `impossible_hardware`

- **Fires when**: `hardwareConcurrency` is a number but not a whole number from 1 to 256, or `deviceMemory` is a number but not a power of two from 0.25 to 64.
- **Meaning**: the values were set by hand.
- **False positives**: none expected for current browsers.

### `native_tampering`

- **Fires when**: one of 23 built-in functions or getters does not look native: its source is not `function name() { [native code] }`, the printed name differs from its `name` property, or it has extra own properties. Checked: `Function.prototype.toString` first (patching it would hide everything else), then canvas (`toDataURL`, `getContext`, `getImageData`, `fillText`, `measureText`), WebGL (`getParameter`, `readPixels`), `AudioBuffer.getChannelData`, `Date.getTimezoneOffset`, `Element.getBoundingClientRect`, `Intl.DateTimeFormat.resolvedOptions`, the navigator getters `userAgent`, `platform`, `languages`, `hardwareConcurrency`, `deviceMemory`, `webdriver`, `plugins`, the screen getters `width`, `height`, `colorDepth`, and `HTMLElement.offsetWidth`.
- **Meaning**: a script replaced a function that fingerprinting reads.
- **False positives**: privacy and anti-fingerprinting extensions do exactly this on purpose, and so can some monitoring or polyfill scripts on your own page. Expect it on privacy-minded users’ browsers.

### `navigator_own_property`

- **Fires when**: one of `deviceMemory`, `hardwareConcurrency`, `language`, `languages`, `platform`, `plugins`, `userAgent`, `vendor` or `webdriver` is defined on the `navigator` object itself instead of its prototype.
- **Meaning**: overridden with `Object.defineProperty(navigator, ...)`.
- **False positives**: extensions that override navigator values.

### `permissions_inconsistent`

- **Fires when**: `Notification.permission` is `denied` while `navigator.permissions.query({ name: 'notifications' })` says `prompt`.
- **Meaning**: a known headless Chrome trait; a normal browser keeps the two in step.
- **False positives**: rare; possible in browsers with unusual notification settings.

### `plugins_inconsistent`

- **Fires when**: `navigator.plugins` or `navigator.mimeTypes` are not the native `PluginArray` and `MimeTypeArray` types, only one of them is empty, or a MIME type’s `enabledPlugin` is not one of the listed plugins.
- **Meaning**: the plugin list was faked.
- **False positives**: none expected.

### `prototype_lie`

- **Fires when**: the clean iframe sees through an override: its own `Function.prototype.toString` prints one of the page’s checked functions as non-native or with a different name (a Proxy keeps the name property but prints no name), or its native navigator and screen getters, applied to the page’s objects, return something other than what the page reads (or reject the page’s object, as they do for a Proxy).
- **Meaning**: an override that the page’s own realm hides, for example by also patching `toString`.
- **False positives**: as `native_tampering`: extensions that change these functions.

### `software_renderer`

- **Fires when**: the WebGL renderer or vendor names a software renderer (SwiftShader, llvmpipe, softpipe, “software rasterizer”, “basic render driver”, Mesa offscreen).
- **Meaning**: no GPU in use: common in servers, containers and virtual machines.
- **False positives**: real users with hardware acceleration turned off, a GPU the browser blocklists, remote desktops and some virtual desktop setups.

### `webdriver_writable`

- **Fires when**: `navigator.webdriver` is defined on the instance, or on the prototype as a data property, writable, or with a setter. Read from property descriptors only; it is never written.
- **Meaning**: someone redefined `navigator.webdriver`, usually to hide automation.
- **False positives**: none expected in current browsers.

## Using the flags

- Treat them as features for your own model or rules, not as a block list.
- Expect `native_tampering`, `prototype_lie` and `navigator_own_property` on real users with privacy extensions, and `software_renderer` on real users without GPU acceleration.
- `automation_webdriver` with `automation_globals` together is a strong automation sign. Any single flag alone is weaker.
- Flags come from the client: an attacker who controls the browser can remove them. Their **presence** is informative; their absence proves nothing. See [Integration](https://whiskerjs.com/docs/integration/#what-never-to-trust-from-the-client).

## Left out on purpose

Two published checks are not used: Chrome DevTools Protocol detection needs a console call (WhiskerJS writes nothing to the console), and a Web Worker cross-check needs a `blob:` script that a page Content Security Policy may block and report over the network. See the roadmap in the library source (`docs/ROADMAP.md`).


---

# Privacy

> What is and is not collected, and what the site using it still has to do.

Source: https://whiskerjs.com/docs/privacy/ (last updated 2026-10-26)

> **In plain words:**
>
> WhiskerJS reads device characteristics, turns the large ones into hashes in the browser, and gives the result to your page. It makes no network requests, stores nothing, shows no permission prompts and writes nothing to the console. It does not decide anything about the visitor. Because a device fingerprint can still be personal data, the site that uses WhiskerJS must explain it in its privacy notice; a template is below.

WhiskerJS is built to collect as little as it can while still telling devices apart, and to keep every decision about the data with the site that uses it. This page says exactly what it does and does not do, and what that site still has to do.

## What it collects

The 46 components in [Signals](https://whiskerjs.com/docs/signals/): screen and display settings, languages and time zone, installed fonts (as a digest), how graphics and audio render (as digests), CPU, memory and browser build details, which permissions are already granted or refused, and whether a content blocker hides test elements. Large values (images, audio samples, font lists, voices, codecs, plugins, WebGL parameters, WebGPU details, permission states) leave only as a digest: the first 128 bits of SHA-256.

## What it never does

| Never | How this is enforced |
| --- | --- |
| Make a network request (fetch, XHR, `sendBeacon`, WebSocket, EventSource, an element with a network source) | no network code exists; the iframe has no `src`; tests scan the compiled source and record every call on a fake browser |
| Send telemetry or usage data | there is no sender of any kind |
| Store anything (localStorage, sessionStorage, IndexedDB, cookies) | `storage` only checks that the APIs exist; tests record every storage and cookie access |
| Show a permission prompt | permission states are read only with `navigator.permissions.query`; no requesting API is called |
| Read WebRTC addresses, the battery, geolocation or media device labels | not collected; see the roadmap in the library source (`docs/ROADMAP.md`) |
| Write to the console | no console calls; `audio_latency` and WebGL skip APIs that would make the browser warn |
| Play sound or open an audio device | audio is rendered offline; `AudioContext` is created only in Safari and on Android, and closed at once |
| Send a raw large value | it is hashed, or reported `unavailable` (`no_digest`) without Web Crypto |
| Score, profile or decide | it is a collector; there is no scoring code |

For a moment during `collect()` the page holds some hidden elements: an off-screen container of measuring spans (fonts, font preferences), eight 1x1 bait elements (content blockers) and one hidden `about:blank` iframe (integrity checks). All are removed before `collect()` resolves.

## Data minimisation

- Signals that change too easily (zoom, taskbar, permissions, keyboard layout, voices, versions) are kept out of the ids, so ids do not follow users’ everyday choices.
- Signals a privacy browser randomises on purpose (Brave farbling, Firefox resistFingerprinting) are not collected at all instead of being worked around.
- `collect({ exclude: [...] })` lets you drop any component you do not need. Dropping fewer components makes ids more distinguishing; dropping more makes them less so. Decide for your purpose.
- Nothing persists between calls. If you want to remember a device, that is your decision and your storage.

## What the site still has to do

A fingerprint can identify a device, and in many places that makes it personal data, whether or not the site also knows the user’s name. WhiskerJS does not decide the lawful basis, the retention or the notice. The site that uses it does, and should take legal advice for its own case. In particular, rules on accessing information on a user’s device (for example the ePrivacy rules in the EU and UK) can require consent unless an exemption applies, and data protection law (for example the GDPR or POPIA) requires transparency, a purpose and limited retention.

For a longer, informational look at the consent and notice questions (not legal advice), see [Privacy and compliance](https://whiskerjs.com/privacy/): [GDPR and ePrivacy](https://whiskerjs.com/privacy/gdpr-eprivacy/), [POPIA](https://whiskerjs.com/privacy/popia/), [CCPA and CPRA](https://whiskerjs.com/privacy/ccpa-cpra/), [fingerprinting without cookies](https://whiskerjs.com/privacy/fingerprinting-without-cookies/) and [what a privacy notice should say](https://whiskerjs.com/privacy/privacy-notice/).

### Disclosure text you can adapt

> **Device information for security.** When you sign in [or: register, pay], our site runs a script in your browser that reads technical characteristics of your device and browser, such as screen size, language and time zone settings, installed fonts, and how your device draws a test image and processes a test sound. Most of these are turned into short codes (hashes) in your browser. We use them to recognise devices you have used before and to detect automated or fraudulent access. The script does not ask for any permission, does not read your location, contacts, files, camera or microphone, and does not store anything on your device. The results are sent to us only with the form you submit, are kept for [period], and are not sold or used for advertising. [Legal basis.] [How to object or contact us.]

Adjust the moments, purpose, retention and legal basis to what you really do.

## The live demo

The demo at [whiskerjs.com/demo](https://whiskerjs.com/demo/) runs the same library. The demo page itself (not the library) keeps your run history in your browser’s local storage so it can show whether your id holds. For visitors it sends nothing; its Content Security Policy allows connections only to OpenStake’s own lab server, which only lab mode with a lab key (OpenStake’s own test devices) uses. “Clear my history” removes everything it stored.


---

# Integration

> Getting the result to your server, checking it there, and the anti-replay binding.

Source: https://whiskerjs.com/docs/integration/ (last updated 2026-10-26)

> **In plain words:**
>
> WhiskerJS hands you a JSON object and stops there. You add it to a request your page already makes (a login or checkout form), and your server checks it. If you want to stop someone from reusing an old result, your server gives the page a one-time code (a nonce) first; WhiskerJS ties the result to that code, and your server checks the code was used once and recently. Everything from the browser can be faked by a determined attacker, so treat the result as one piece of evidence.

WhiskerJS ends where your code begins: it gives you a result object and does nothing else with it. This page covers getting that result to your server and using it safely.

## Sending the result

Add the result to a request you already make. There is no WhiskerJS endpoint and no extra request is needed.

```ts
import { load } from 'whiskerjs';

const agent = await load();

form.addEventListener('submit', async (event) => {
  event.preventDefault();
  const binding = await (await fetch('/api/whisker-nonce')).json();   // optional
  const device = await agent.collect({ timeoutMs: 3000, binding });
  await fetch('/api/login', {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ email: form.email.value, password: form.password.value, device }),
  });
});
```

Tips:

- Collect at the moment you need it (login, sign-up, checkout), not on every page view.
- Pick `timeoutMs` for the moment: a few seconds before a form post is usually fine; `collect()` resolves as soon as every component settles.
- The result is about 4 KB of JSON. If you verify the binding, send it unchanged: the digest covers every field.

## The onResult hook

`load({ onResult })` gives you one place where every result passes, for example to forward it to your own collector. It is off unless you pass a function.

```ts
const agent = await load({
  onResult: (result) => {
    navigator.sendBeacon('/api/device', JSON.stringify(result)); // your code, your endpoint
  },
});
```

Behaviour, exactly:

- it is called once per `collect()`, with a deep copy (via JSON) of the result, just before `collect()` resolves; changing the copy does not change what `collect()` returns;
- it is not awaited: an async hook runs on its own;
- if it throws or its promise rejects, the error is swallowed and `collect()` is not affected;
- a hook that does slow **synchronous** work still runs on the page’s main thread before `collect()` resolves, so keep it short or move the work into a promise;
- a value that is not a function is ignored.

## Storing ids

Store, per event (login, payment and so on):

| Field | Why |
| --- | --- |
| `visitorId` | the exact-match key |
| `structuredId` | similarity across small changes |
| `idVersion`, `signalsVersion`, `version` | ids are only comparable within the same versions |
| `integrityFlags` | what the checks saw at that moment |
| the components you use in rules | for explanations and later analysis |
| your own context: account, time, IP address, user agent from the request | the server-side view to compare with |

Index on `(idVersion, signalsVersion, visitorId)`. When you ship a new library version, expect new ids for the same devices and link them through a session you already trust. See [Identifiers](https://whiskerjs.com/docs/identifiers/#why-versions-bump).

Keep retention short and limited to the purpose; see [Privacy](https://whiskerjs.com/docs/privacy/).

## Recommended server checks

1. **Shape**: the body parses, the versions are ones you ship, every name in `components` is in `COMPONENT_NAMES` and none is missing, each status is one of the six, values are at most 128 printable ASCII characters.
2. **Binding** (if you use it): nonce issued by you, unused, recent, digest matches. See [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding).
3. **Consistency with the request**: compare the result with what your server sees itself. A `ua_client_hints` platform of `Windows` with a Mac user agent header, a `time_zone` far from the IP address’s region, or `languages` that do not match `Accept-Language` are all worth a look.
4. **Integrity flags**: use them as inputs, weigh them, and remember the false positives listed in [Integrity checks](https://whiskerjs.com/docs/integrity/).
5. **History**: the same `visitorId` on many accounts, or one account on many `visitorId`s in a short time, is usually more telling than any single result.

## What never to trust from the client

Everything in the result was produced by code running on a machine you do not control. In particular:

- **Any value can be faked.** A determined attacker can send a perfect result made by hand. The checks make faking harder and catch careless tools; they do not make it impossible.
- **A missing flag proves nothing.** A clean `integrityFlags: []` can be typed by hand.
- **The binding digest is not a signature.** It stops replay of an old result and catches edits; it does not prove the browser was honest.
- **`browser_class` is a guess** from client values.
- **`durationMs`** is measured on the client clock.

So: use the result as evidence among other evidence, never as an authentication factor on its own, and never let it alone grant access or money.

## Anti-replay binding

### The problem

A result is just JSON. Without more, someone could record one good result and send it again and again, from another machine, long after it was made.

### The idea

Your server makes a fresh, single-use **nonce** and notes the **time** it issued it. The page passes both into `collect()`. WhiskerJS copies them into the result and computes a **digest** over the whole result including them. Your server then checks: “is this my nonce, unused, and recent? Does the digest still match the result?”

```text
server                       browser                        server
------                       -------                        ------
issue nonce, timestamp  ->   collect({ binding })     ->   check nonce unused, recent,
remember (nonce, time)       result.binding =               recompute the digest,
                             { nonce, timestamp, digest }   mark nonce used
```

This stops an old result from being replayed and catches accidental edits. It is **not a signature**: code in the page can recompute the digest, so it does not stop someone who builds a fresh fake result in their own browser. Signing belongs on your server, where the key is safe.

### In the page

```ts
const { nonce, timestamp } = await (await fetch('/api/whisker-nonce')).json();
const result = await agent.collect({ binding: { nonce, timestamp } });
// result.binding: { nonce, timestamp, digest: '9b161c7e6b82c54427df82df3db99457' }
```

Input rules:

- `nonce`: a string of 8 to 128 printable ASCII characters without spaces (`^[\x21-\x7e]{8,128}$`). Use at least 128 random bits, for example 32 hex characters from a cryptographic random source.
- `timestamp`: an integer number of milliseconds from 0 to 8.64e15, from your server’s clock. WhiskerJS reads no clock and no randomness of its own for the binding.

What `result.binding` can be:

| Case | `result.binding` |
| --- | --- |
| no `binding` passed | `null` |
| valid input | `{ nonce, timestamp, digest }` |
| not an object | `{ nonce: null, timestamp: null, digest: null, ruleId: 'invalid_binding' }` |
| bad nonce | `{ nonce: null, timestamp: null, digest: null, ruleId: 'invalid_nonce' }` |
| bad timestamp | `{ nonce: null, timestamp: null, digest: null, ruleId: 'invalid_timestamp' }` |
| no Web Crypto | `{ nonce, timestamp, digest: null, ruleId: 'no_digest' }` |

### The digest

The digest is the first 128 bits of SHA-256, as 32 lowercase hex characters, over this text (lines joined with `\n`, UTF-8):

```text
whiskerjs/bind/1
nonce=<nonce>
timestamp=<timestamp>
version=<version>
signalsVersion=<signalsVersion>
idVersion=<idVersion>
visitorId=<visitorId, or ! when null>
structuredId=<structuredId, or ! when null>
durationMs=<durationMs>
integrityFlags=<flags joined with ,>
c:<name>=<status>|<h, v or ->|<value or empty>|<ruleId or empty>
```

The last line repeats once per component, names sorted. The middle field is `h` for `hashed: true`, `v` for `hashed: false` and `-` when `hashed` is absent. `bindingInput(result)` (exported) returns exactly this text, so your server does not have to rebuild it by hand.

### On the server

A sketch for Node 18 or newer. It uses the library’s own `bindingInput` (pure code, no browser needed) and checks the result’s shape before trusting anything in it.

```ts
import { createHash, randomBytes } from 'node:crypto';
import { bindingInput, COMPONENT_NAMES, type CollectResult } from 'whiskerjs';

const MAX_AGE_MS = 60_000;
const issued = new Map<string, number>(); // use your database or cache, with expiry

export function issueNonce(): { nonce: string; timestamp: number } {
  const nonce = randomBytes(16).toString('hex');
  const timestamp = Date.now();
  issued.set(nonce, timestamp);
  return { nonce, timestamp };
}

export function verify(result: CollectResult): { ok: boolean; reason?: string } {
  const b = result?.binding;
  if (!b || typeof b.nonce !== 'string' || typeof b.digest !== 'string') {
    return { ok: false, reason: 'no_binding' };
  }
  // 1. The nonce is one we issued, and it is used only once.
  const issuedAt = issued.get(b.nonce);
  if (issuedAt === undefined) return { ok: false, reason: 'unknown_or_used_nonce' };
  issued.delete(b.nonce);
  // 2. The timestamp is the one we issued, and it is recent.
  if (b.timestamp !== issuedAt) return { ok: false, reason: 'timestamp_mismatch' };
  if (Date.now() - issuedAt > MAX_AGE_MS) return { ok: false, reason: 'expired' };
  // 3. The result has exactly the components this library version reports.
  const names = Object.keys(result.components ?? {}).sort();
  if (names.join(',') !== [...COMPONENT_NAMES].sort().join(',')) {
    return { ok: false, reason: 'unexpected_components' };
  }
  // 4. The digest matches the result as received.
  const expected = createHash('sha256').update(bindingInput(result), 'utf8').digest('hex').slice(0, 32);
  if (expected !== b.digest) return { ok: false, reason: 'digest_mismatch' };
  return { ok: true };
}
```

Notes:

- Mark the nonce used **before** any slow work, so two parallel requests with the same result cannot both pass.
- Compare the timestamp with what you stored rather than trusting the one in the result.
- Check `version`, `signalsVersion` and `idVersion` against the versions you ship; step 3 above assumes the server runs the same library version as the page.
- Bind the nonce to the session or form it was issued for, so a nonce issued to one visitor cannot be used by another.
- The digest only proves the result was not changed **after** it was made in a browser holding that nonce. Whether the browser itself told the truth is a separate question; see [Integration](https://whiskerjs.com/docs/integration/).


---

# FAQ

> Short answers to the questions people ask first.

Source: https://whiskerjs.com/docs/faq/ (last updated 2026-10-26)

## Does WhiskerJS tell me whether a visitor is a bot?

No. It reports signals and integrity flags. Deciding what they mean for your site is your server’s job. See [Integrity checks](https://whiskerjs.com/docs/integrity/).

## Does it identify people?

It describes a browser setup. Two identical devices can share a visitorId; one person with two browsers has two. Still treat ids as personal data: see [Privacy](https://whiskerjs.com/docs/privacy/).

## Is it on npm?

Not yet. Build it from source; see [Getting started](https://whiskerjs.com/docs/getting-started/).

## Does it send anything anywhere?

No. It has no network code and no telemetry. You send the result yourself, with your own request.

## Why is `visitorId` null?

`crypto.subtle` is not available, usually because the page is not a secure context. Serve it over https (or `http://localhost` in development).

## Why did my visitorId change?

A stable component changed value or went from `ok` to not `ok` (or back). Compare the two structuredIds to see which group moved, then the components in that group. Common causes: a browser or driver update, fonts, language or time zone, a private window that adds canvas noise. A new `signalsVersion` or `idVersion` also gives new ids. See [Identifiers](https://whiskerjs.com/docs/identifiers/#what-changes-the-id).

## Is the id the same in a private window?

Often, but not always: some browsers add noise to canvas or WebGL in private windows, which turns those components `noisy` and changes the id. Brave and Firefox resistFingerprinting are handled by the exclusion table instead.

## Why is a component `noisy`?

It was rendered twice and the results differed, so the browser or an extension adds random noise. The value is left out on purpose.

## Why is `device_memory` unavailable in Safari or on my iPhone?

Only Chromium-based browsers offer `navigator.deviceMemory`. Elsewhere it is `unavailable` by design. The same goes for `heap_limit`, `ua_client_hints`, `ua_versions` and `keyboard_layout`.

## Why is `audio_latency` “skipped”?

Outside Safari and Android, creating an `AudioContext` without a user tap makes the browser print a console warning, and WhiskerJS writes nothing to the console. Nothing is wrong with the browser.

## I see `iframe_mismatch` in my automated tests. Is that a bug?

It has been seen under WebKit automation, where the automation layer makes the page and a new frame disagree. Under automation, also expect `automation_webdriver`. See [Integrity checks](https://whiskerjs.com/docs/integrity/#iframe_mismatch).

## How long does `collect()` take?

It is bounded: each component has 1 second and the whole call `timeoutMs` (5 seconds by default). `result.durationMs` tells you the real time on each device; measure it on the devices you care about.

## Does it slow the page down?

It runs on the main thread. Several probes (font measurement, canvas and WebGL drawing) are synchronous for a moment. Collect when you need it, for example on a form submit, rather than on every page load.

## Can I run it on the server or in Node?

It runs without errors (the tests do), but there is no browser to read, so most components are `unavailable`. Collect in the browser; on the server, use `bindingInput` and your own checks.

## Can I leave out a signal?

Yes: `collect({ exclude: ['keyboard_layout', 'permissions'] })`. Excluded stable components count as “missing” in the ids, so a different exclude list gives different ids.

## Can someone fake a result?

Yes. Everything comes from the client. The checks catch common tools and the binding stops replay, but a determined attacker can hand-craft a result. Use it as one piece of evidence. See [Integration](https://whiskerjs.com/docs/integration/#what-never-to-trust-from-the-client).

## Can I compare ids from different versions?

No. Store `idVersion` and `signalsVersion` with every id and compare only within the same pair. See [What’s new](https://whiskerjs.com/whats-new/).

## Why are some known techniques missing (WebRTC, battery, CDP detection)?

They need a network-capable API, a prompt, or console output, which the library’s rules forbid. See the roadmap in the library source (`docs/ROADMAP.md`).


---

# API reference

> Every export, option, type and default.

Source: https://whiskerjs.com/docs/api/ (last updated 2026-10-26)

> **In plain words:**
>
> There are two calls: `load()` makes an agent and `agent.collect()` makes one result. Everything else is constants and types that describe the result. `collect()` never throws.

Everything below is exported from `whiskerjs` (the package’s only entry point, ES modules). Version 0.1.0, signalsVersion 5, idVersion 2.

## Functions

### `load(options?: LoadOptions): Promise<Agent>`

Creates an agent. Does no collection work and keeps no state between `collect()` calls. Never rejects: if `options.env` cannot be used, the default environment is used.

### `agent.collect(options?: CollectOptions): Promise<CollectResult>`

Runs one collection. Never throws and never rejects. Each call is independent.

### `bindingInput(result): string`

Returns the exact text the binding digest is computed over (see [Anti-replay binding](https://whiskerjs.com/docs/integration/#the-digest)). Takes a result with its `binding`; `binding.digest` is not part of the text. Pure: usable on a server.

## Options

### `LoadOptions`

| Option | Type | Default | Meaning |
| --- | --- | --- | --- |
| `env` | `Partial<Environment>` | the real browser globals | override what the library touches; mainly for tests |
| `onResult` | `(result: CollectResult) => void \| Promise<void>` | none (off) | called once per `collect()` with a deep copy of the result; errors are swallowed, not awaited. See [Integration](https://whiskerjs.com/docs/integration/#the-onresult-hook) |

### `Environment`

| Field | Type | Default |
| --- | --- | --- |
| `window` | `WindowLike` (any Window-like object) | `globalThis` |
| `now()` | `() => number` (milliseconds) | `window.performance.now()`, else `Date.now()` |
| `setTimeout(fn, ms)` | timer | `globalThis.setTimeout` |
| `clearTimeout(handle)` | timer | `globalThis.clearTimeout` |
| `subtle` | `DigestLike` or `undefined` | `window.crypto.subtle`, else `globalThis.crypto.subtle` |

Passing `subtle: undefined` explicitly simulates a browser without Web Crypto.

### `CollectOptions`

| Option | Type | Default | Meaning |
| --- | --- | --- | --- |
| `timeoutMs` | `number` | `5000` | overall budget; clamped to 0 to 60000; not a finite number means 5000 |
| `signal` | `AbortSignal` | none | aborting resolves every pending component as `timed_out` / `aborted` and skips the iframe checks |
| `exclude` | `string[]` | `[]` | component names not to collect; they report `excluded` / `caller_excluded`; unknown names and non-strings are ignored |
| `binding` | `{ nonce: string; timestamp: number }` | none | anti-replay input from your server; see [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding) |

## Types

### `CollectResult`

| Field | Type | Meaning |
| --- | --- | --- |
| `visitorId` | `string \| null` | 32 lowercase hex characters; `null` without a digest |
| `version` | `string` | library version, `'0.1.0'` |
| `signalsVersion` | `string` | `'5'` |
| `idVersion` | `string` | `'2'` |
| `components` | `Record<string, Component>` | all 46, always present |
| `structuredId` | `string \| null` | `'2_'` then seven 12-hex parts joined by `_`; `null` without a digest |
| `integrityFlags` | `string[]` | sorted names of the checks that fired |
| `durationMs` | `number` | whole milliseconds the collection took |
| `binding` | `Binding \| null` | `null` unless `binding` was passed |

The result is plain JSON: no functions, no `undefined` values, no cycles.

### `Component`

| Field | Type | Present |
| --- | --- | --- |
| `status` | `ComponentStatus` | always |
| `value` | `string` | only when `status` is `'ok'`; at most 128 printable ASCII characters |
| `hashed` | `boolean` | only when `status` is `'ok'`; `true` when `value` is a digest |
| `ruleId` | `string` | only when `status` is not `'ok'`; matches `^[a-z0-9_]{1,32}$` |

### `ComponentStatus`

`'ok' | 'unavailable' | 'blocked' | 'noisy' | 'excluded' | 'timed_out'`. Meanings and every ruleId: [How it works](https://whiskerjs.com/docs/how-it-works/#statuses-and-reason-codes).

### `Binding`

| Field | Type | Meaning |
| --- | --- | --- |
| `nonce` | `string \| null` | your nonce; `null` when the input was invalid |
| `timestamp` | `number \| null` | your timestamp; `null` when the input was invalid |
| `digest` | `string \| null` | 32 hex characters; `null` when invalid or without a digest |
| `ruleId` | `string` (optional) | why `digest` is `null`: `invalid_binding`, `invalid_nonce`, `invalid_timestamp` or `no_digest` |

### Other types

- `Agent`: `{ collect(options?): Promise<CollectResult> }`.
- `DigestLike`: `{ digest(algorithm: string, data: ArrayBuffer): Promise<ArrayBuffer> }`, the part of `SubtleCrypto` the library uses.
- `WindowLike`: `any`; collectors read the browser only through it.
- `BrowserClass`: `'brave' | 'firefox_rfp' | 'firefox' | 'safari' | 'chromium' | 'other'`.

## Constants

| Export | Value |
| --- | --- |
| `VERSION` | `'0.1.0'` |
| `SIGNALS_VERSION` | `'5'` |
| `ID_VERSION` | `'2'` |
| `DEFAULT_TIMEOUT_MS` | `5000` |
| `COMPONENT_NAMES` | the 46 component names, sorted (frozen array) |
| `INTEGRITY_FLAG_NAMES` | the 14 flag names, sorted (frozen array) |
| `EXCLUSION_TABLE` | `Record<BrowserClass, Record<componentName, ruleId>>` (frozen) |
| `ID_GROUPS` | `Record<group, componentName[]>`, seven groups (frozen) |
| `ID_GROUP_ORDER` | `['gpu', 'audio', 'fonts', 'device', 'browser', 'locale', 'prefs']` |
| `ID_PART_LENGTH` | `12` (hex characters per structuredId part) |

Not exported but fixed: the maximum `timeoutMs` (60000), the inner timeout per collector (1000 ms), the value length limit (128 characters).

## Testing with a fake environment

```ts
import { load } from 'whiskerjs';

const agent = await load({
  env: {
    window: myFakeWindow,          // anything Window-like
    now: () => fakeClock.now(),
    subtle: globalThis.crypto.subtle,
  },
});
const result = await agent.collect();
```

The project’s own tests do this with `test/fake-browser.ts`.


---

# WhiskerJS facts

> Precise statements you can quote, each with the page that explains it. They describe WhiskerJS 0.1.0 at signalsVersion 5 and idVersion 2.

Source: https://whiskerjs.com/facts/ (last updated 2026-10-26)

> **In plain words:**
>
> WhiskerJS is a free, open-source script for web pages that reads technical characteristics of a browser and device and hands them, as one JSON object, to the website’s own server. It does not send anything anywhere itself, does not store anything, and does not decide whether a visitor is a person or a bot. It is still in development and not yet on npm.

## Identity

| Fact | Value |
| --- | --- |
| Name | WhiskerJS |
| What it is | A browser collector: it reads device and browser signals in the page and returns one plain JSON result |
| What it is not | A scoring engine, a bot verdict or a tracking service |
| Licence | Apache License 2.0 |
| Library version | 0.1.0 |
| Signal set | signalsVersion 5 |
| Identifier derivation | idVersion 2 |
| Language and format | TypeScript, compiled to ES2020 modules with `.d.ts` types |
| Runtime dependencies | None |
| Release status | In development. Not yet published to npm or any other registry: build it from source; the npm package is coming |
| Website | [whiskerjs.com](https://whiskerjs.com/) |

## What one call returns

- **46 components** (signals). Every component is always present with one of six statuses: `ok`, `unavailable`, `blocked`, `noisy`, `excluded`, `timed_out`; a non-ok component carries a short `ruleId` saying why. See [Signals](https://whiskerjs.com/docs/signals/) and [How it works](https://whiskerjs.com/docs/how-it-works/#statuses-and-reason-codes).
- **37 stable components** make up the `visitorId`, a 128-bit hash written as 32 lowercase hex characters. The other **9** are reported but kept out of both identifiers because they change too easily (zoom, taskbar, permissions, keyboard layout, voices, versions, audio latency, canvas readback, content blockers). See [Identifiers](https://whiskerjs.com/docs/identifiers/).
- **7 groups** (`gpu`, `audio`, `fonts`, `device`, `browser`, `locale`, `prefs`) form the `structuredId`: the idVersion followed by one 48-bit part (12 hex characters) per group, so two results can be compared group by group. See [Identifiers](https://whiskerjs.com/docs/identifiers/#structuredid).
- **14 integrity flags**: signs of automation or tampering, such as `automation_webdriver` or `prototype_lie`. They are hints for the server, never a verdict, and each has documented false positives. See [Integrity checks](https://whiskerjs.com/docs/integrity/).
- An optional **anti-replay binding**: the server’s nonce and timestamp, echoed with a digest over the whole result. It stops replay of an old result; it is not a signature. See [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding).
- `durationMs`, the time the collection took, and the three version strings `version`, `signalsVersion` and `idVersion`.

## Limits and timing

| Limit | Value |
| --- | --- |
| Inner timeout per component | 1000 ms |
| Overall budget (`timeoutMs`) | default 5000 ms, clamped to 0 to 60000 ms |
| Value length | at most 128 printable ASCII characters; longer or non-ASCII values are hashed |
| Digest | first 128 bits of SHA-256, as 32 lowercase hex characters |
| Errors | `collect()` never throws and never rejects |
| Secure context | needed for Web Crypto; without it both ids are `null` |

## Privacy stance

What the library itself never does, as enforced by its test suite (a recording fake browser and a scan of the compiled source):

- **No network**: no fetch, XHR, `sendBeacon`, WebSocket or EventSource, no element with a network source, no telemetry.
- **No storage**: no cookies, localStorage, sessionStorage or IndexedDB; each `collect()` starts from nothing.
- **No permission prompts**: permission states are read only with `navigator.permissions.query`, which never prompts. No WebRTC addresses, battery, geolocation or media device labels.
- **No console output.**
- **No raw large values**: images, audio samples, font lists, voices, codecs, plugins, WebGL parameters, WebGPU details and permission states leave the page only as a digest.
- **Privacy browsers are not worked around**: under Brave and Firefox resistFingerprinting (also Tor Browser) the randomised or normalised components are not collected and report `excluded`.

Device signals can still be personal data: the site that uses WhiskerJS decides the purpose, the legal basis, the retention and the notice. See [Privacy](https://whiskerjs.com/docs/privacy/) and [Privacy and compliance](https://whiskerjs.com/privacy/) (informational, not legal advice).

## Measurement status

- **No accuracy, stability or uniqueness figures are published.** The head-to-head measurement against other libraries has not run yet, so WhiskerJS makes no claim to be more accurate, more stable or more unique than any other library.
- **Early lab observation**, an early small sample, not a benchmark: at signalsVersion 1, four device and browser pairs (Mac Chrome, 4 runs; Mac Safari, 2; iPhone Chrome, 3; iPhone Safari, 3) each kept one identifier across their runs, and the four identifiers differed. `device_memory` was `unavailable` on Safari and iOS, by design.

## Credits

Two small parts are adapted from MIT-licensed projects with their notices kept: the Math operations from FingerprintJS 5.3.0 and the media MIME lists from fpscanner 1.0.8. Other techniques are credited as ideas, not code. See the [comparison](https://whiskerjs.com/compare/).

## How to cite

“WhiskerJS 0.1.0 (signalsVersion 5, idVersion 2), an open-source (Apache-2.0) browser collector of 46 device signals, [https://whiskerjs.com/](https://whiskerjs.com/)”. When a fact changes, this page and the [changelog](https://whiskerjs.com/whats-new/) change with it; compare ids only within the same signalsVersion and idVersion.


---

# Integration guides

> Add WhiskerJS to your page in the framework you use, then check its result on your server. Every code sample here was built and run.

Source: https://whiskerjs.com/guides/ (last updated 2026-10-26)

> **In plain words:**
>
> WhiskerJS runs in your web page and gives you one JSON object describing the browser and device. These guides show how to get that object at the right moment (when someone signs in, signs up or pays), send it to your server with the request you already make, and check on the server that it is fresh and was not changed on the way. What you then decide with it is up to your own rules.

## How the pieces fit

Every guide uses the same small contract between the page and your server, so you can mix any browser guide with any server guide.

```text
browser                                   your server
-------                                   -----------
GET /api/whisker-nonce            ->      make a nonce (128 random bits) and note the time,
                                  <-      store both for this session: { nonce, timestamp }
user presses "Sign in"
collect({ timeoutMs: 3000, binding })     (in the browser, 46 signals, no network)
POST /api/login { email, password, device }
                                  ->      verify the binding: nonce known, unused, recent,
                                          versions and component names as shipped, digest matches
                                  <-      then your own decision (password, rules, history)
```

| Endpoint | Method | Body | Answer |
| --- | --- | --- | --- |
| `/api/whisker-nonce` | GET | none | `{ "nonce": "<32 hex>", "timestamp": <ms> }` |
| `/api/login` (your existing form post) | POST | your fields plus `device`: the WhiskerJS result | your usual answer; a refused binding gives an error code such as `unknown_or_used_nonce` or `digest_mismatch` |

The names are examples: use your own routes. The only rule is that the nonce endpoint and the form post belong to the same session, so that a nonce issued to one visitor cannot be used by another.

## Browser side

- [Plain JavaScript](https://whiskerjs.com/guides/javascript/): The dist files as ES modules, or a bundler import.
- [React](https://whiskerjs.com/guides/react/): A login form component that collects on submit.
- [Next.js](https://whiskerjs.com/guides/nextjs/): A client component plus route handlers in the same app.
- [Vue](https://whiskerjs.com/guides/vue/): A single-file component with script setup.
- [Svelte](https://whiskerjs.com/guides/svelte/): A Svelte 5 component with runes.
- [Astro](https://whiskerjs.com/guides/astro/): A client script in an Astro page.

## Server side

- [Node](https://whiskerjs.com/guides/verify-node/): Uses the library's own bindingInput and COMPONENT_NAMES.
- [Go](https://whiskerjs.com/guides/verify-go/): Standard library only, numbers kept exact.
- [PHP](https://whiskerjs.com/guides/verify-php/): Core PHP, nonces kept in the session.
- [Python](https://whiskerjs.com/guides/verify-python/): Standard library only.

## Rules every guide follows

- **Collect at the moment you need it.** On submit of a login, sign-up or checkout form, not on every page view. `collect()` takes up to `timeoutMs` (the guides use 3000 ms) and briefly works on the main thread.
- **Only in the browser.** WhiskerJS reads the browser it runs in. In frameworks that render on the server (Next.js, Nuxt, SvelteKit, Astro), call it only from an event handler or an effect that runs in the browser, never while rendering.
- **A secure context.** Hashing uses Web Crypto, which browsers offer only on https pages (and on `http://localhost` while you develop). Without it `visitorId` and `structuredId` are `null` and large components report `unavailable` with ruleId `no_digest`.
- **`collect()` never throws and never rejects.** You do not need a try block around it. You do need one around your own `fetch` calls, which can fail like any request.
- **Send the result unchanged.** The binding digest covers every field, so do not trim or reorder it before it reaches the server check. It is about 4 KB of JSON.
- **The server decides.** WhiskerJS gives signals and integrity flags, not verdicts. A valid binding proves the result is fresh and unchanged since it was made, not that the browser told the truth. See [what never to trust from the client](https://whiskerjs.com/docs/integration/#what-never-to-trust-from-the-client).

## Install (all guides)

WhiskerJS is not on npm yet; the npm package is coming. Build it from source and install the tarball, or copy the built files:

```sh
cd whiskerjs                 # the WhiskerJS source folder
pnpm install && pnpm build   # writes dist/
pnpm pack                    # writes whiskerjs-0.1.0.tgz
cd ../my-app
npm install ../whiskerjs/whiskerjs-0.1.0.tgz
```

[Getting started](https://whiskerjs.com/docs/getting-started/) covers the build in more detail.

## How these guides were tested

Each code sample on these pages was run on 2026-10-26 with WhiskerJS 0.1.0 (signalsVersion 5, idVersion 2), built from source:

- every browser sample was built with its framework, served next to the server sample from the matching guide, and driven by headless Chromium 140 (Playwright 1.55.0): it filled in the form, submitted it, and checked that the server accepted the binding and refused the same result when it was sent a second time;
- every server sample was also run against three real results made by headless Chromium, Firefox and WebKit, and refused a result with one changed component value, a reused nonce and a result older than 60 seconds.

Each page names the runtime versions it was tested with.

## Questions and answers

### Which guide do I need?

Usually two: one for the browser side (the framework your login or checkout page uses) and one for the server side (the language your API is written in). The two talk through two endpoints that every guide uses the same way.

### Can I use WhiskerJS without the anti-replay binding?

Yes. Leave out the binding option and the result has binding: null. You then lose the protection against a recorded result being sent again later, so the server guides recommend using it for logins, sign-ups and payments.

### Is WhiskerJS on npm?

Not yet; the npm package is coming. Until then you build it from source, run pnpm pack and install the tarball it writes, or serve the files in dist/ as ES modules.

## Related pages

- [Getting started](https://whiskerjs.com/docs/getting-started/): Build the library and collect a first result.
- [Integration reference](https://whiskerjs.com/docs/integration/): Sending results, storing ids, server checks.
- [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding): The nonce, the timestamp and the digest in detail.
- [API reference](https://whiskerjs.com/docs/api/): Every export, option and type.


---

# Astro

> An Astro page whose bundled script collects on submit; the page itself stays static HTML.

Source: https://whiskerjs.com/guides/astro/ (last updated 2026-10-26)

> **In plain words:**
>
> An Astro page is HTML made on the server or at build time. The small script at the bottom is the only part that runs in the visitor’s browser: when the form is submitted it gets a one-time code from your server, lets WhiskerJS read the browser and posts the result with the form.

## Install: build from source

WhiskerJS is not on npm yet; the npm package is coming. Build it and install the tarball:

```sh
cd whiskerjs
pnpm install && pnpm build && pnpm pack    # writes whiskerjs-0.1.0.tgz
cd ../my-astro-site
npm install ../whiskerjs/whiskerjs-0.1.0.tgz
```

## The page

`src/pages/index.astro`:

```astro
---
// Rendered on the server or at build time: no WhiskerJS code runs here.
---
<html lang="en">
  <head><meta charset="utf-8" /><title>Sign in</title></head>
  <body>
    <form id="login">
      <label>Email <input name="email" type="email" required /></label>
      <label>Password <input name="password" type="password" required /></label>
      <button type="submit">Sign in</button>
      <output id="status"></output>
    </form>

    <script>
      // Astro bundles this script and runs it in the browser only.
      import { load } from 'whiskerjs';

      const agentReady = load(); // cheap: no collection work happens yet
      const form = document.getElementById('login') as HTMLFormElement;
      const status = document.getElementById('status') as HTMLOutputElement;

      form.addEventListener('submit', async (event) => {
        event.preventDefault();
        const data = new FormData(form);
        // A fresh nonce from your server, then collect. collect() never throws.
        const binding = await (await fetch('/api/whisker-nonce')).json();
        const device = await (await agentReady).collect({ timeoutMs: 3000, binding });
        const response = await fetch('/api/login', {
          method: 'POST',
          headers: { 'content-type': 'application/json' },
          body: JSON.stringify({ email: data.get('email'), password: data.get('password'), device }),
        });
        status.textContent = response.ok ? 'Signed in' : `Refused (${response.status})`;
      });
    </script>
  </body>
</html>
```

## How it works

- **The frontmatter** (between the `---` lines) runs on the server or at build time. Nothing from WhiskerJS belongs there: there is no browser to read.
- **The `<script>`** is processed by Astro: TypeScript is stripped, `import { load } from 'whiskerjs'` is resolved from `node_modules`, and the result is bundled into one module under `/_astro/` that the browser loads. It runs once per page load, in the browser only.
- **The binding.** `/api/whisker-nonce` returns `{ nonce, timestamp }`, passed to `collect({ binding })`; your server checks `result.binding`: [Node](https://whiskerjs.com/guides/verify-node/), [Go](https://whiskerjs.com/guides/verify-go/), [PHP](https://whiskerjs.com/guides/verify-php/), [Python](https://whiskerjs.com/guides/verify-python/).
- **Errors.** `collect()` never throws or rejects. Add a `try` block around the `fetch` calls if you want a message on network errors, as the other guides do.

## Things to know

- **Static output needs a backend.** With Astro’s default static build the endpoints live in your existing server. The tested setup served the built `dist/` folder from the [Node server](https://whiskerjs.com/guides/verify-node/#a-complete-server).
- **Content Security Policy.** The bundled script is a normal same-origin module file, and WhiskerJS makes no network request, so `script-src 'self'` is enough for it.
- **Secure context.** https, or `localhost` with `astro dev` or `astro preview`.

## Tested

Tested with WhiskerJS 0.1.0 (signalsVersion 5, idVersion 2) and Astro 7.4.1 on 2026-10-26: built with `astro build`, the `dist/` folder served by the [Node server](https://whiskerjs.com/guides/verify-node/#a-complete-server) and submitted in headless Chromium 140 (Playwright 1.55.0). The server accepted the binding and refused the same result sent a second time.

## Questions and answers

### Do I need a UI framework island?

No. A plain script tag in the .astro file is enough. Astro bundles it as a module and runs it in the browser; the rest of the page stays static HTML.

### Where do the nonce and login endpoints go in a static Astro site?

A static build has no server of its own, so they live in your existing backend (any of the server guides). With an Astro server adapter you can also write them as Astro endpoints.

### Can I use is:inline?

Not with import 'whiskerjs': an inline script is not bundled, so the bare import cannot be resolved. Either let Astro bundle the script, or serve the dist files and import them by URL as in the plain JavaScript guide.

## Related pages

- [Plain JavaScript](https://whiskerjs.com/guides/javascript/): The same script without a build step.
- [Verify in Node](https://whiskerjs.com/guides/verify-node/): The server this page was tested against.
- [All integration guides](https://whiskerjs.com/guides/): The page-to-server contract.
- [Getting started](https://whiskerjs.com/docs/getting-started/): Build WhiskerJS from source.


---

# Plain JavaScript

> No framework: load WhiskerJS as ES modules or through a bundler, collect when the form is submitted, send the result with the form.

Source: https://whiskerjs.com/guides/javascript/ (last updated 2026-10-26)

> **In plain words:**
>
> You copy the WhiskerJS files next to your page, import them with one line, and when the visitor presses the submit button you ask your server for a one-time code, let WhiskerJS read the browser, and send its answer together with the form. Nothing else on the page changes.

## Install: build from source

WhiskerJS is not on npm yet; the npm package is coming. Build it from source:

```sh
cd whiskerjs                 # the WhiskerJS source folder
pnpm install && pnpm build   # writes dist/: ES2020 modules and .d.ts files
```

Then pick one of two ways.

- **As plain files.** Copy `dist/*.js` and `dist/collectors/*.js` to your static files, keeping the folder layout (for example to `public/vendor/whiskerjs/`). The `.d.ts` files are only for editors and type checkers; leave them out if you like. This is how the [live demo](https://whiskerjs.com/demo/) runs it.
- **With a bundler.** Run `pnpm pack` in the WhiskerJS folder and install the tarball in your project with `npm install ../whiskerjs/whiskerjs-0.1.0.tgz`. Your bundler then resolves `import { load } from 'whiskerjs'`.

There are no runtime dependencies.

## The page, as ES modules

A complete sign-in page. It assumes the two endpoints described in the [guides overview](https://whiskerjs.com/guides/#how-the-pieces-fit): `GET /api/whisker-nonce` and your existing `POST /api/login`.

```html
<!doctype html>
<html lang="en">
<head><meta charset="utf-8"><title>Sign in</title></head>
<body>
  <form id="login">
    <label>Email <input name="email" type="email" required></label>
    <label>Password <input name="password" type="password" required></label>
    <button type="submit">Sign in</button>
  </form>
  <output id="status"></output>

  <script type="module">
    import { load } from '/vendor/whiskerjs/index.js';

    const agentReady = load(); // cheap: no collection work happens yet
    const form = document.getElementById('login');
    const status = document.getElementById('status');

    form.addEventListener('submit', async (event) => {
      event.preventDefault();
      try {
        // 1. A fresh nonce and timestamp from your server.
        const binding = await (await fetch('/api/whisker-nonce')).json();
        // 2. Collect at the moment you need it. collect() never throws or rejects.
        const agent = await agentReady;
        const device = await agent.collect({ timeoutMs: 3000, binding });
        // 3. Send it with the request you already make.
        const response = await fetch('/api/login', {
          method: 'POST',
          headers: { 'content-type': 'application/json' },
          body: JSON.stringify({ email: form.email.value, password: form.password.value, device }),
        });
        status.textContent = response.ok ? 'Signed in' : `Refused (${response.status})`;
      } catch {
        status.textContent = 'Network error, please try again';
      }
    });
  </script>
</body>
</html>
```

What happens on submit:

1. **Nonce.** The page asks your server for a fresh `{ nonce, timestamp }`. The server stores both for this session; see the [Node](https://whiskerjs.com/guides/verify-node/), [Go](https://whiskerjs.com/guides/verify-go/), [PHP](https://whiskerjs.com/guides/verify-php/) or [Python](https://whiskerjs.com/guides/verify-python/) guide.
2. **Collect.** `collect({ timeoutMs: 3000, binding })` reads the 46 components, runs the integrity checks, derives the ids and adds `result.binding` with your nonce, your timestamp and a digest over the whole result. It never throws and never rejects; a component that fails reports its own status instead.
3. **Send.** The result goes in the body of the request you were sending anyway, as the `device` field. There is no WhiskerJS endpoint and no extra request.

The `try` block is for the two `fetch` calls, which can fail like any request.

## The same page with a bundler

With the tarball installed, only the import changes. The script moves to its own file:

```js
import { load } from 'whiskerjs';

const agentReady = load(); // cheap: no collection work happens yet
const form = document.getElementById('login');
const status = document.getElementById('status');

form.addEventListener('submit', async (event) => {
  event.preventDefault();
  try {
    // 1. A fresh nonce and timestamp from your server.
    const binding = await (await fetch('/api/whisker-nonce')).json();
    // 2. Collect at the moment you need it. collect() never throws or rejects.
    const agent = await agentReady;
    const device = await agent.collect({ timeoutMs: 3000, binding });
    // 3. Send it with the request you already make.
    const response = await fetch('/api/login', {
      method: 'POST',
      headers: { 'content-type': 'application/json' },
      body: JSON.stringify({ email: form.email.value, password: form.password.value, device }),
    });
    status.textContent = response.ok ? 'Signed in' : `Refused (${response.status})`;
  } catch {
    status.textContent = 'Network error, please try again';
  }
});
  
```

and the page loads it with `<script type="module" src="/src/main.js"></script>` (the path your bundler expects).

## Things to know

- **Secure context.** Serve the page over https, or from `http://localhost` while you develop. Hashing uses `crypto.subtle`, which browsers only offer there; without it `visitorId` and `structuredId` are `null` and large components are `unavailable` with ruleId `no_digest`.
- **A body element.** Several probes add hidden elements to `document.body` for a moment and remove them before `collect()` resolves. A module script runs after the document is parsed, so the body exists; if you call `collect()` from a script in the `<head>` without `type="module"` or `defer`, wait for `DOMContentLoaded`.
- **Content Security Policy.** WhiskerJS makes no network request and creates no worker, so it needs nothing beyond `script-src` for your own files. Its integrity checks add one `about:blank` iframe without a `src` for a moment.
- **When to collect.** On the action you protect (sign-in, sign-up, checkout), not on every page view. The time it takes is in `result.durationMs`; the overall budget is `timeoutMs`.
- **What the result contains.** See [Getting started](https://whiskerjs.com/docs/getting-started/#4-read-the-result) and [Signals](https://whiskerjs.com/docs/signals/).

## Tested

Tested with WhiskerJS 0.1.0 (signalsVersion 5, idVersion 2) and headless Chromium 140 (Playwright 1.55.0) on 2026-10-26: the ES module page served by the [Node server](https://whiskerjs.com/guides/verify-node/#a-complete-server), and the bundler version built with Vite 8.3.5. In both, the server accepted the binding and refused the same result sent a second time.

## Questions and answers

### Do I need a bundler?

No. The dist folder is plain ES2020 modules with relative imports, so a browser can load index.js directly with a script of type module. A bundler only changes the import line.

### Can I load it from a CDN?

No CDN serves WhiskerJS. Serve the files from your own origin, which also keeps the page free of third-party requests.

### Why is the agent created before the click?

load() is cheap: it only picks the browser objects, the clock and Web Crypto, and does no collection work. Creating it early means the submit handler only waits for collect().

### What if the nonce request fails?

Then fetch throws and the catch block reports a network error. collect() itself never throws, so the try block is only there for your own requests.

## Related pages

- [Verify in Node](https://whiskerjs.com/guides/verify-node/): The server this page was tested against.
- [All integration guides](https://whiskerjs.com/guides/): The shared contract between page and server.
- [Getting started](https://whiskerjs.com/docs/getting-started/): Build the library from source.
- [How it works](https://whiskerjs.com/docs/how-it-works/): What happens inside collect().
- [Live demo](https://whiskerjs.com/demo/): The same dist files, running in your browser.


---

# Next.js

> A 'use client' login form that collects on submit, plus two route handlers in the same app that issue the nonce and check the binding.

Source: https://whiskerjs.com/guides/nextjs/ (last updated 2026-10-26)

> **In plain words:**
>
> In Next.js the sign-in form is a client component: it is drawn on the server first, then comes alive in the browser. WhiskerJS must only run in the browser part, so the form calls it only when the visitor presses the button. Two small route handlers in the same app hand out the one-time code and check the result when the form arrives.

## Install: build from source

WhiskerJS is not on npm yet; the npm package is coming. Build it and install the tarball:

```sh
cd whiskerjs
pnpm install && pnpm build && pnpm pack    # writes whiskerjs-0.1.0.tgz
cd ../my-next-app
npm install ../whiskerjs/whiskerjs-0.1.0.tgz
```

## The client component

`components/LoginForm.tsx`:

```tsx
'use client';

import { useState, type FormEvent } from 'react';
import { load, type Agent } from 'whiskerjs';

// One agent per page, created on first use. load() is cheap and keeps no state.
let agent: Promise<Agent> | undefined;
const getAgent = () => (agent ??= load());

export function LoginForm() {
  const [status, setStatus] = useState('');
  const [busy, setBusy] = useState(false);

  async function onSubmit(event: FormEvent<HTMLFormElement>) {
    event.preventDefault();
    const form = new FormData(event.currentTarget);
    setBusy(true);
    try {
      // A fresh nonce from your server, then collect. collect() never throws.
      const binding = await (await fetch('/api/whisker-nonce')).json();
      const device = await (await getAgent()).collect({ timeoutMs: 3000, binding });
      const response = await fetch('/api/login', {
        method: 'POST',
        headers: { 'content-type': 'application/json' },
        body: JSON.stringify({ email: form.get('email'), password: form.get('password'), device }),
      });
      setStatus(response.ok ? 'Signed in' : `Refused (${response.status})`);
    } catch {
      setStatus('Network error, please try again');
    } finally {
      setBusy(false);
    }
  }

  return (
    <form onSubmit={onSubmit}>
      <label>Email <input name="email" type="email" required /></label>
      <label>Password <input name="password" type="password" required /></label>
      <button type="submit" disabled={busy}>Sign in</button>
      <output id="status">{status}</output>
    </form>
  );
}
```

`app/page.tsx` stays a server component and only renders the form:

```tsx
import { LoginForm } from '../components/LoginForm';

// A server component: it renders the form; WhiskerJS runs only inside LoginForm, in the browser.
export default function Page() {
  return <LoginForm />;
}
```

### Never during server rendering

`'use client'` does not mean “browser only”: Next.js renders client components on the server too, to produce the first HTML. Code at the top of the component body runs there. That is why `load()` and `collect()` appear only inside `onSubmit`, which runs when the visitor submits the form in the browser. The module-level `agent` variable is only assigned inside that handler, so it stays empty on the server.

If you ever need to collect without a user action, do it in a `useEffect`, which also runs only in the browser.

## The route handlers

Both import `lib/whisker-binding.ts`, the Node module from [Verify in Node](https://whiskerjs.com/guides/verify-node/#the-verification-module), unchanged. WhiskerJS’s `bindingInput` and `COMPONENT_NAMES` are plain code with no browser dependency, so they work in a route handler.

`app/api/whisker-nonce/route.ts` issues a nonce for this browser’s session (a random `sid` cookie here; use your own session if you have one):

```ts
import { randomBytes } from 'node:crypto';
import { cookies } from 'next/headers';
import { issueNonce } from '../../../lib/whisker-binding';

export async function GET() {
  const jar = await cookies();
  let sid = jar.get('sid')?.value;
  if (!sid) {
    sid = randomBytes(16).toString('hex');
    jar.set('sid', sid, { httpOnly: true, sameSite: 'lax', path: '/' });
  }
  return Response.json(issueNonce(sid));
}
```

`app/api/login/route.ts` verifies the binding before anything else:

```ts
import { cookies } from 'next/headers';
import { verifyBinding } from '../../../lib/whisker-binding';

export async function POST(request: Request) {
  const sid = (await cookies()).get('sid')?.value ?? '';
  const body = await request.json().catch(() => null);
  const verdict = verifyBinding(body?.device, sid);
  if (!verdict.ok) return Response.json({ error: verdict.reason }, { status: 400 });
  // Fresh and unchanged since collection. Now check the password and use
  // body.device as one piece of evidence among others.
  return Response.json({ visitorId: body.device.visitorId, flags: body.device.integrityFlags });
}
```

### Where the nonces live

`whisker-binding.ts` keeps issued nonces in a `Map`. That is correct only when one long-running process handles every request, as with a single `next start`. On a serverless platform, or with several instances, the nonce request and the login may reach different processes: keep the nonces in a shared store (your database or a cache) with an expiry of about a minute, and delete each one in the same step that reads it.

## Things to know

- **Secure context.** `next dev` on `localhost` and any https deployment work. On plain http elsewhere the ids are `null`.
- **TypeScript settings.** Next.js creates a `tsconfig.json` with `strict: false`; the samples type-check with it as generated.
- **The result is evidence, not a verdict.** After the binding passes, use the components, ids and flags in your own rules. See [Integration](https://whiskerjs.com/docs/integration/#recommended-server-checks).

## Tested

Tested with WhiskerJS 0.1.0 (signalsVersion 5, idVersion 2), Next.js 16.4.3 (App Router, Turbopack build), React 19.3.1 and TypeScript 5.9.3 on 2026-10-26: built with `next build`, run with `next start` on Node 22.18 and submitted in headless Chromium 140 (Playwright 1.55.0). The route handlers accepted the binding and refused the same result sent a second time.

## Questions and answers

### Is 'use client' enough to keep WhiskerJS off the server?

No. Client components are still rendered on the server for the first HTML. What keeps WhiskerJS in the browser is calling load() and collect() only from an event handler or an effect, as this component does.

### Can I store nonces in a Map in a route handler?

Only when one long-running Node process serves every request, as with a single next start. On serverless or several instances the nonce request and the login can reach different processes, so keep nonces in a shared store such as your database or a cache, with expiry.

### Does this work with the Pages Router?

The form component works the same in the Pages Router without the 'use client' line. The server checks then go in API routes; this guide was tested with the App Router only.

## Related pages

- [React](https://whiskerjs.com/guides/react/): The same form explained line by line.
- [Verify in Node](https://whiskerjs.com/guides/verify-node/): The whisker-binding.ts module the route handlers import.
- [All integration guides](https://whiskerjs.com/guides/): The page-to-server contract.
- [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding): What the digest proves and what it does not.


---

# React

> A login form component that creates one WhiskerJS agent on first use and collects when the form is submitted.

Source: https://whiskerjs.com/guides/react/ (last updated 2026-10-26)

> **In plain words:**
>
> The component below is an ordinary sign-in form. When it is submitted it asks your server for a one-time code, lets WhiskerJS read the browser, and sends the result along with the email and password. WhiskerJS is loaded once and only in the browser, so nothing changes about how your app renders.

## Install: build from source

WhiskerJS is not on npm yet; the npm package is coming. Build it and install the tarball into your React project:

```sh
cd whiskerjs
pnpm install && pnpm build && pnpm pack    # writes whiskerjs-0.1.0.tgz
cd ../my-react-app
npm install ../whiskerjs/whiskerjs-0.1.0.tgz
```

The package ships its own type definitions; no `@types` package is needed.

## The component

```tsx
import { useState, type FormEvent } from 'react';
import { load, type Agent } from 'whiskerjs';

// One agent per page, created on first use. load() is cheap and keeps no state.
let agent: Promise<Agent> | undefined;
const getAgent = () => (agent ??= load());

export function LoginForm() {
  const [status, setStatus] = useState('');
  const [busy, setBusy] = useState(false);

  async function onSubmit(event: FormEvent<HTMLFormElement>) {
    event.preventDefault();
    const form = new FormData(event.currentTarget);
    setBusy(true);
    try {
      // A fresh nonce from your server, then collect. collect() never throws.
      const binding = await (await fetch('/api/whisker-nonce')).json();
      const device = await (await getAgent()).collect({ timeoutMs: 3000, binding });
      const response = await fetch('/api/login', {
        method: 'POST',
        headers: { 'content-type': 'application/json' },
        body: JSON.stringify({ email: form.get('email'), password: form.get('password'), device }),
      });
      setStatus(response.ok ? 'Signed in' : `Refused (${response.status})`);
    } catch {
      setStatus('Network error, please try again');
    } finally {
      setBusy(false);
    }
  }

  return (
    <form onSubmit={onSubmit}>
      <label>Email <input name="email" type="email" required /></label>
      <label>Password <input name="password" type="password" required /></label>
      <button type="submit" disabled={busy}>Sign in</button>
      <output id="status">{status}</output>
    </form>
  );
}
```

And where it is mounted, here in a Vite app:

```tsx
import { createRoot } from 'react-dom/client';
import { LoginForm } from './LoginForm';

createRoot(document.getElementById('root')!).render(<LoginForm />);
```

## How it works

- **One agent, created on first use.** `getAgent()` keeps the promise from the first `load()` call and returns it afterwards. `load()` does no collection work and keeps no state between `collect()` calls, so one agent per page is enough. It lives outside the component so re-renders do not create new agents.
- **Collect in the handler, not in render.** `collect()` reads the browser and adds hidden elements to the page for a moment, so it belongs in an event handler (or an effect), never in the render function.
- **The binding.** `/api/whisker-nonce` returns `{ nonce, timestamp }`, which goes straight into `collect({ binding })`. The result’s `binding` then carries both and a digest over the whole result. The server checks it; see [Verify in Node](https://whiskerjs.com/guides/verify-node/) or the [Go](https://whiskerjs.com/guides/verify-go/), [PHP](https://whiskerjs.com/guides/verify-php/) and [Python](https://whiskerjs.com/guides/verify-python/) guides.
- **Errors.** `collect()` never throws or rejects. The `try` block covers the two `fetch` calls; `finally` re-enables the button.
- **Send it unchanged.** `device` is the whole result object. Do not pick fields out of it before sending if the server verifies the binding: the digest covers every field.

## Things to know

- **Secure context.** On a plain http page other than `localhost`, Web Crypto is missing and the ids are `null`. The Vite dev server on `localhost` works.
- **Disable the button while collecting.** A double click would otherwise fetch two nonces and send two results; the `busy` state prevents that.
- **Preloading.** If you want the agent ready before the first submit, call `getAgent()` from a `useEffect` in the component. It stays cheap either way.
- **What you do with the answer.** The server’s verdict comes from your own rules. See [Integration](https://whiskerjs.com/docs/integration/#recommended-server-checks) for what to check beyond the binding.

## Tested

Tested with WhiskerJS 0.1.0 (signalsVersion 5, idVersion 2), React 19.3.1, Vite 8.3.5 and TypeScript 5.9.3 (strict) on 2026-10-26: built with `tsc --noEmit && vite build`, served by the [Node server](https://whiskerjs.com/guides/verify-node/#a-complete-server) and submitted in headless Chromium 140 (Playwright 1.55.0). The server accepted the binding and refused the same result sent a second time.

## Questions and answers

### Should I call collect() in useEffect on page load?

Usually not. Collect on the action you protect, such as the submit of a login or checkout form. The nonce then belongs to that action and the result is fresh when the server checks it.

### Does React StrictMode cause two collections?

Not with this component. StrictMode runs effects and render functions twice in development, but collect() is only called from the submit handler, which runs once per submit.

### Does this work with server-side rendering?

Yes. load() and collect() are only called inside the submit handler, which never runs on the server. For Next.js see the Next.js guide.

### Where do the types come from?

The tarball contains .d.ts files, so Agent, CollectResult and the option types are available from 'whiskerjs' with no extra package.

## Related pages

- [Next.js](https://whiskerjs.com/guides/nextjs/): The same component as a client component, with route handlers.
- [Verify in Node](https://whiskerjs.com/guides/verify-node/): The server side of the binding.
- [All integration guides](https://whiskerjs.com/guides/): The page-to-server contract.
- [API reference](https://whiskerjs.com/docs/api/): load(), collect() and their options.


---

# Svelte

> A Svelte 5 component with runes that collects on submit and sends the result with the form.

Source: https://whiskerjs.com/guides/svelte/ (last updated 2026-10-26)

> **In plain words:**
>
> A Svelte sign-in form that, on submit, gets a one-time code from your server, lets WhiskerJS read the browser and posts the result with the email and password. WhiskerJS is created the first time someone submits and only runs in the browser.

## Install: build from source

WhiskerJS is not on npm yet; the npm package is coming. Build it and install the tarball:

```sh
cd whiskerjs
pnpm install && pnpm build && pnpm pack    # writes whiskerjs-0.1.0.tgz
cd ../my-svelte-app
npm install ../whiskerjs/whiskerjs-0.1.0.tgz
```

## The component

`src/LoginForm.svelte`:

```svelte
<script lang="ts">
  import { load, type Agent } from 'whiskerjs';

  let email = $state('');
  let password = $state('');
  let status = $state('');
  let busy = $state(false);

  // One agent per page, created on first use. load() is cheap and keeps no state.
  let agent: Promise<Agent> | undefined;

  async function onsubmit(event: SubmitEvent) {
    event.preventDefault();
    busy = true;
    try {
      // A fresh nonce from your server, then collect. collect() never throws.
      const binding = await (await fetch('/api/whisker-nonce')).json();
      const device = await (await (agent ??= load())).collect({ timeoutMs: 3000, binding });
      const response = await fetch('/api/login', {
        method: 'POST',
        headers: { 'content-type': 'application/json' },
        body: JSON.stringify({ email, password, device }),
      });
      status = response.ok ? 'Signed in' : `Refused (${response.status})`;
    } catch {
      status = 'Network error, please try again';
    } finally {
      busy = false;
    }
  }
</script>

<form {onsubmit}>
  <label>Email <input bind:value={email} name="email" type="email" required /></label>
  <label>Password <input bind:value={password} name="password" type="password" required /></label>
  <button type="submit" disabled={busy}>Sign in</button>
  <output id="status">{status}</output>
</form>
```

Mounted in `src/main.ts`:

```ts
import { mount } from 'svelte';
import LoginForm from './LoginForm.svelte';

mount(LoginForm, { target: document.getElementById('app')! });
```

## How it works

- **`onsubmit`** is the Svelte 5 event attribute; `event.preventDefault()` stops the browser’s own form post so the handler can add the device result.
- **Runes.** `$state` holds the form fields, the status line and the `busy` flag. The agent is a plain variable, created by the first submit (`agent ??= load()`).
- **The binding.** The nonce endpoint returns `{ nonce, timestamp }`, passed to `collect({ binding })`. The result’s `binding` carries both and a digest over the whole result, which your server checks: [Node](https://whiskerjs.com/guides/verify-node/), [Go](https://whiskerjs.com/guides/verify-go/), [PHP](https://whiskerjs.com/guides/verify-php/), [Python](https://whiskerjs.com/guides/verify-python/).
- **Errors.** `collect()` never throws or rejects. The `try` block covers the `fetch` calls.

## Things to know

- **SvelteKit and server rendering.** Component script code runs on the server during rendering; event handlers do not. Keep WhiskerJS calls in handlers, or in `onMount` if you need to collect without a user action.
- **Secure context.** https, or `localhost` with the Vite dev server.
- **Send the result unchanged** if the server verifies the binding.

## Tested

Tested with WhiskerJS 0.1.0 (signalsVersion 5, idVersion 2), Svelte 5.57.2, Vite 8.3.5 with @sveltejs/vite-plugin-svelte 7.3.1, and svelte-check 4.7.7 on 2026-10-26: built with `svelte-check && vite build`, served by the [Node server](https://whiskerjs.com/guides/verify-node/#a-complete-server) and submitted in headless Chromium 140 (Playwright 1.55.0). The server accepted the binding and refused the same result sent a second time.

## Questions and answers

### Does this work in SvelteKit?

The component does: load() and collect() are only called from the submit handler, which runs in the browser. SvelteKit server endpoints can then host the nonce and verification routes. This guide was tested with Svelte and Vite only.

### Why is the agent not $state?

Nothing in the markup depends on it. A plain variable is enough to keep the one agent for the life of the component.

### Can I use a form action instead of fetch?

You can, as long as the device result reaches the server unchanged. A hidden input holding JSON.stringify(result) works; this guide shows fetch because that was tested.

## Related pages

- [Verify in Node](https://whiskerjs.com/guides/verify-node/): The server this component was tested against.
- [Vue](https://whiskerjs.com/guides/vue/): The same form in Vue.
- [All integration guides](https://whiskerjs.com/guides/): The page-to-server contract.
- [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding): Nonce, timestamp and digest.


---

# Verify the anti-replay binding in Go

> A standard-library Go package that issues nonces and checks that a WhiskerJS result is fresh and unchanged, plus a net/http server.

Source: https://whiskerjs.com/guides/verify-go/ (last updated 2026-10-26)

> **In plain words:**
>
> Your Go server hands out a random one-time code with the time before the form is submitted. WhiskerJS seals that code into its result in the browser. When the form arrives, the server checks that it issued the code to this visitor, that it is unused and recent, and that the seal still matches every field of the result.

## Install

Nothing to install on the server: the package below uses only the Go standard library (Go 1.22 or newer for the method patterns in `net/http`). The page side needs WhiskerJS built from source; it is not on npm yet, the npm package is coming. See the [plain JavaScript guide](https://whiskerjs.com/guides/javascript/#install-build-from-source).

## The package

`whiskerbind/whiskerbind.go` rebuilds the text the browser hashed (the same as WhiskerJS’s `bindingInput`), keeps issued nonces, and verifies a result:

```go
// Package whiskerbind checks the anti-replay binding of a WhiskerJS result
// (WhiskerJS 0.1.0, signalsVersion 5, idVersion 2). Standard library only.
package whiskerbind

import (
	"crypto/rand"
	"crypto/sha256"
	"crypto/subtle"
	"encoding/hex"
	"encoding/json"
	"errors"
	"regexp"
	"sort"
	"strconv"
	"strings"
	"sync"
	"time"
)

// The versions this server ships. Ids and the binding format belong to them.
const (
	Version        = "0.1.0"
	SignalsVersion = "5"
	IDVersion      = "2"
	MaxAge         = 60 * time.Second
)

// ComponentNames are the 46 components of signalsVersion 5, sorted.
var ComponentNames = []string{
	"apple_pay", "audio", "audio_latency", "browser_class", "canvas", "canvas_readback",
	"color_depth", "color_gamut", "content_blockers", "cpu_architecture", "device_memory",
	"dynamic_range", "font_preferences", "fonts", "fonts_canvas", "forced_colors",
	"hardware_concurrency", "heap_limit", "intl_locale", "keyboard_layout", "languages", "math",
	"media_codecs", "pdf_viewer", "permissions", "pixel_ratio", "platform", "plugins",
	"prefers_contrast", "private_click", "reduced_motion", "screen_frame", "screen_resolution",
	"speech_voices", "storage", "time_zone", "touch_support", "ua_client_hints", "ua_versions",
	"vendor", "vendor_flavors", "webgl_image", "webgl_params", "webgl_renderer", "webgl_vendor",
	"webgpu",
}

type Component struct {
	Status string  `json:"status"`
	Value  *string `json:"value,omitempty"`
	Hashed *bool   `json:"hashed,omitempty"`
	RuleID *string `json:"ruleId,omitempty"`
}

type Binding struct {
	Nonce     *string      `json:"nonce"`
	Timestamp *json.Number `json:"timestamp"`
	Digest    *string      `json:"digest"`
}

// Result is a WhiskerJS result. Numbers stay json.Number so that they print
// exactly as the browser printed them (never in exponent form).
type Result struct {
	VisitorID      *string              `json:"visitorId"`
	Version        string               `json:"version"`
	SignalsVersion string               `json:"signalsVersion"`
	IDVersion      string               `json:"idVersion"`
	Components     map[string]Component `json:"components"`
	StructuredID   *string              `json:"structuredId"`
	IntegrityFlags []string             `json:"integrityFlags"`
	DurationMs     json.Number          `json:"durationMs"`
	Binding        *Binding             `json:"binding"`
}

var (
	ErrNoBinding      = errors.New("no_binding")
	ErrUnknownNonce   = errors.New("unknown_or_used_nonce")
	ErrWrongSession   = errors.New("wrong_session")
	ErrTimestamp      = errors.New("timestamp_mismatch")
	ErrExpired        = errors.New("expired")
	ErrVersion        = errors.New("unexpected_version")
	ErrComponents     = errors.New("unexpected_components")
	ErrBadShape       = errors.New("bad_shape")
	ErrDigestMismatch = errors.New("digest_mismatch")
)

var digestPattern = regexp.MustCompile(`^[0-9a-f]{32}$`)

func integer(n json.Number) (int64, error) {
	return strconv.ParseInt(string(n), 10, 64)
}

func orEmpty(s *string) string {
	if s == nil {
		return ""
	}
	return *s
}

func orBang(s *string) string {
	if s == nil {
		return "!"
	}
	return *s
}

// BindingInput rebuilds the exact text the browser hashed (bindingInput in
// WhiskerJS): one line per field, then one line per component, sorted by name.
func BindingInput(r *Result) (string, error) {
	duration, err := integer(r.DurationMs)
	if err != nil {
		return "", ErrBadShape
	}
	nonce, timestamp := "", ""
	if r.Binding != nil && r.Binding.Nonce != nil {
		nonce = *r.Binding.Nonce
	}
	if r.Binding != nil && r.Binding.Timestamp != nil {
		ts, err := integer(*r.Binding.Timestamp)
		if err != nil {
			return "", ErrBadShape
		}
		timestamp = strconv.FormatInt(ts, 10)
	}
	lines := []string{
		"whiskerjs/bind/1",
		"nonce=" + nonce,
		"timestamp=" + timestamp,
		"version=" + r.Version,
		"signalsVersion=" + r.SignalsVersion,
		"idVersion=" + r.IDVersion,
		"visitorId=" + orBang(r.VisitorID),
		"structuredId=" + orBang(r.StructuredID),
		"durationMs=" + strconv.FormatInt(duration, 10),
		"integrityFlags=" + strings.Join(r.IntegrityFlags, ","),
	}
	names := make([]string, 0, len(r.Components))
	for name := range r.Components {
		names = append(names, name)
	}
	sort.Strings(names)
	for _, name := range names {
		c := r.Components[name]
		kind := "-"
		if c.Hashed != nil && *c.Hashed {
			kind = "h"
		} else if c.Hashed != nil {
			kind = "v"
		}
		lines = append(lines, "c:"+name+"="+c.Status+"|"+kind+"|"+orEmpty(c.Value)+"|"+orEmpty(c.RuleID))
	}
	return strings.Join(lines, "\n"), nil
}

type issued struct {
	timestamp int64
	session   string
}

// Store keeps issued nonces. In production use your database or cache, with expiry.
type Store struct {
	mu     sync.Mutex
	nonces map[string]issued
}

func NewStore() *Store { return &Store{nonces: map[string]issued{}} }

// Remember records a nonce issued to a session.
func (s *Store) Remember(nonce string, timestamp int64, session string) {
	s.mu.Lock()
	defer s.mu.Unlock()
	s.nonces[nonce] = issued{timestamp, session}
}

// Issue makes a single-use nonce (128 random bits) for this session.
func (s *Store) Issue(session string) (string, int64, error) {
	buf := make([]byte, 16)
	if _, err := rand.Read(buf); err != nil {
		return "", 0, err
	}
	nonce := hex.EncodeToString(buf)
	timestamp := time.Now().UnixMilli()
	s.Remember(nonce, timestamp, session)
	return nonce, timestamp, nil
}

// take returns and deletes a nonce in one step, so it can be used only once.
func (s *Store) take(nonce string) (issued, bool) {
	s.mu.Lock()
	defer s.mu.Unlock()
	entry, ok := s.nonces[nonce]
	delete(s.nonces, nonce)
	return entry, ok
}

// Verify checks the binding of a result this session sent. It returns nil
// when the nonce is ours, unused and recent and the digest matches.
func (s *Store) Verify(r *Result, session string, now time.Time) error {
	if r == nil || r.Binding == nil || r.Binding.Nonce == nil || r.Binding.Timestamp == nil ||
		r.Binding.Digest == nil || !digestPattern.MatchString(*r.Binding.Digest) {
		return ErrNoBinding
	}
	entry, ok := s.take(*r.Binding.Nonce)
	if !ok {
		return ErrUnknownNonce
	}
	if entry.session != session {
		return ErrWrongSession
	}
	ts, err := integer(*r.Binding.Timestamp)
	if err != nil || ts != entry.timestamp {
		return ErrTimestamp
	}
	if now.UnixMilli()-entry.timestamp > MaxAge.Milliseconds() {
		return ErrExpired
	}
	if r.Version != Version || r.SignalsVersion != SignalsVersion || r.IDVersion != IDVersion {
		return ErrVersion
	}
	if len(r.Components) != len(ComponentNames) {
		return ErrComponents
	}
	for _, name := range ComponentNames {
		if _, ok := r.Components[name]; !ok {
			return ErrComponents
		}
	}
	text, err := BindingInput(r)
	if err != nil {
		return err
	}
	sum := sha256.Sum256([]byte(text))
	expected := hex.EncodeToString(sum[:])[:32]
	if subtle.ConstantTimeCompare([]byte(expected), []byte(*r.Binding.Digest)) != 1 {
		return ErrDigestMismatch
	}
	return nil
}
```

Points that matter for an exact match with the browser:

- **Numbers.** `timestamp` and `durationMs` are decoded as `json.Number`, parsed with `strconv.ParseInt` and printed with `strconv.FormatInt`. Decoding them into `float64` and printing with `%v` could give exponent form, and the digest would not match.
- **Missing versus empty.** `Value`, `Hashed` and `RuleID` are pointers, so an absent `hashed` prints `-` and `hashed: false` prints `v`.
- **Sorting.** `sort.Strings` orders names by bytes, as JavaScript’s default sort does for these ASCII names.
- **Single use.** `take` reads and deletes a nonce under one lock, so two parallel requests cannot both use it.
- **Constant time.** `subtle.ConstantTimeCompare` compares the digests.

## A complete server

`cmd/server/main.go`: a random `sid` cookie as the session (use yours if you have one), the nonce endpoint, and the login post that verifies the binding before anything else. The file server at the end only serves the example page.

```go
package main

import (
	"crypto/rand"
	"encoding/hex"
	"encoding/json"
	"net/http"
	"time"

	"example.com/whiskerdemo/whiskerbind"
)

var store = whiskerbind.NewStore()

// session returns this browser's session id, setting a cookie the first time.
func session(w http.ResponseWriter, r *http.Request) string {
	if c, err := r.Cookie("sid"); err == nil && len(c.Value) == 32 {
		return c.Value
	}
	buf := make([]byte, 16)
	rand.Read(buf)
	sid := hex.EncodeToString(buf)
	http.SetCookie(w, &http.Cookie{Name: "sid", Value: sid, Path: "/", HttpOnly: true, SameSite: http.SameSiteLaxMode})
	return sid
}

func send(w http.ResponseWriter, status int, body any) {
	w.Header().Set("content-type", "application/json")
	w.WriteHeader(status)
	json.NewEncoder(w).Encode(body)
}

func main() {
	http.HandleFunc("GET /api/whisker-nonce", func(w http.ResponseWriter, r *http.Request) {
		nonce, timestamp, err := store.Issue(session(w, r))
		if err != nil {
			send(w, 500, map[string]string{"error": "no_nonce"})
			return
		}
		send(w, 200, map[string]any{"nonce": nonce, "timestamp": timestamp})
	})
	http.HandleFunc("POST /api/login", func(w http.ResponseWriter, r *http.Request) {
		var body struct {
			Email    string              `json:"email"`
			Password string              `json:"password"`
			Device   *whiskerbind.Result `json:"device"`
		}
		r.Body = http.MaxBytesReader(w, r.Body, 64<<10) // a result is about 4 KB
		if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
			send(w, 400, map[string]string{"error": "bad_request"})
			return
		}
		if err := store.Verify(body.Device, session(w, r), time.Now()); err != nil {
			send(w, 400, map[string]string{"error": err.Error()})
			return
		}
		// Fresh and unchanged since collection. Now check the password and use
		// body.Device as one piece of evidence among others.
		send(w, 200, map[string]any{"visitorId": body.Device.VisitorID, "flags": body.Device.IntegrityFlags})
	})
	// Static files for this example only; your app serves its own.
	http.Handle("GET /", http.FileServer(http.Dir("public")))
	http.ListenAndServe("localhost:3000", nil)
}
```

`store` keeps nonces in memory, which only works for one process. With several instances, put them in your database or a shared cache with an expiry, and delete each one in the same step that reads it.

## What the digest proves

The binding digest is the first 128 bits of SHA-256 over a fixed text built from the whole result, your nonce and your timestamp. When the server rebuilds that text from what it received and gets the same digest, and the nonce is one it issued to this session, unused and recent, then:

- **it proves** the result was made in a browser that held your nonce, within the time window, and was not changed afterwards (a changed value, status, flag or id gives a different digest);
- **it stops** replay: a recorded result cannot be sent again, because its nonce is used up, and an old one fails the age check;
- **it does not prove** that the browser told the truth. The digest is **not a signature**: code in the page can compute it too, so an attacker who controls the browser can build a fake result for a fresh nonce. Signing belongs on your server, where the key is safe.

So a passing binding means “fresh and unchanged”, nothing more. Use the result as evidence among other evidence; see [what never to trust from the client](https://whiskerjs.com/docs/integration/#what-never-to-trust-from-the-client).

## The checks, in order

| Step | Check | Refusal |
| --- | --- | --- |
| 1 | `binding` exists with a string nonce and a 32-hex digest | `no_binding` |
| 2 | the nonce was issued by this server, is unused, and is **deleted now**, before any slow work | `unknown_or_used_nonce` |
| 3 | the nonce was issued to this session | `wrong_session` |
| 4 | the timestamp equals the one stored with the nonce (never trust the one in the result) | `timestamp_mismatch` |
| 5 | issued at most 60 seconds ago (tune to your form) | `expired` |
| 6 | `version`, `signalsVersion`, `idVersion` are the ones you ship | `unexpected_version` |
| 7 | `components` has exactly the 46 names of signalsVersion 5 | `unexpected_components` |
| 8 | the rebuilt text hashes to the received digest, compared in constant time | `digest_mismatch` |

Deleting the nonce in step 2, before anything else, means two parallel requests with the same result cannot both pass.

## The text that is hashed

The browser hashes these lines joined with `\n` (UTF-8), and the server rebuilds them from the result it received:

```text
whiskerjs/bind/1
nonce=<nonce>
timestamp=<timestamp>
version=<version>
signalsVersion=<signalsVersion>
idVersion=<idVersion>
visitorId=<visitorId, or ! when null>
structuredId=<structuredId, or ! when null>
durationMs=<durationMs>
integrityFlags=<flags joined with ,>
c:<name>=<status>|<h, v or ->|<value or empty>|<ruleId or empty>
```

The last line repeats once per component, names sorted (byte order). The middle field is `h` for `hashed: true`, `v` for `hashed: false` and `-` when `hashed` is absent. `timestamp` and `durationMs` are integers and must print as plain digits. The format is described in [Anti-replay binding](https://whiskerjs.com/docs/integration/#the-digest).

## Tested

Tested with WhiskerJS 0.1.0 (signalsVersion 5, idVersion 2) on 2026-10-26:

- the package with Go 1.27.1 (`go vet` clean) against three real results from headless Chromium, Firefox and WebKit: all accepted; the same result again refused with `unknown_or_used_nonce`; one changed component value refused with `digest_mismatch`; a check 61 seconds after issue refused with `expired`;
- the server, built for linux/arm64 with Go 1.27.1, with the [plain JavaScript page](https://whiskerjs.com/guides/javascript/) in headless Chromium 140 (Playwright 1.55.0): the login was accepted, and posting the same result again was refused with `unknown_or_used_nonce`.

## Questions and answers

### Why json.Number instead of float64 or int64 fields?

Decoding into float64 and printing it can produce exponent form for large values such as a millisecond timestamp, which would not match the text the browser hashed. json.Number keeps the digits; the package then parses them as int64 and refuses anything that is not a plain integer.

### Why do Value, Hashed and RuleID use pointers?

The text that is hashed distinguishes a missing field from an empty one: hashed absent gives '-', hashed false gives 'v'. Pointers keep that difference.

### Do I have to update the component list?

Yes, when you ship a WhiskerJS version with a new signalsVersion. The list and the version constants belong to the library version your pages load; a mismatch is refused as unexpected_version or unexpected_components.

## Related pages

- [Verify in Node](https://whiskerjs.com/guides/verify-node/): The same checks using the library's own code.
- [Verify in Python](https://whiskerjs.com/guides/verify-python/): The same checks in Python.
- [Plain JavaScript](https://whiskerjs.com/guides/javascript/): The page this server was tested with.
- [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding): The format in detail.


---

# Verify the anti-replay binding in Node

> Issue a nonce, then check that the result is fresh and unchanged, with the library's own bindingInput. A complete node:http server included.

Source: https://whiskerjs.com/guides/verify-node/ (last updated 2026-10-26)

> **In plain words:**
>
> Before the visitor submits a form, your server hands out a random one-time code with the time. WhiskerJS seals that code into its result. When the form arrives, the server checks three things: it issued this code to this visitor, the code has not been used and is recent, and the seal still matches the result. That stops anyone from recording a good result and sending it again later.

## Install: build from source

WhiskerJS is not on npm yet; the npm package is coming. The server uses the same package as the page:

```sh
cd whiskerjs
pnpm install && pnpm build && pnpm pack    # writes whiskerjs-0.1.0.tgz
cd ../my-server
npm install ../whiskerjs/whiskerjs-0.1.0.tgz
```

WhiskerJS is ES modules only, and the samples use `import` syntax; the tested project had `"type": "module"` in its `package.json`. Node 18 or newer runs the library; the TypeScript files below run directly on Node 22.18 or newer.

## The verification module

`whisker-binding.ts`: issue a nonce, verify a result. It imports `bindingInput`, `COMPONENT_NAMES` and the version constants from WhiskerJS, so it always matches the library version you install.

```ts
import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
import {
  bindingInput,
  COMPONENT_NAMES,
  ID_VERSION,
  SIGNALS_VERSION,
  VERSION,
  type CollectResult,
} from 'whiskerjs';

const MAX_AGE_MS = 60_000;
const EXPECTED_NAMES = [...COMPONENT_NAMES].sort().join(',');

interface Issued {
  timestamp: number;
  sessionId: string;
}

// One entry per nonce. In production use your database or cache, with expiry.
export const issued = new Map<string, Issued>();

/** Make a single-use nonce for this session. Send both values to the page. */
export function issueNonce(sessionId: string): { nonce: string; timestamp: number } {
  const nonce = randomBytes(16).toString('hex'); // 128 random bits
  const timestamp = Date.now();
  issued.set(nonce, { timestamp, sessionId });
  return { nonce, timestamp };
}

/** ok, or the reason the binding does not hold. */
export interface Verdict {
  ok: boolean;
  reason?: string;
}

/** Check the binding of a result this session sent. Never trust anything else in it before this passes. */
export function verifyBinding(result: CollectResult, sessionId: string, now = Date.now()): Verdict {
  const b = result?.binding;
  if (!b || typeof b.nonce !== 'string' || typeof b.digest !== 'string' || !/^[0-9a-f]{32}$/.test(b.digest)) {
    return { ok: false, reason: 'no_binding' };
  }
  // 1. A nonce we issued to this session, used once: delete it before any slow work.
  const entry = issued.get(b.nonce);
  if (!entry) return { ok: false, reason: 'unknown_or_used_nonce' };
  issued.delete(b.nonce);
  if (entry.sessionId !== sessionId) return { ok: false, reason: 'wrong_session' };
  // 2. The timestamp we stored, and recent.
  if (b.timestamp !== entry.timestamp) return { ok: false, reason: 'timestamp_mismatch' };
  if (now - entry.timestamp > MAX_AGE_MS) return { ok: false, reason: 'expired' };
  // 3. The library version we ship, with exactly its 46 components.
  if (result.version !== VERSION || result.signalsVersion !== SIGNALS_VERSION || result.idVersion !== ID_VERSION) {
    return { ok: false, reason: 'unexpected_version' };
  }
  if (!result.components || typeof result.components !== 'object') return { ok: false, reason: 'bad_shape' };
  if (Object.keys(result.components).sort().join(',') !== EXPECTED_NAMES) {
    return { ok: false, reason: 'unexpected_components' };
  }
  // 4. The digest matches the result as received.
  let text: string;
  try {
    text = bindingInput(result);
  } catch {
    return { ok: false, reason: 'bad_shape' };
  }
  const expected = createHash('sha256').update(text, 'utf8').digest('hex').slice(0, 32);
  if (!timingSafeEqual(Buffer.from(expected), Buffer.from(b.digest))) {
    return { ok: false, reason: 'digest_mismatch' };
  }
  return { ok: true };
}
```

`verifyBinding` returns `{ ok: true }` or `{ ok: false, reason }`; the reasons are listed under [the checks, in order](https://whiskerjs.com/guides/verify-node/#the-checks-in-order). Pass `now` only in tests.

## A complete server

`server.ts` uses only `node:http`. It sets a random `sid` cookie as the session (use your own session if you have one), serves the nonce, and verifies the binding of the login post before anything else. The static file part at the end exists only so the example page can be served from the same origin.

```ts
import { randomBytes } from 'node:crypto';
import { createServer, type IncomingMessage, type ServerResponse } from 'node:http';
import { readFile } from 'node:fs/promises';
import { extname, join, normalize } from 'node:path';
import { issueNonce, verifyBinding } from './whisker-binding.ts';

const MAX_BODY = 64 * 1024; // a result is about 4 KB

function sessionOf(req: IncomingMessage, res: ServerResponse): string {
  const match = /(?:^|;\s*)sid=([0-9a-f]{32})/.exec(req.headers.cookie ?? '');
  if (match) return match[1];
  const sid = randomBytes(16).toString('hex');
  res.setHeader('set-cookie', `sid=${sid}; HttpOnly; SameSite=Lax; Path=/`);
  return sid;
}

async function readJson(req: IncomingMessage): Promise<any> {
  let size = 0;
  const chunks: Buffer[] = [];
  for await (const chunk of req) {
    size += chunk.length;
    if (size > MAX_BODY) throw new Error('too large');
    chunks.push(chunk);
  }
  return JSON.parse(Buffer.concat(chunks).toString('utf8'));
}

function send(res: ServerResponse, status: number, body: unknown): void {
  res.writeHead(status, { 'content-type': 'application/json' });
  res.end(JSON.stringify(body));
}

const TYPES: Record<string, string> = { '.html': 'text/html', '.js': 'text/javascript' };

createServer(async (req, res) => {
  const url = new URL(req.url ?? '/', 'http://localhost');
  if (req.method === 'GET' && url.pathname === '/api/whisker-nonce') {
    return send(res, 200, issueNonce(sessionOf(req, res)));
  }
  if (req.method === 'POST' && url.pathname === '/api/login') {
    let body: any;
    try {
      body = await readJson(req);
    } catch {
      return send(res, 400, { error: 'bad_request' });
    }
    const verdict = verifyBinding(body?.device, sessionOf(req, res));
    if (!verdict.ok) return send(res, 400, { error: verdict.reason });
    // The result is fresh and unchanged since collection. Now check the password,
    // and use body.device as one piece of evidence among others.
    return send(res, 200, { visitorId: body.device.visitorId, flags: body.device.integrityFlags });
  }
  // Static files for this example only; your app or framework serves its own.
  const path = normalize(join('public', url.pathname === '/' ? 'index.html' : url.pathname));
  if (!path.startsWith('public')) return send(res, 404, { error: 'not_found' });
  try {
    const file = await readFile(path);
    res.writeHead(200, { 'content-type': TYPES[extname(path)] ?? 'application/octet-stream' });
    res.end(file);
  } catch {
    send(res, 404, { error: 'not_found' });
  }
}).listen(3000, 'localhost');
```

Run it with `node server.ts` and open `http://localhost:3000/` with the page from the [plain JavaScript guide](https://whiskerjs.com/guides/javascript/) in `public/`.

## What the digest proves

The binding digest is the first 128 bits of SHA-256 over a fixed text built from the whole result, your nonce and your timestamp. When the server rebuilds that text from what it received and gets the same digest, and the nonce is one it issued to this session, unused and recent, then:

- **it proves** the result was made in a browser that held your nonce, within the time window, and was not changed afterwards (a changed value, status, flag or id gives a different digest);
- **it stops** replay: a recorded result cannot be sent again, because its nonce is used up, and an old one fails the age check;
- **it does not prove** that the browser told the truth. The digest is **not a signature**: code in the page can compute it too, so an attacker who controls the browser can build a fake result for a fresh nonce. Signing belongs on your server, where the key is safe.

So a passing binding means “fresh and unchanged”, nothing more. Use the result as evidence among other evidence; see [what never to trust from the client](https://whiskerjs.com/docs/integration/#what-never-to-trust-from-the-client).

## The checks, in order

| Step | Check | Refusal |
| --- | --- | --- |
| 1 | `binding` exists with a string nonce and a 32-hex digest | `no_binding` |
| 2 | the nonce was issued by this server, is unused, and is **deleted now**, before any slow work | `unknown_or_used_nonce` |
| 3 | the nonce was issued to this session | `wrong_session` |
| 4 | the timestamp equals the one stored with the nonce (never trust the one in the result) | `timestamp_mismatch` |
| 5 | issued at most 60 seconds ago (tune to your form) | `expired` |
| 6 | `version`, `signalsVersion`, `idVersion` are the ones you ship | `unexpected_version` |
| 7 | `components` has exactly the 46 names of signalsVersion 5 | `unexpected_components` |
| 8 | the rebuilt text hashes to the received digest, compared in constant time | `digest_mismatch` |

Deleting the nonce in step 2, before anything else, means two parallel requests with the same result cannot both pass.

## The text that is hashed

The browser hashes these lines joined with `\n` (UTF-8), and the server rebuilds them from the result it received:

```text
whiskerjs/bind/1
nonce=<nonce>
timestamp=<timestamp>
version=<version>
signalsVersion=<signalsVersion>
idVersion=<idVersion>
visitorId=<visitorId, or ! when null>
structuredId=<structuredId, or ! when null>
durationMs=<durationMs>
integrityFlags=<flags joined with ,>
c:<name>=<status>|<h, v or ->|<value or empty>|<ruleId or empty>
```

The last line repeats once per component, names sorted (byte order). The middle field is `h` for `hashed: true`, `v` for `hashed: false` and `-` when `hashed` is absent. `timestamp` and `durationMs` are integers and must print as plain digits. The format is described in [Anti-replay binding](https://whiskerjs.com/docs/integration/#the-digest).

## Tested

Tested with WhiskerJS 0.1.0 (signalsVersion 5, idVersion 2) on 2026-10-26:

- `verifyBinding` on Node 22.23.2 against three real results from headless Chromium, Firefox and WebKit: all accepted; the same result again refused with `unknown_or_used_nonce`; one changed component value refused with `digest_mismatch`; a check 61 seconds after issue refused with `expired`; another session refused with `wrong_session`;
- `server.ts` on Node 22.18.0 with the plain JavaScript page in headless Chromium 140 (Playwright 1.55.0): the login was accepted, and posting the same result again was refused with `unknown_or_used_nonce`.

## Questions and answers

### Why import WhiskerJS on the server?

bindingInput and COMPONENT_NAMES are plain code with no browser dependency. Using them means the server rebuilds exactly the text the browser hashed, for the same library version.

### Can I run the TypeScript files directly?

Node 22.18 and newer strip TypeScript types by default, so node server.ts works. On older Node versions compile them first, or rename them to .js and remove the type annotations.

### Where should nonces be stored in production?

In a store every server process shares, such as your database or a cache, with an expiry of about a minute. The Map in the sample only works for one long-running process.

### Why use timingSafeEqual for the digest?

A normal string comparison can stop at the first differing character, which in principle leaks how much of a guess was right. A constant-time comparison avoids that; it costs nothing here.

## Related pages

- [Verify in Go](https://whiskerjs.com/guides/verify-go/): The same checks with the Go standard library.
- [Plain JavaScript](https://whiskerjs.com/guides/javascript/): The page this server was tested with.
- [Next.js](https://whiskerjs.com/guides/nextjs/): This module inside route handlers.
- [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding): The format in detail.
- [API reference](https://whiskerjs.com/docs/api/): bindingInput, COMPONENT_NAMES and the result types.


---

# Verify the anti-replay binding in PHP

> Core PHP functions that keep nonces in the session and check that a WhiskerJS result is fresh and unchanged, plus a router for PHP's built-in server.

Source: https://whiskerjs.com/guides/verify-php/ (last updated 2026-10-26)

> **In plain words:**
>
> Before the form is submitted, your PHP code puts a random one-time code and the time in the visitor’s session and hands both to the page. WhiskerJS seals the code into its result. When the form arrives, PHP checks that the code is in this session, unused and recent, and that the seal still matches every field of the result.

## Install

Nothing to install on the server: the functions use only PHP core (`random_bytes`, `hash`, `hash_equals`, `json_decode`, sessions); written for PHP 8 and tested with PHP 8.3. The page side needs WhiskerJS built from source; it is not on npm yet, the npm package is coming. See the [plain JavaScript guide](https://whiskerjs.com/guides/javascript/#install-build-from-source).

## The functions

`whisker_binding.php`:

```php
<?php
// Check the anti-replay binding of a WhiskerJS result (WhiskerJS 0.1.0,
// signalsVersion 5, idVersion 2). No extensions beyond the PHP core.
declare(strict_types=1);

const WHISKER_VERSIONS = ['0.1.0', '5', '2']; // version, signalsVersion, idVersion
const WHISKER_MAX_AGE_MS = 60000;
const WHISKER_COMPONENT_NAMES = [
    'apple_pay', 'audio', 'audio_latency', 'browser_class', 'canvas', 'canvas_readback',
    'color_depth', 'color_gamut', 'content_blockers', 'cpu_architecture', 'device_memory',
    'dynamic_range', 'font_preferences', 'fonts', 'fonts_canvas', 'forced_colors',
    'hardware_concurrency', 'heap_limit', 'intl_locale', 'keyboard_layout', 'languages', 'math',
    'media_codecs', 'pdf_viewer', 'permissions', 'pixel_ratio', 'platform', 'plugins',
    'prefers_contrast', 'private_click', 'reduced_motion', 'screen_frame', 'screen_resolution',
    'speech_voices', 'storage', 'time_zone', 'touch_support', 'ua_client_hints', 'ua_versions',
    'vendor', 'vendor_flavors', 'webgl_image', 'webgl_params', 'webgl_renderer', 'webgl_vendor',
    'webgpu',
];

/** A single-use nonce (128 random bits) and timestamp, kept in this session. */
function whisker_issue_nonce(): array
{
    $nonce = bin2hex(random_bytes(16));
    $timestamp = (int) floor(microtime(true) * 1000);
    $_SESSION['whisker_nonces'][$nonce] = $timestamp;
    return ['nonce' => $nonce, 'timestamp' => $timestamp];
}

/** The exact text the browser hashed (bindingInput in WhiskerJS). */
function whisker_binding_input(array $result): string
{
    $b = is_array($result['binding'] ?? null) ? $result['binding'] : [];
    $int = function ($v): int {
        if (!is_int($v)) {
            throw new UnexpectedValueException('not an integer');
        }
        return $v;
    };
    $lines = [
        'whiskerjs/bind/1',
        'nonce=' . ($b['nonce'] ?? ''),
        'timestamp=' . (isset($b['timestamp']) ? $int($b['timestamp']) : ''),
        'version=' . $result['version'],
        'signalsVersion=' . $result['signalsVersion'],
        'idVersion=' . $result['idVersion'],
        'visitorId=' . ($result['visitorId'] ?? '!'),
        'structuredId=' . ($result['structuredId'] ?? '!'),
        'durationMs=' . $int($result['durationMs']),
        'integrityFlags=' . implode(',', $result['integrityFlags']),
    ];
    $components = $result['components'];
    ksort($components, SORT_STRING);
    foreach ($components as $name => $c) {
        $hashed = $c['hashed'] ?? null;
        $kind = $hashed === true ? 'h' : ($hashed === false ? 'v' : '-');
        $lines[] = "c:{$name}={$c['status']}|{$kind}|" . ($c['value'] ?? '') . '|' . ($c['ruleId'] ?? '');
    }
    return implode("\n", $lines);
}

/** Null when the binding holds, otherwise the reason it does not. */
function whisker_verify_binding($result, ?int $nowMs = null): ?string
{
    $nowMs ??= (int) floor(microtime(true) * 1000);
    $b = is_array($result) ? ($result['binding'] ?? null) : null;
    if (!is_array($b) || !is_string($b['nonce'] ?? null) || !is_string($b['digest'] ?? null)
        || !preg_match('/^[0-9a-f]{32}$/', $b['digest'])) {
        return 'no_binding';
    }
    // 1. A nonce issued to this session, used once: remove it before any slow work.
    $issuedAt = $_SESSION['whisker_nonces'][$b['nonce']] ?? null;
    unset($_SESSION['whisker_nonces'][$b['nonce']]);
    if ($issuedAt === null) {
        return 'unknown_or_used_nonce';
    }
    // 2. The timestamp we stored, and recent.
    if (($b['timestamp'] ?? null) !== $issuedAt) {
        return 'timestamp_mismatch';
    }
    if ($nowMs - $issuedAt > WHISKER_MAX_AGE_MS) {
        return 'expired';
    }
    // 3. The version we ship, with exactly its 46 components.
    if ([$result['version'] ?? null, $result['signalsVersion'] ?? null, $result['idVersion'] ?? null] !== WHISKER_VERSIONS) {
        return 'unexpected_version';
    }
    if (!is_array($result['components'] ?? null)) {
        return 'unexpected_components';
    }
    $names = array_map('strval', array_keys($result['components']));
    sort($names, SORT_STRING);
    if ($names !== WHISKER_COMPONENT_NAMES) {
        return 'unexpected_components';
    }
    // 4. The digest matches the result as received.
    try {
        $text = whisker_binding_input($result);
    } catch (Throwable $e) {
        return 'bad_shape';
    }
    $expected = substr(hash('sha256', $text), 0, 32);
    return hash_equals($expected, $b['digest']) ? null : 'digest_mismatch';
}
```

`whisker_verify_binding` returns `null` when the binding holds, or the reason it does not. It expects the session to be started. Pass `$nowMs` only in tests.

Points that matter for an exact match with the browser:

- **Decode to arrays.** Use `json_decode($raw, true)`, so components are arrays and `hashed` stays `true`, `false` or missing.
- **Integers.** `timestamp` and `durationMs` must be PHP `int` values; on 64-bit PHP a millisecond timestamp fits.
- **Sorting.** `ksort($components, SORT_STRING)` orders names by bytes, as JavaScript’s default sort does for these ASCII names.
- **Constant time.** `hash_equals` compares the digests.

## A router for the built-in server

`router.php` serves the two endpoints with `php -S localhost:3000 -t public router.php`. In your application these are two routes; the last line only lets the built-in server deliver the example page from `public/`.

```php
<?php
// Routes for PHP's built-in server: php -S localhost:3000 -t public router.php
// In your app, these are two routes of your framework.
declare(strict_types=1);
require __DIR__ . '/whisker_binding.php';

$path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);

function send(int $status, array $body): void
{
    http_response_code($status);
    $json = json_encode($body);
    header('content-type: application/json');
    header('content-length: ' . strlen($json));
    echo $json;
}

if ($path === '/api/whisker-nonce' && $_SERVER['REQUEST_METHOD'] === 'GET') {
    session_start(['cookie_httponly' => true, 'cookie_samesite' => 'Lax']);
    send(200, whisker_issue_nonce());
    return true;
}

if ($path === '/api/login' && $_SERVER['REQUEST_METHOD'] === 'POST') {
    session_start(['cookie_httponly' => true, 'cookie_samesite' => 'Lax']);
    if ((int) ($_SERVER['CONTENT_LENGTH'] ?? 0) > 64 * 1024) { // a result is about 4 KB
        send(413, ['error' => 'too_large']);
        return true;
    }
    $raw = file_get_contents('php://input');
    $body = json_decode((string) $raw, true);
    $reason = whisker_verify_binding(is_array($body) ? ($body['device'] ?? null) : null);
    if ($reason !== null) {
        send(400, ['error' => $reason]);
        return true;
    }
    // Fresh and unchanged since collection. Now check the password and use
    // $body['device'] as one piece of evidence among others.
    send(200, ['visitorId' => $body['device']['visitorId'], 'flags' => $body['device']['integrityFlags']]);
    return true;
}

return false; // static files (this example only)
```

## What the digest proves

The binding digest is the first 128 bits of SHA-256 over a fixed text built from the whole result, your nonce and your timestamp. When the server rebuilds that text from what it received and gets the same digest, and the nonce is one it issued to this session, unused and recent, then:

- **it proves** the result was made in a browser that held your nonce, within the time window, and was not changed afterwards (a changed value, status, flag or id gives a different digest);
- **it stops** replay: a recorded result cannot be sent again, because its nonce is used up, and an old one fails the age check;
- **it does not prove** that the browser told the truth. The digest is **not a signature**: code in the page can compute it too, so an attacker who controls the browser can build a fake result for a fresh nonce. Signing belongs on your server, where the key is safe.

So a passing binding means “fresh and unchanged”, nothing more. Use the result as evidence among other evidence; see [what never to trust from the client](https://whiskerjs.com/docs/integration/#what-never-to-trust-from-the-client).

## The checks, in order

| Step | Check | Refusal |
| --- | --- | --- |
| 1 | `binding` exists with a string nonce and a 32-hex digest | `no_binding` |
| 2 | the nonce was issued by this server, is unused, and is **deleted now**, before any slow work | `unknown_or_used_nonce` |
| 3 | the nonce was issued to this session | `wrong_session` |
| 4 | the timestamp equals the one stored with the nonce (never trust the one in the result) | `timestamp_mismatch` |
| 5 | issued at most 60 seconds ago (tune to your form) | `expired` |
| 6 | `version`, `signalsVersion`, `idVersion` are the ones you ship | `unexpected_version` |
| 7 | `components` has exactly the 46 names of signalsVersion 5 | `unexpected_components` |
| 8 | the rebuilt text hashes to the received digest, compared in constant time | `digest_mismatch` |

Deleting the nonce in step 2, before anything else, means two parallel requests with the same result cannot both pass.

## The text that is hashed

The browser hashes these lines joined with `\n` (UTF-8), and the server rebuilds them from the result it received:

```text
whiskerjs/bind/1
nonce=<nonce>
timestamp=<timestamp>
version=<version>
signalsVersion=<signalsVersion>
idVersion=<idVersion>
visitorId=<visitorId, or ! when null>
structuredId=<structuredId, or ! when null>
durationMs=<durationMs>
integrityFlags=<flags joined with ,>
c:<name>=<status>|<h, v or ->|<value or empty>|<ruleId or empty>
```

The last line repeats once per component, names sorted (byte order). The middle field is `h` for `hashed: true`, `v` for `hashed: false` and `-` when `hashed` is absent. `timestamp` and `durationMs` are integers and must print as plain digits. The format is described in [Anti-replay binding](https://whiskerjs.com/docs/integration/#the-digest).

## Tested

Tested with WhiskerJS 0.1.0 (signalsVersion 5, idVersion 2) and PHP 8.3.36 (CLI, Docker image php:8.3-cli) on 2026-10-26:

- the functions against three real results from headless Chromium, Firefox and WebKit: all accepted; the same result again refused with `unknown_or_used_nonce`; one changed component value refused with `digest_mismatch`; a check 61 seconds after issue refused with `expired`;
- `router.php` on PHP’s built-in server with the [plain JavaScript page](https://whiskerjs.com/guides/javascript/) in headless Chromium 140 (Playwright 1.55.0): the login was accepted, and posting the same result again was refused with `unknown_or_used_nonce`.

## Questions and answers

### Why keep nonces in $_SESSION?

The session already belongs to one visitor, so a nonce stored there cannot be used by another, and PHP's default file sessions are locked while a request runs, so reading and removing a nonce cannot race. With a custom session handler that does not lock, keep nonces in your database instead.

### Does it work with Laravel or Symfony?

The functions have no framework code. Call whisker_issue_nonce in your nonce route and whisker_verify_binding in your login route with the decoded JSON. With a framework session object instead of $_SESSION, change the two lines that read and write the nonce. Only the plain PHP version was tested.

### Why is_int and not a cast?

A cast would accept 831.5 or '831' and print something the browser never hashed. Requiring a real integer from json_decode keeps the rebuilt text identical.

## Related pages

- [Verify in Python](https://whiskerjs.com/guides/verify-python/): The same checks in Python.
- [Verify in Node](https://whiskerjs.com/guides/verify-node/): The same checks with the library's own code.
- [Plain JavaScript](https://whiskerjs.com/guides/javascript/): The page this server was tested with.
- [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding): The format in detail.


---

# Verify the anti-replay binding in Python

> A standard-library Python module that issues nonces and checks that a WhiskerJS result is fresh and unchanged, plus a small http.server example.

Source: https://whiskerjs.com/guides/verify-python/ (last updated 2026-10-26)

> **In plain words:**
>
> Your Python server hands out a random one-time code with the time before the form is submitted. WhiskerJS seals that code into its result in the browser. When the form arrives, the server checks that it issued the code to this visitor, that the code is unused and recent, and that the seal still matches every field of the result.

## Install

Nothing to install on the server: the module uses only the Python standard library (Python 3.10 or newer for the type hints used). The page side needs WhiskerJS built from source; it is not on npm yet, the npm package is coming. See the [plain JavaScript guide](https://whiskerjs.com/guides/javascript/#install-build-from-source).

## The module

`whisker_binding.py`:

```python
"""Check the anti-replay binding of a WhiskerJS result (WhiskerJS 0.1.0,
signalsVersion 5, idVersion 2). Standard library only."""
import hashlib
import hmac
import re
import secrets
import threading
import time

VERSION, SIGNALS_VERSION, ID_VERSION = "0.1.0", "5", "2"
MAX_AGE_MS = 60_000

# The 46 components of signalsVersion 5.
COMPONENT_NAMES = frozenset("""
apple_pay audio audio_latency browser_class canvas canvas_readback color_depth color_gamut
content_blockers cpu_architecture device_memory dynamic_range font_preferences fonts
fonts_canvas forced_colors hardware_concurrency heap_limit intl_locale keyboard_layout
languages math media_codecs pdf_viewer permissions pixel_ratio platform plugins
prefers_contrast private_click reduced_motion screen_frame screen_resolution speech_voices
storage time_zone touch_support ua_client_hints ua_versions vendor vendor_flavors
webgl_image webgl_params webgl_renderer webgl_vendor webgpu
""".split())

DIGEST = re.compile(r"[0-9a-f]{32}")

# nonce -> (timestamp, session id). In production use your database or cache, with expiry.
_issued: dict[str, tuple[int, str]] = {}
_lock = threading.Lock()

def remember(nonce: str, timestamp: int, session_id: str) -> None:
    with _lock:
        _issued[nonce] = (timestamp, session_id)

def issue_nonce(session_id: str) -> dict:
    """A single-use nonce (128 random bits) and timestamp for this session."""
    nonce = secrets.token_hex(16)
    timestamp = int(time.time() * 1000)
    remember(nonce, timestamp, session_id)
    return {"nonce": nonce, "timestamp": timestamp}

def _int(value) -> int:
    # JSON integers only: Python's bool is an int, and 831.0 would print differently.
    if type(value) is not int:
        raise ValueError("not an integer")
    return value

def binding_input(result: dict) -> str:
    """The exact text the browser hashed (bindingInput in WhiskerJS)."""
    b = result.get("binding") or {}
    nonce = b.get("nonce")
    timestamp = b.get("timestamp")
    lines = [
        "whiskerjs/bind/1",
        f"nonce={'' if nonce is None else nonce}",
        f"timestamp={'' if timestamp is None else _int(timestamp)}",
        f"version={result['version']}",
        f"signalsVersion={result['signalsVersion']}",
        f"idVersion={result['idVersion']}",
        f"visitorId={'!' if result.get('visitorId') is None else result['visitorId']}",
        f"structuredId={'!' if result.get('structuredId') is None else result['structuredId']}",
        f"durationMs={_int(result['durationMs'])}",
        f"integrityFlags={','.join(result['integrityFlags'])}",
    ]
    for name in sorted(result["components"]):
        c = result["components"][name]
        kind = "h" if c.get("hashed") is True else "v" if c.get("hashed") is False else "-"
        value = c.get("value")
        rule = c.get("ruleId")
        lines.append(f"c:{name}={c['status']}|{kind}|{'' if value is None else value}|{'' if rule is None else rule}")
    return "\n".join(lines)

def verify_binding(result, session_id: str, now_ms: int | None = None) -> str | None:
    """None when the binding holds, otherwise the reason it does not."""
    now_ms = int(time.time() * 1000) if now_ms is None else now_ms
    b = result.get("binding") if isinstance(result, dict) else None
    if not isinstance(b, dict) or not isinstance(b.get("nonce"), str) \
            or not isinstance(b.get("digest"), str) or not DIGEST.fullmatch(b["digest"]):
        return "no_binding"
    # 1. A nonce we issued to this session, used once: remove it before any slow work.
    with _lock:
        entry = _issued.pop(b["nonce"], None)
    if entry is None:
        return "unknown_or_used_nonce"
    issued_at, owner = entry
    if owner != session_id:
        return "wrong_session"
    # 2. The timestamp we stored, and recent.
    if type(b.get("timestamp")) is not int or b["timestamp"] != issued_at:
        return "timestamp_mismatch"
    if now_ms - issued_at > MAX_AGE_MS:
        return "expired"
    # 3. The version we ship, with exactly its 46 components.
    if (result.get("version"), result.get("signalsVersion"), result.get("idVersion")) != (VERSION, SIGNALS_VERSION, ID_VERSION):
        return "unexpected_version"
    components = result.get("components")
    if not isinstance(components, dict) or set(components) != COMPONENT_NAMES:
        return "unexpected_components"
    # 4. The digest matches the result as received.
    try:
        text = binding_input(result)
    except (KeyError, TypeError, ValueError, AttributeError):
        return "bad_shape"
    expected = hashlib.sha256(text.encode("utf-8")).hexdigest()[:32]
    if not hmac.compare_digest(expected, b["digest"]):
        return "digest_mismatch"
    return None
```

`verify_binding` returns `None` when the binding holds, or the reason it does not. Pass `now_ms` only in tests.

Points that matter for an exact match with the browser:

- **Integers.** `timestamp` and `durationMs` must be real `int` values (not `bool`, not `float`), so they print as plain digits.
- **Missing versus empty.** `c.get("hashed") is True` gives `h`, `is False` gives `v`, anything else `-`; a missing `value` or `ruleId` prints as empty.
- **Sorting.** `sorted()` orders the ASCII names the same way JavaScript’s default sort does.
- **Constant time.** `hmac.compare_digest` compares the digests.

## A complete server

`server.py` uses `http.server` only, to stay dependency-free. It sets a random `sid` cookie as the session, serves the nonce and verifies the login post before anything else. In your framework these are two views; the static file serving exists only for the example page in `public/`.

```python
import json
import re
import secrets
from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer

from whisker_binding import issue_nonce, verify_binding

MAX_BODY = 64 * 1024  # a result is about 4 KB

class Handler(SimpleHTTPRequestHandler):
    def __init__(self, *args, **kwargs):
        # Static files for this example only; your framework serves its own.
        super().__init__(*args, directory="public", **kwargs)

    def session(self) -> str:
        match = re.search(r"(?:^|;\s*)sid=([0-9a-f]{32})", self.headers.get("cookie", ""))
        if match:
            self.new_sid = None
            return match.group(1)
        self.new_sid = secrets.token_hex(16)
        return self.new_sid

    def send(self, status: int, body: dict) -> None:
        data = json.dumps(body).encode()
        self.send_response(status)
        self.send_header("content-type", "application/json")
        if self.new_sid:
            self.send_header("set-cookie", f"sid={self.new_sid}; HttpOnly; SameSite=Lax; Path=/")
        self.send_header("content-length", str(len(data)))
        self.end_headers()
        self.wfile.write(data)

    def do_GET(self):
        if self.path == "/api/whisker-nonce":
            return self.send(200, issue_nonce(self.session()))
        return super().do_GET()

    def do_POST(self):
        if self.path != "/api/login":
            return self.send_error(404)
        sid = self.session()
        length = int(self.headers.get("content-length", 0))
        if length > MAX_BODY:
            return self.send(413, {"error": "too_large"})
        try:
            body = json.loads(self.rfile.read(length))
        except ValueError:
            return self.send(400, {"error": "bad_request"})
        reason = verify_binding(body.get("device") if isinstance(body, dict) else None, sid)
        if reason:
            return self.send(400, {"error": reason})
        # Fresh and unchanged since collection. Now check the password and use
        # body["device"] as one piece of evidence among others.
        device = body["device"]
        return self.send(200, {"visitorId": device["visitorId"], "flags": device["integrityFlags"]})

ThreadingHTTPServer(("localhost", 3000), Handler).serve_forever()
```

## What the digest proves

The binding digest is the first 128 bits of SHA-256 over a fixed text built from the whole result, your nonce and your timestamp. When the server rebuilds that text from what it received and gets the same digest, and the nonce is one it issued to this session, unused and recent, then:

- **it proves** the result was made in a browser that held your nonce, within the time window, and was not changed afterwards (a changed value, status, flag or id gives a different digest);
- **it stops** replay: a recorded result cannot be sent again, because its nonce is used up, and an old one fails the age check;
- **it does not prove** that the browser told the truth. The digest is **not a signature**: code in the page can compute it too, so an attacker who controls the browser can build a fake result for a fresh nonce. Signing belongs on your server, where the key is safe.

So a passing binding means “fresh and unchanged”, nothing more. Use the result as evidence among other evidence; see [what never to trust from the client](https://whiskerjs.com/docs/integration/#what-never-to-trust-from-the-client).

## The checks, in order

| Step | Check | Refusal |
| --- | --- | --- |
| 1 | `binding` exists with a string nonce and a 32-hex digest | `no_binding` |
| 2 | the nonce was issued by this server, is unused, and is **deleted now**, before any slow work | `unknown_or_used_nonce` |
| 3 | the nonce was issued to this session | `wrong_session` |
| 4 | the timestamp equals the one stored with the nonce (never trust the one in the result) | `timestamp_mismatch` |
| 5 | issued at most 60 seconds ago (tune to your form) | `expired` |
| 6 | `version`, `signalsVersion`, `idVersion` are the ones you ship | `unexpected_version` |
| 7 | `components` has exactly the 46 names of signalsVersion 5 | `unexpected_components` |
| 8 | the rebuilt text hashes to the received digest, compared in constant time | `digest_mismatch` |

Deleting the nonce in step 2, before anything else, means two parallel requests with the same result cannot both pass.

## The text that is hashed

The browser hashes these lines joined with `\n` (UTF-8), and the server rebuilds them from the result it received:

```text
whiskerjs/bind/1
nonce=<nonce>
timestamp=<timestamp>
version=<version>
signalsVersion=<signalsVersion>
idVersion=<idVersion>
visitorId=<visitorId, or ! when null>
structuredId=<structuredId, or ! when null>
durationMs=<durationMs>
integrityFlags=<flags joined with ,>
c:<name>=<status>|<h, v or ->|<value or empty>|<ruleId or empty>
```

The last line repeats once per component, names sorted (byte order). The middle field is `h` for `hashed: true`, `v` for `hashed: false` and `-` when `hashed` is absent. `timestamp` and `durationMs` are integers and must print as plain digits. The format is described in [Anti-replay binding](https://whiskerjs.com/docs/integration/#the-digest).

## Tested

Tested with WhiskerJS 0.1.0 (signalsVersion 5, idVersion 2) on 2026-10-26:

- the module with Python 3.13.0 against three real results from headless Chromium, Firefox and WebKit: all accepted; the same result again refused with `unknown_or_used_nonce`; one changed component value refused with `digest_mismatch`; a check 61 seconds after issue refused with `expired`;
- the server with Python 3.12.3 and the [plain JavaScript page](https://whiskerjs.com/guides/javascript/) in headless Chromium 140 (Playwright 1.55.0): the login was accepted, and posting the same result again was refused with `unknown_or_used_nonce`.

## Questions and answers

### Can I use this with Django, Flask or FastAPI?

Yes. The module has no web framework code: call issue_nonce from your nonce view and verify_binding from your login view with the parsed JSON body and your session id. The example server uses http.server only to stay dependency-free; it was the setup that was tested.

### Why check type(value) is int?

Python's bool is a subclass of int, and a float such as 831.0 would print as 831.0 instead of 831. Requiring a real int keeps the rebuilt text identical to what the browser hashed.

### Is the in-memory dictionary safe?

Within one process, yes: a lock makes reading and deleting a nonce one step. With several workers or servers, keep nonces in a shared store such as your database or Redis, with an expiry.

## Related pages

- [Verify in Node](https://whiskerjs.com/guides/verify-node/): The same checks with the library's own code.
- [Verify in PHP](https://whiskerjs.com/guides/verify-php/): The same checks in PHP.
- [Plain JavaScript](https://whiskerjs.com/guides/javascript/): The page this server was tested with.
- [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding): The format in detail.


---

# Vue

> A Vue 3 single-file component that collects on submit and sends the result with the form.

Source: https://whiskerjs.com/guides/vue/ (last updated 2026-10-26)

> **In plain words:**
>
> This is a normal Vue sign-in form. When it is submitted it fetches a one-time code from your server, lets WhiskerJS read the browser, and posts the result together with the email and password. WhiskerJS is created the first time it is needed and only ever runs in the browser.

## Install: build from source

WhiskerJS is not on npm yet; the npm package is coming. Build it and install the tarball:

```sh
cd whiskerjs
pnpm install && pnpm build && pnpm pack    # writes whiskerjs-0.1.0.tgz
cd ../my-vue-app
npm install ../whiskerjs/whiskerjs-0.1.0.tgz
```

## The component

`src/LoginForm.vue`:

```vue
<script setup lang="ts">
import { ref } from 'vue';
import { load, type Agent } from 'whiskerjs';

const email = ref('');
const password = ref('');
const status = ref('');
const busy = ref(false);

// One agent per page, created on first use. load() is cheap and keeps no state.
let agent: Promise<Agent> | undefined;

async function onSubmit() {
  busy.value = true;
  try {
    // A fresh nonce from your server, then collect. collect() never throws.
    const binding = await (await fetch('/api/whisker-nonce')).json();
    const device = await (await (agent ??= load())).collect({ timeoutMs: 3000, binding });
    const response = await fetch('/api/login', {
      method: 'POST',
      headers: { 'content-type': 'application/json' },
      body: JSON.stringify({ email: email.value, password: password.value, device }),
    });
    status.value = response.ok ? 'Signed in' : `Refused (${response.status})`;
  } catch {
    status.value = 'Network error, please try again';
  } finally {
    busy.value = false;
  }
}
</script>

<template>
  <form @submit.prevent="onSubmit">
    <label>Email <input v-model="email" name="email" type="email" required /></label>
    <label>Password <input v-model="password" name="password" type="password" required /></label>
    <button type="submit" :disabled="busy">Sign in</button>
    <output id="status">{{ status }}</output>
  </form>
</template>
```

Mounted as the app’s root component in `src/main.ts`:

```ts
import { createApp } from 'vue';
import LoginForm from './LoginForm.vue';

createApp(LoginForm).mount('#app');
```

## How it works

- **`@submit.prevent`** stops the browser’s own form post, so the handler can add the device result first.
- **The agent** is created by the first submit (`agent ??= load()`) and reused after that. `load()` is cheap and keeps no state between `collect()` calls.
- **The binding.** `/api/whisker-nonce` returns `{ nonce, timestamp }`; `collect({ binding })` echoes both in `result.binding` and adds a digest over the whole result. Your server checks it: [Node](https://whiskerjs.com/guides/verify-node/), [Go](https://whiskerjs.com/guides/verify-go/), [PHP](https://whiskerjs.com/guides/verify-php/), [Python](https://whiskerjs.com/guides/verify-python/).
- **Errors.** `collect()` never throws or rejects; the `try` block covers your two `fetch` calls.
- **`busy`** disables the button while a submit is in flight, so a double click does not use two nonces.

## Things to know

- **Server rendering (Nuxt and similar).** The component’s `script setup` runs on the server when the page is rendered there. Calling WhiskerJS only from the submit handler (or from `onMounted`) keeps it in the browser.
- **Secure context.** Use https, or `localhost` with the Vite dev server. Without Web Crypto the ids are `null`.
- **Send the result unchanged** when the server verifies the binding: the digest covers every field.

## Tested

Tested with WhiskerJS 0.1.0 (signalsVersion 5, idVersion 2), Vue 3.5.44, Vite 8.3.5 with @vitejs/plugin-vue 6.0.10, and vue-tsc 3.3.13 on 2026-10-26: built with `vue-tsc --noEmit && vite build`, served by the [Node server](https://whiskerjs.com/guides/verify-node/#a-complete-server) and submitted in headless Chromium 140 (Playwright 1.55.0). The server accepted the binding and refused the same result sent a second time.

## Questions and answers

### Should the agent be reactive state?

No. The agent is a plain object with one method; keeping it in a ref adds nothing. A plain variable in script setup holds it for the life of the component.

### What about Nuxt?

Nuxt renders components on the server first. Keep load() and collect() inside event handlers or onMounted, which only run in the browser, as this component does. The component itself was tested with Vue and Vite only.

### Do I need a plugin or a global property?

No. Import load where you need it. There is nothing to install into the Vue app.

## Related pages

- [Verify in Node](https://whiskerjs.com/guides/verify-node/): The server this component was tested against.
- [All integration guides](https://whiskerjs.com/guides/): The page-to-server contract.
- [Svelte](https://whiskerjs.com/guides/svelte/): The same form in Svelte 5.
- [Getting started](https://whiskerjs.com/docs/getting-started/): Build WhiskerJS from source.


---

# Signals

> All 46 components of signalsVersion 5, sorted by the identifier group they belong to, each with its own page.

Source: https://whiskerjs.com/signals/ (last updated 2026-10-26)

> **In plain words:**
>
> A signal (WhiskerJS calls it a component) is one small measurement of the browser and device, such as the screen size, the time zone or how a test image is drawn. One signal alone says little; together they tell browser setups apart. WhiskerJS reads 46 of them, sorts the 37 that rarely change into seven groups, and keeps the 9 that change easily out of the identifiers. It never decides what a signal means: your server does.

## How to read a signal page

Every signal page has the same parts, so you can compare them:

- **Facts box** (at the top): the group, whether the signal is in the visitorId, how it is hashed, whether a browser class excludes it, and the signalsVersion that added it. It is generated from the library’s code.
- **What it reads**: the exact browser API and what is taken from it.
- **How the technique works**: the method, step by step.
- **Why it helps**: what makes it differ between devices.
- **Stability**: what makes it change on the same device.
- **Browser support and what blocks it**: where it is usually `ok`, and what it reports elsewhere.
- **Privacy**: what the value can reveal and how WhiskerJS limits that.
- **How WhiskerJS handles noise and failures**: the statuses and [ruleIds](https://whiskerjs.com/glossary/#ruleid) this component can really report.
- **Example value**: the shape of a real value.

If you would rather read everything on one page, use the [signals reference](https://whiskerjs.com/docs/signals/).

## The groups at a glance

The [structuredId](https://whiskerjs.com/glossary/#structured-id) has one part per [signal group](https://whiskerjs.com/glossary/#signal-group). When two results differ, the group that moved tells you what kind of change happened. Columns: **In visitorId** says whether the component joins both ids; **Always hashed** says whether the value always leaves the library as a [digest](https://whiskerjs.com/glossary/#digest) (other values are hashed only when longer than 128 characters or not printable ASCII).

### gpu: graphics

Graphics output depends on the GPU, its driver, the operating system and the browser’s rendering engine together. It is the most distinguishing group and also the one most likely to move after a driver or browser update.

| Component | Group | In visitorId | Always hashed |
| --- | --- | --- | --- |
| [`canvas`](https://whiskerjs.com/signals/canvas/) | gpu | yes | yes |
| [`webgl_image`](https://whiskerjs.com/signals/webgl-image/) | gpu | yes | yes |
| [`webgl_params`](https://whiskerjs.com/signals/webgl-params/) | gpu | yes | yes |
| [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/) | gpu | yes | no |
| [`webgl_vendor`](https://whiskerjs.com/signals/webgl-vendor/) | gpu | yes | no |
| [`webgpu`](https://whiskerjs.com/signals/webgpu/) | gpu | yes | yes |

### audio

One offline audio render. Nothing is played and no audio device is opened.

| Component | Group | In visitorId | Always hashed |
| --- | --- | --- | --- |
| [`audio`](https://whiskerjs.com/signals/audio/) | audio | yes | yes |

### fonts

Installed fonts and default font settings, which follow the operating system, its language packs and installed software.

| Component | Group | In visitorId | Always hashed |
| --- | --- | --- | --- |
| [`font_preferences`](https://whiskerjs.com/signals/font-preferences/) | fonts | yes | yes |
| [`fonts`](https://whiskerjs.com/signals/fonts/) | fonts | yes | yes (`none` plain) |
| [`fonts_canvas`](https://whiskerjs.com/signals/fonts-canvas/) | fonts | yes | yes (`none` plain) |

### device: screen, memory and CPU

Hardware facts the browser reports: screen size, colour depth, CPU threads and family, memory buckets and touch support.

| Component | Group | In visitorId | Always hashed |
| --- | --- | --- | --- |
| [`color_depth`](https://whiskerjs.com/signals/color-depth/) | device | yes | no |
| [`cpu_architecture`](https://whiskerjs.com/signals/cpu-architecture/) | device | yes | no |
| [`device_memory`](https://whiskerjs.com/signals/device-memory/) | device | yes | no |
| [`hardware_concurrency`](https://whiskerjs.com/signals/hardware-concurrency/) | device | yes | no |
| [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) | device | yes | no |
| [`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/) | device | yes | no |
| [`touch_support`](https://whiskerjs.com/signals/touch-support/) | device | yes | no |

### browser: engine and build

What the browser is and how it was built: its class, its maths and codec support, plugins, Client Hints and browser-specific globals. This group usually moves after a browser update.

| Component | Group | In visitorId | Always hashed |
| --- | --- | --- | --- |
| [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) | browser | yes | no |
| [`browser_class`](https://whiskerjs.com/signals/browser-class/) | browser | yes | no |
| [`math`](https://whiskerjs.com/signals/math/) | browser | yes | yes |
| [`media_codecs`](https://whiskerjs.com/signals/media-codecs/) | browser | yes | yes |
| [`pdf_viewer`](https://whiskerjs.com/signals/pdf-viewer/) | browser | yes | no |
| [`platform`](https://whiskerjs.com/signals/platform/) | browser | yes | no |
| [`plugins`](https://whiskerjs.com/signals/plugins/) | browser | yes | yes (`none` plain) |
| [`private_click`](https://whiskerjs.com/signals/private-click/) | browser | yes | no |
| [`storage`](https://whiskerjs.com/signals/storage/) | browser | yes | no |
| [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) | browser | yes | no |
| [`vendor`](https://whiskerjs.com/signals/vendor/) | browser | yes | no |
| [`vendor_flavors`](https://whiskerjs.com/signals/vendor-flavors/) | browser | yes | no |

### locale

Language, locale and time zone settings. They move when a user changes them or travels.

| Component | Group | In visitorId | Always hashed |
| --- | --- | --- | --- |
| [`intl_locale`](https://whiskerjs.com/signals/intl-locale/) | locale | yes | no |
| [`languages`](https://whiskerjs.com/signals/languages/) | locale | yes | no |
| [`time_zone`](https://whiskerjs.com/signals/time-zone/) | locale | yes | no |

### prefs: display and accessibility preferences

Five CSS media queries about the screen and the user’s accessibility settings. Each reports the first option that matches.

| Component | Group | In visitorId | Always hashed |
| --- | --- | --- | --- |
| [`color_gamut`](https://whiskerjs.com/signals/color-gamut/) | prefs | yes | no |
| [`dynamic_range`](https://whiskerjs.com/signals/dynamic-range/) | prefs | yes | no |
| [`forced_colors`](https://whiskerjs.com/signals/forced-colors/) | prefs | yes | no |
| [`prefers_contrast`](https://whiskerjs.com/signals/prefers-contrast/) | prefs | yes | no |
| [`reduced_motion`](https://whiskerjs.com/signals/reduced-motion/) | prefs | yes | no |

## Not in either id

These nine are reported so your server can use them, but they change too easily (zoom, taskbar, permission grants, keyboard layout, late-loading voices, browser versions, audio output, content blockers) to be part of an identifier. Changing them never changes the visitorId or the structuredId.

| Component | Group | In visitorId | Always hashed |
| --- | --- | --- | --- |
| [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) | none | no | no |
| [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) | none | no | no |
| [`content_blockers`](https://whiskerjs.com/signals/content-blockers/) | none | no | no |
| [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) | none | no | no |
| [`permissions`](https://whiskerjs.com/signals/permissions/) | none | no | yes |
| [`pixel_ratio`](https://whiskerjs.com/signals/pixel-ratio/) | none | no | no |
| [`screen_frame`](https://whiskerjs.com/signals/screen-frame/) | none | no | no |
| [`speech_voices`](https://whiskerjs.com/signals/speech-voices/) | none | no | yes (`none` plain) |
| [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) | none | no | no |

## What every signal has in common

- **Always present.** Every one of the 46 components is in every result with exactly one status: `ok`, `unavailable`, `blocked`, `noisy`, `excluded` or `timed_out`. A non-ok status carries a short [ruleId](https://whiskerjs.com/glossary/#ruleid) saying why. See [Statuses and reason codes](https://whiskerjs.com/docs/how-it-works/#statuses-and-reason-codes).
- **Its own clock.** Each component has an inner timeout of 1000 ms, and the whole call has a budget (`timeoutMs`, 5000 ms by default).
- **No prompts, no network, no storage.** No signal asks for a permission, makes a request or writes anything. See [Privacy](https://whiskerjs.com/docs/privacy/).
- **Excluded where a browser randomises it on purpose.** Brave’s [farbling](https://whiskerjs.com/glossary/#farbling) and Firefox [resistFingerprinting](https://whiskerjs.com/glossary/#resistfingerprinting) remove some components through the [exclusion table](https://whiskerjs.com/glossary/#exclusion-table), instead of WhiskerJS working around them.

## Left out on purpose

WebRTC (even without addresses), media device lists, network information, battery, geolocation, storage quota and user-agent parsing are not collected, because they need a network-capable API, a permission-coupled API or console output, or because they change too easily. See [the Signals reference](https://whiskerjs.com/docs/signals/#left-out-on-purpose).

## Questions and answers

### How many signals does WhiskerJS read?

46 components at signalsVersion 5. 37 of them are stable and make up the visitorId and the seven parts of the structuredId; the other 9 are reported but kept out of both ids.

### Can I turn a signal off?

Yes. Pass its name in collect({ exclude: [...] }). It then reports status excluded with ruleId caller_excluded, and a stable component counts as missing in both ids, so a different exclude list gives different ids.

### Are the uniqueness or entropy of each signal measured?

Not yet. No per-signal entropy or uniqueness figure for WhiskerJS has been measured, so these pages describe why a signal tends to differ between devices without giving numbers.

## Related pages

- [Signals reference (one page)](https://whiskerjs.com/docs/signals/): Every component on a single page, for reading straight through.
- [Identifiers](https://whiskerjs.com/docs/identifiers/): How the visitorId and structuredId are derived from the stable components.
- [How it works](https://whiskerjs.com/docs/how-it-works/): Statuses, reason codes, hashing and the exclusion table.
- [Glossary](https://whiskerjs.com/glossary/): Short definitions of the terms used on these pages.
- [Browser support matrix](https://whiskerjs.com/browsers/support-matrix/): Which signals each browser family offers, and which WhiskerJS excludes.


---

# apple_pay

> Whether the browser offers Apple Pay, the highest Apple Pay JS version it supports, and whether it says it can pay. No payment sheet is shown and no request is made.

Source: https://whiskerjs.com/signals/apple-pay/ (last updated 2026-10-26)

**apple_pay at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `apple_pay` |
| In the visitorId | yes |
| structuredId group | [browser (engine and build)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 2](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Safari and other browsers built on Apple’s WebKit can offer Apple Pay to web pages. This signal records whether the browser offers it at all, which version of Apple’s web payment interface it supports, and whether it says it can make payments. It never starts a payment and never shows anything to the user. On browsers without Apple Pay it simply reports `none`.

## What it reads

- whether `window.ApplePaySession` exists and is a function;
- the highest version from 20 down to 1 that `ApplePaySession.supportsVersion(v)` accepts;
- the answer of `ApplePaySession.canMakePayments()`.

Nothing else: no merchant identifier, no card information, no session object.

## How the technique works

1. If `ApplePaySession` is not a function, the component reports `none` straight away.
2. Otherwise it calls `supportsVersion(20)`, then 19, and so on down to 1, and stops at the first version that returns true. If a call throws, the loop stops and the version found so far is kept (0 when none was found). When `supportsVersion` is missing, the version stays 0.
3. It calls `canMakePayments()` once. The result is written as `1` (true), `0` (false), `blocked` (the call threw) or `-` (the method does not exist).
4. The value is `version=<n>;can_pay=<x>`.

Neither call shows a payment sheet, and WhiskerJS never constructs an `ApplePaySession`, which is the step that would start a payment.

## Why it helps

Apple Pay JS versions follow the WebKit release and the operating system version, and `canMakePayments()` depends on the device (for example whether it has the hardware and settings for Apple Pay). Together they separate WebKit builds from each other and separate Apple-platform browsers from all others. On non-Apple browsers the value is the same `none` everywhere, so it adds nothing there; its value is on Apple devices.

## Stability

- The supported version changes when Safari or the operating system is updated, which also changes the visitorId and the `browser` part of the structuredId.
- `can_pay` can change if the user sets up or removes Apple Pay on the device. That is uncommon, but it does move the id.
- On non-Apple browsers it is stable: always `none`.

## Browser support and what blocks it

- **Safari on macOS and iOS**: `ApplePaySession` exists, so you see a version and a `can_pay` value. See [Safari on macOS](https://whiskerjs.com/browsers/safari-macos/) and [Safari and iOS browsers](https://whiskerjs.com/browsers/safari-ios/).
- **Other iOS browsers** run on WebKit too; whether they expose `ApplePaySession` depends on the browser and the iOS version, so expect either a version or `none`.
- **Chrome, Edge, Brave, Samsung Internet, Firefox** on other systems: `none`. See [Chrome on desktop](https://whiskerjs.com/browsers/chrome-desktop/) and [Firefox](https://whiskerjs.com/browsers/firefox/).
- `canMakePayments()` throws in insecure contexts and in some cross-origin frames; then `can_pay=blocked`.

## Privacy

The value says whether a device is set up for Apple Pay in general. It reveals no card, no account and no merchant relationship. WhiskerJS does not request a payment, does not show a sheet and makes no request. Like every device signal it can still help recognise a device, so it belongs in the notice your site gives users; see [Privacy](https://whiskerjs.com/docs/privacy/).

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | always when the collector runs: `none`, or `version=<n>;can_pay=<x>` |
| `excluded` | `caller_excluded` | you passed `apple_pay` in `collect({ exclude })` |
| `timed_out` | `timeout`, `aborted` | the inner timeout (1000 ms) or the overall budget ran out, or the abort signal fired |
| `blocked` | `threw`, `security_error` | an unexpected error outside the guarded calls |

Errors inside `supportsVersion` and `canMakePayments` are caught and turned into part of the value (`can_pay=blocked`, or a lower version), so they do not make the whole component fail. The value is short printable ASCII, so it is never hashed. No browser class excludes it.

## Example value

On the three headless test browsers run in a Linux container (Chromium, Firefox and WebKit), `apple_pay` was `{ status: 'ok', value: 'none', hashed: false }`: Linux WebKit builds have no Apple Pay. On a Mac or iPhone with Safari the value has the form `version=14;can_pay=1` (illustrative).

## Questions and answers

### Does apple_pay show a payment sheet or contact Apple?

No. WhiskerJS only checks that ApplePaySession exists and calls supportsVersion() and canMakePayments(), which answer locally. It never creates a session, so no sheet appears and no request is made.

### Why does my Chrome on Windows report none?

Outside Apple's WebKit there is no ApplePaySession, so the component reports the plain value none. That is an ok status, not a failure.

### What does can_pay=blocked mean?

canMakePayments() threw, which browsers do in contexts where Apple Pay is not allowed, such as insecure pages or some cross-origin frames. The value still joins the id as it is.

## Related pages

- [private_click](https://whiskerjs.com/signals/private-click/): Another WebKit-only signal in the browser group.
- [browser_class](https://whiskerjs.com/signals/browser-class/): How WhiskerJS classes Safari and every iOS browser.
- [Safari on macOS](https://whiskerjs.com/browsers/safari-macos/): What works and what is blocked in Safari.
- [Safari and every iOS browser](https://whiskerjs.com/browsers/safari-ios/): Why all iOS browsers look like Safari to WhiskerJS.


---

# audio_latency

> The audio output's base latency from AudioContext.baseLatency, read only in Safari and on Android. Nothing is played; not in either id.

Source: https://whiskerjs.com/signals/audio-latency/ (last updated 2026-10-26)

**audio_latency at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `audio_latency` |
| In the visitorId | no (reported, kept out of both ids) |
| structuredId group | none |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 3](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Every audio output adds a small delay between a sound being made and it being heard. Browsers report a base value for that delay, which depends on the audio hardware and system. WhiskerJS reads it only where that is quiet (Safari and Android browsers), never plays anything, and keeps it out of the identifiers because it follows whatever output device is in use.

## What it reads

`AudioContext.baseLatency` (or the `webkitAudioContext` form), in seconds.

## How the technique works

1. If the browser class is not `safari` and the user agent does not contain `Android`, the component reports `unavailable` with ruleId `skipped` and creates nothing.
2. Otherwise it creates an `AudioContext`, reads `baseLatency` and closes the context immediately in a `finally` block (errors while closing are ignored).
3. The number is rounded to six decimals.

## Why it helps

The value follows the audio stack and output device, which differs between phone models and Mac setups. It gives your server extra context where many other values are the same, for example among iPhones.

It is deliberately limited to places where reading it is silent for the user and the console. That choice follows the library’s rules: no console output, no sound, nothing that a careful site owner would notice as a side effect.

## Stability

Medium: it changes with the output device (speaker, headphones, Bluetooth). That is why it is outside both ids.

## Browser support and what blocks it

| Where | Result |
| --- | --- |
| [Safari on macOS](https://whiskerjs.com/browsers/safari-macos/), [Safari and every iOS browser](https://whiskerjs.com/browsers/safari-ios/) (all classed `safari`) | read |
| Android browsers: [Chrome Android](https://whiskerjs.com/browsers/chrome-android/), [Samsung Internet](https://whiskerjs.com/browsers/samsung-internet/), Firefox on Android | read |
| Desktop [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/), [Brave](https://whiskerjs.com/browsers/brave/), [Firefox](https://whiskerjs.com/browsers/firefox/) | `unavailable` / `skipped` |

No browser class excludes it through the exclusion table; the skip is the collector’s own rule.

## Privacy

A latency figure says little more than “this kind of audio hardware”. No sound is played, no microphone is touched and no audio device is opened for recording.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | seconds, up to six decimals |
| `unavailable` | `skipped` | not Safari and not Android |
| `unavailable` | `no_api` | no `AudioContext` |
| `unavailable` | `no_value` | `baseLatency` is not a finite number |
| `blocked` | `threw`, `security_error` | creating the context throws |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

## Example value

In the container test, headless WebKit (classed `safari`) reported `0.002902`; headless Chromium and Firefox reported `unavailable` / `skipped`.

## Questions and answers

### Why is audio_latency skipped in Chrome on my computer?

Creating an AudioContext outside a user gesture makes desktop Chromium and Firefox print an autoplay warning in the console, and WhiskerJS writes nothing to the console. So it reports unavailable with ruleId skipped there. Nothing is wrong with the browser.

### Does it play a sound?

No. It creates an AudioContext, reads one property and closes the context at once.

## Related pages

- [audio](https://whiskerjs.com/signals/audio/): The offline audio render, in the id.
- [Safari on macOS](https://whiskerjs.com/browsers/safari-macos/): One of the places it is read.
- [Chrome on Android](https://whiskerjs.com/browsers/chrome-android/): Android browsers are the other.


---

# audio

> A short sound rendered offline through a compressor; the last 500 samples are reported as a digest. Nothing is played.

Source: https://whiskerjs.com/signals/audio/ (last updated 2026-10-26)

**audio at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `audio` |
| In the visitorId | yes |
| structuredId group | [audio](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | always a digest (first 128 bits of SHA-256) |
| Excluded under | Brave (brave_farbling) |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> WhiskerJS asks the browser to compute a short test tone and pass it through a sound compressor, all in memory, without playing anything. The exact numbers that come out depend on how the browser, the operating system and the processor do floating-point maths, so they differ slightly between devices. WhiskerJS keeps only a short code (a digest) of the end of the sound.

## What it reads

`audio` creates an `OfflineAudioContext` (or the older `webkitOfflineAudioContext`) with 1 channel, 5000 frames at 44100 Hz. Inside it:

- an oscillator with type `triangle` at 10000 Hz;
- a dynamics compressor with threshold -50, knee 40, ratio 12, attack 0 and release 0.25;
- oscillator to compressor to the context’s destination.

It starts the oscillator, renders the buffer with `startRendering()`, takes channel 0 and keeps the last 500 samples as 32-bit floats. Those 2000 bytes are hashed.

## How the technique works

An offline audio context computes sound as fast as it can into memory instead of sending it to speakers. The triangle wave is a simple, known input; the compressor applies non-linear gain changes that exercise the audio engine’s maths. Small differences in how engines implement these nodes, and in the CPU’s floating-point behaviour, show up in the last digits of the samples. If all 500 samples are zero, the render produced silence (a sign of blocking), and the component is reported `blocked` / `silent` instead of hashing zeros.

## Why it helps

The audio stack differs between browser engines (Chromium, Gecko, WebKit), their versions, operating systems and CPU families, while the same setup usually produces exactly the same samples. It is the only member of the `audio` group of the [structuredId](https://whiskerjs.com/glossary/#structured-id), so a change in that part points straight at the audio stack.

## Stability

It can change with a browser update that touches the Web Audio implementation, an operating system update, or a change of CPU architecture. WhiskerJS renders it once only: unlike `canvas` and `webgl_image`, there is no double render, so a browser or extension that randomises audio reads every time would give a new digest on every run and change the visitorId. Browsers known to do this on purpose are handled through the [exclusion table](https://whiskerjs.com/docs/how-it-works/#the-exclusion-table) instead.

## Browser support and what blocks it

- `ok` in all current browsers with Web Audio: [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/), [Firefox](https://whiskerjs.com/browsers/firefox/), [Safari](https://whiskerjs.com/browsers/safari-macos/) and mobile browsers.
- [Brave](https://whiskerjs.com/browsers/brave/): `excluded` / `brave_farbling`.
- Not excluded under [Firefox resistFingerprinting](https://whiskerjs.com/browsers/firefox-rfp-and-tor/).
- `blocked` / `silent` when a blocker makes the render return only zeros.

## Privacy

The output is a computed test tone, not a recording: no microphone, no playback, no audio device. It reveals how the device computes audio and leaves only as a 32-character digest. No permission, no prompt, no request.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | rendered; value is a digest |
| `unavailable` | `no_api` | no `OfflineAudioContext` |
| `blocked` | `no_buffer` | the render gave no buffer |
| `blocked` | `short_buffer` | fewer than 5000 samples |
| `blocked` | `silent` | the last 500 samples were all zero |
| `blocked` | `security_error`, `threw` | creating or rendering the context threw or rejected |
| `unavailable` | `no_digest` | no Web Crypto |
| `excluded` | `brave_farbling`, `caller_excluded` | exclusion table or your list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, budget, abort |

## Example value

From a headless Chromium test browser in a container:

```json
"audio": { "status": "ok", "value": "40febf1c331d3bd4c550bd46ce0e1813", "hashed": true }
```

## Questions and answers

### Does the audio signal play a sound or use the microphone?

No. The sound is rendered offline into a buffer in memory. No audio device is opened, nothing is played and the microphone is never touched.

### Why is audio excluded in Brave?

Brave adds per-site, per-session noise to audio reads. Reading it would only make the id change, so the exclusion table skips it and reports brave_farbling.

### Is audio checked for noise like canvas?

No. audio is rendered once and has no double render. A browser that adds random noise to every audio read would change the digest from run to run, which is why such browsers belong in the exclusion table.

## Related pages

- [audio_latency](https://whiskerjs.com/signals/audio-latency/): The output latency, outside the ids.
- [Offline audio rendering](https://whiskerjs.com/glossary/#offline-audio-rendering): How a page renders sound without playing it.
- [Farbling](https://whiskerjs.com/glossary/#farbling): Brave's per-site randomisation.
- [Brave](https://whiskerjs.com/browsers/brave/): Where audio is excluded.
- [The exclusion table](https://whiskerjs.com/docs/how-it-works/#the-exclusion-table): Which browsers skip which signals.


---

# browser_class

> WhiskerJS's own guess at the browser family: brave, firefox_rfp, firefox, safari, chromium or other. It picks the exclusion row and joins the id.

Source: https://whiskerjs.com/signals/browser-class/ (last updated 2026-10-26)

**browser_class at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `browser_class` |
| In the visitorId | yes |
| structuredId group | [browser (engine and build)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Before measuring anything, WhiskerJS makes a quick guess at which kind of browser it is in: Brave, Firefox with its anti-fingerprinting mode, Firefox, Safari, a Chromium-based browser, or something else. That guess decides which signals are skipped because the browser randomises them on purpose, and it is also reported as a signal of its own. It is a guess from what the browser says about itself, not proof.

## What it reads

- `navigator.brave` and whether `navigator.brave.isBrave` is a function;
- the user agent string (`navigator.userAgent`);
- whether `mozInnerScreenX` exists on the window (a Firefox-only property);
- `navigator.vendor`;
- whether `window.chrome` exists;
- for Firefox only, the [resistFingerprinting](https://whiskerjs.com/glossary/#resistfingerprinting) traits: the Intl time zone, `screen` and `avail*` sizes, `innerWidth` and `innerHeight`, `devicePixelRatio`, `screenX`, `screenY` and `navigator.webdriver`.

## How the technique works

The checks run in this order and the first match wins:

1. **brave**: `navigator.brave.isBrave` is a function.
2. **firefox** or **firefox_rfp**: the user agent contains `Firefox/` followed by a number, or the window has `mozInnerScreenX`. It is `firefox_rfp` only when every one of these holds at once: the time zone is `UTC`, `Etc/UTC` or `Atlantic/Reykjavik`; `navigator.webdriver` is not true; the screen is exactly the size of the content area (`innerWidth`, `innerHeight`); the available screen equals the screen; `devicePixelRatio` is 1; and `screenX` and `screenY` are 0. Otherwise it is `firefox`.
3. **chromium**: the user agent contains `Chrome/` or `Chromium/` followed by a number at a word boundary, or `window.chrome` exists and the vendor is `Google Inc.`.
4. **safari**: the vendor is `Apple Computer, Inc.`, or the user agent has both `Safari/` and `Version/`.
5. **other**: none of the above, or something threw.

The class picks a row of the [exclusion table](https://whiskerjs.com/docs/how-it-works/#the-exclusion-table): `brave` removes seven components, `firefox_rfp` removes nine, the others remove none.

## Why it helps

The class separates engine families in one short word, and because it is in the id, a browser that changes family on the same device changes the id. Its main job is internal, though: it keeps randomised values (Brave farbling, Firefox resistFingerprinting) out of the id instead of letting them change it on every visit.

## Stability

It changes only when the browser changes family, when a user switches Firefox resistFingerprinting on or off, or when a user agent switcher changes what the browser claims. The `firefox_rfp` test is deliberately strict: each trait alone is common in stock Firefox, and stock Firefox under automation (Playwright runs it in UTC with the screen equal to the viewport) matches several. A missed resistFingerprinting browser only leaves normalised values in; a false positive would drop nine components, seven of them from the id. That was fixed in signalsVersion 5; see [What’s new](https://whiskerjs.com/whats-new/).

## Browser support and what blocks it

| Browser | Class |
| --- | --- |
| [Chrome desktop](https://whiskerjs.com/browsers/chrome-desktop/), [Chrome Android](https://whiskerjs.com/browsers/chrome-android/), [Edge](https://whiskerjs.com/browsers/edge/), [Samsung Internet](https://whiskerjs.com/browsers/samsung-internet/) | `chromium` (their user agents carry `Chrome/`) |
| [Brave](https://whiskerjs.com/browsers/brave/) | `brave` |
| [Firefox](https://whiskerjs.com/browsers/firefox/) | `firefox` |
| [Firefox with resistFingerprinting, Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/) | `firefox_rfp` when every trait holds, else `firefox` |
| [Safari on macOS](https://whiskerjs.com/browsers/safari-macos/) | `safari` |
| [Every iOS browser](https://whiskerjs.com/browsers/safari-ios/) (Safari, Chrome `CriOS`, Firefox `FxiOS`, Edge `EdgiOS`) | `safari`: they all report the Apple vendor and carry no `Chrome/` or `Firefox/` token |
| Headless Chromium with a `HeadlessChrome` user agent and no `window.chrome` | `other` |

Nothing blocks it: the checks only read properties and never throw out of the collector.

## Privacy

The class is a coarse category shared by millions of browsers. It reveals no version and no personal setting, except that `firefox_rfp` says the user has turned on (or uses a browser with) resistFingerprinting.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | always when it runs: one of the six class names |
| `excluded` | `caller_excluded` | you excluded it; the exclusion table still uses the class internally |
| `timed_out` | `timeout`, `aborted` | budget or abort, which is unlikely for a synchronous check |

If any read throws, the class falls back to `other` rather than failing. The value is never hashed. Related integrity checks: [`engine_mismatch`](https://whiskerjs.com/docs/integrity/#engine_mismatch) compares the class with the printed length of `eval` (33 characters in V8, 37 in Gecko and WebKit) and `navigator.productSub`; it is not checked for class `other`.

## Example value

From the headless test browsers in a Linux container: Firefox gave `firefox`, WebKit gave `safari`, and headless Chromium gave `other` (its user agent says `HeadlessChrome` and it has no `window.chrome`). A normal desktop Chrome reports `chromium`.

## Questions and answers

### Why is Chrome on my iPhone classed safari?

Every iOS browser runs on Apple's WebKit, reports the vendor Apple Computer, Inc. and has no Chrome/ token in its user agent (Chrome on iOS says CriOS). WhiskerJS follows the engine, so it is classed safari.

### Why did headless Chromium come out as other?

Its user agent says HeadlessChrome, which does not match the Chrome/ token at a word boundary, and the old headless mode has no window.chrome object. Neither chromium rule matches, so the class is other.

### Can I trust browser_class to tell me the real browser?

No. It is a guess from values the client controls. Use it as a feature, compare it with the User-Agent header your server sees, and look at the engine_mismatch flag.

## Related pages

- [The exclusion table](https://whiskerjs.com/docs/how-it-works/#the-exclusion-table): What each class removes, and why.
- [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): The strict test for the firefox_rfp class.
- [Brave](https://whiskerjs.com/browsers/brave/): Recognised by navigator.brave.isBrave.
- [engine_mismatch flag](https://whiskerjs.com/docs/integrity/#engine_mismatch): Fires when the code behaves like a different engine than the class says.
- [vendor](https://whiskerjs.com/signals/vendor/): One of the inputs to the class.


---

# canvas_readback

> A tamper probe: two known colours painted into a 1x1 canvas and read back. exact means untouched readback; altered means something adds noise. Not in either id.

Source: https://whiskerjs.com/signals/canvas-readback/ (last updated 2026-10-26)

**canvas_readback at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `canvas_readback` |
| In the visitorId | no (reported, kept out of both ids) |
| structuredId group | none |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 3](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Some browsers and privacy extensions change a few pixels whenever a page reads an image back from a canvas, to make canvas fingerprints useless. WhiskerJS paints two exact colours into a single pixel and reads them back. If they come back unchanged it reports `exact`; if not, `altered`. It is a diagnostic about the browser’s settings, so it is kept out of the identifiers.

## What it reads

The RGBA bytes of a 1x1 2D canvas after painting it, through `getImageData(0, 0, 1, 1)`.

## How the technique works

1. A canvas element is created and sized 1x1; a 2D context is taken.
2. It is filled with `rgb(17, 34, 51)` and read back; then with `rgb(204, 153, 102)` and read back. These opaque colours survive premultiplied alpha exactly in every engine.
3. If any read returns bytes other than the colour and alpha 255, the value is `altered` at once; if both match, `exact`.

## Why it helps

It turns canvas tampering into a signal of its own. Your server can see that a browser alters readback even when the [`canvas`](https://whiskerjs.com/signals/canvas/) component does not look noisy (for example when the change is the same on every read), and can weigh the graphics group accordingly.

## Stability

High for a given browser and its settings, but it follows those settings: turning an extension or a protection mode on or off flips it. That is why it is outside both ids.

## Browser support and what blocks it

- Works wherever a 2D canvas exists: [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Firefox](https://whiskerjs.com/browsers/firefox/), [Safari](https://whiskerjs.com/browsers/safari-macos/), [iOS browsers](https://whiskerjs.com/browsers/safari-ios/), [Edge](https://whiskerjs.com/browsers/edge/), [Brave](https://whiskerjs.com/browsers/brave/).
- Browsers or modes that randomise or block readback report `altered`, or `blocked` when `getImageData` throws. Unlike `canvas`, this probe is not excluded under Brave or Firefox resistFingerprinting, so there it tells you what the browser does.

## Privacy

It reveals only whether canvas reads are altered, which suggests a privacy setting or extension. WhiskerJS does not try to work around the alteration.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | `exact` or `altered` |
| `unavailable` | `no_document` | no `document` or `createElement` |
| `unavailable` | `no_api` | the element has no `getContext` |
| `unavailable` | `no_context` | no 2D context, or no `getImageData` or `fillRect` |
| `unavailable` | `no_value` | the pixel data is shorter than 4 bytes |
| `blocked` | `security_error`, `threw` | the browser refuses or fails the read |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

Never hashed.

## Example value

All three headless test browsers in the container reported `exact`.

## Questions and answers

### What makes canvas_readback report altered?

A browser setting or an extension that changes pixel data when a page reads a canvas, which is how many anti-fingerprinting tools work. A clean browser returns the exact colours.

### How is this different from canvas being noisy?

canvas renders a full scene twice and compares the exports, so it catches noise that changes between reads. canvas_readback compares one read with the colours it painted, so it also catches a change that is the same on every read.

## Related pages

- [canvas](https://whiskerjs.com/signals/canvas/): The canvas scene, with the double render.
- [Canvas noise](https://whiskerjs.com/glossary/#canvas-noise): Why browsers and extensions alter readback.
- [Noise handling: the double render](https://whiskerjs.com/docs/how-it-works/#noise-handling-the-double-render): How canvas and webgl_image detect noise.
- [native_tampering flag](https://whiskerjs.com/docs/integrity/#native_tampering): Checks whether getImageData and toDataURL look native.


---

# canvas

> A fixed 2D drawing of text, an emoji and blended shapes, exported as an image and reported as a digest.

Source: https://whiskerjs.com/signals/canvas/ (last updated 2026-10-26)

**canvas at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `canvas` |
| In the visitorId | yes |
| structuredId group | [gpu (graphics)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | always a digest (first 128 bits of SHA-256) |
| Excluded under | Brave (brave_farbling); Firefox resistFingerprinting and Tor Browser (firefox_rfp) |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> WhiskerJS draws a small, fixed picture in an invisible canvas: two lines of text with a cat emoji, three overlapping coloured circles and a ring. Every device draws text, emoji and blended colours very slightly differently, so the exact pixels of the picture differ between systems. The picture is never shown and never sent: WhiskerJS turns it into a short code (a digest) in the browser.

## What it reads

The `canvas` component creates a detached `<canvas>` element, takes its 2D context with `getContext('2d')`, sets it to 260 by 80 pixels and draws one fixed scene:

- an orange filled rectangle;
- the text “Whiskers twitch, jumpy fox” followed by a cat face emoji, once in 14 px “Times New Roman” and once in 19 px Arial with a semi-transparent green fill;
- three circles drawn with the `multiply` composite operation, so their overlaps blend;
- a ring made of two arcs filled with the `evenodd` rule.

The canvas is then exported with `toDataURL()`, which returns the image as a PNG data URL. That string is what gets hashed.

## How the technique works

1. Draw the scene once and export it.
2. Draw exactly the same scene again on the same canvas and export it again.
3. If the first export does not start with `data:image/` or is suspiciously short, the browser gave back an empty or fake image: the component is reported `blocked` with ruleId `empty_image`.
4. If the two exports differ, something added random noise between the two reads: the component is reported `noisy` with ruleId `render_mismatch` and carries no value.
5. Otherwise the export is passed to the runner, which hashes it with SHA-256 (canvas is one of the “large” components that are always hashed) and keeps the first 128 bits.

The element is never attached to the page, so nothing appears on screen.

## Why it helps

Turning text and shapes into pixels involves many layers that differ between systems: the font files installed and their versions, the font rasteriser and its anti-aliasing and hinting, the emoji font (each operating system ships its own emoji images), the graphics library that blends colours, and sometimes the GPU. Two devices with the same browser can still produce different pixels, while the same device usually produces the same pixels every time. That makes the digest useful for telling setups apart. It sits in the `gpu` group of the [structuredId](https://whiskerjs.com/glossary/#structured-id) together with the WebGL and WebGPU components.

## Stability

The digest stays the same as long as the drawing pipeline stays the same. It can change after:

- a browser update that changes text rendering or the graphics back end;
- an operating system update that changes fonts or the emoji set;
- a GPU driver update, or switching hardware acceleration on or off;
- installing or removing the fonts the scene uses;
- a private window or an extension that adds noise (the component turns `noisy`, which also changes the visitorId compared with an `ok` run).

When only the `gpu` part of two structuredIds differs, a graphics change like these is a likely cause. See [What changes the id](https://whiskerjs.com/docs/identifiers/#what-changes-the-id).

## Browser support and what blocks it

- All current browsers offer the 2D canvas, so `canvas` is usually `ok` on [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/), [Safari](https://whiskerjs.com/browsers/safari-macos/), [Firefox](https://whiskerjs.com/browsers/firefox/) and mobile browsers.
- [Brave](https://whiskerjs.com/browsers/brave/): `excluded` with ruleId `brave_farbling`, because Brave randomises canvas reads per site and session.
- [Firefox with resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): `excluded` with ruleId `firefox_rfp`, because that mode blocks or fakes canvas readback.
- Browsers or extensions that add noise only sometimes (for example in private windows) give `noisy` / `render_mismatch`.

## Privacy

The image itself contains only the fixed test scene, nothing from the page or the user. It reveals details about the rendering stack (fonts, emoji set, graphics), not personal content. It leaves the library only as a 32-character digest. Drawing on a canvas needs no permission, shows no prompt and makes no network request.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | the scene was drawn twice with identical output; the value is a digest (`hashed: true`) |
| `noisy` | `render_mismatch` | the two exports differed |
| `blocked` | `empty_image` | the export was empty or not an image |
| `blocked` | `security_error`, `threw` | the browser threw while drawing or exporting |
| `unavailable` | `no_document`, `no_api`, `no_context` | no `document`, no `getContext`, or no 2D context |
| `unavailable` | `no_digest` | Web Crypto is missing, so the value cannot be hashed and is not sent raw |
| `excluded` | `brave_farbling`, `firefox_rfp`, `caller_excluded` | the exclusion table or your `exclude` list |
| `timed_out` | `timeout`, `aborted` | the 1000 ms inner timeout, the overall budget or your abort signal |

Any status other than `ok` adds the same placeholder line to the visitorId, so `blocked` in one run and `timed_out` in the next give the same id. The separate [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) probe tells you whether canvas reads are being altered at all.

## Example value

From a headless Chromium test browser in a container:

```json
"canvas": { "status": "ok", "value": "ddf67a6b33259ceea15174ae31a4ac73", "hashed": true }
```

## Questions and answers

### Why does canvas show as excluded in Brave?

Brave adds per-site, per-session noise to canvas reads (it calls this farbling). Reading it would only add noise to the id, so the exclusion table skips canvas for the brave browser class and reports excluded with ruleId brave_farbling.

### What does noisy with render_mismatch mean?

WhiskerJS drew the same scene twice and the two images differed. That only happens when the browser or an extension adds random noise to canvas reads, so the value is left out and the component counts as missing in the visitorId.

### Is the image sent to my server?

No. The exported image is hashed in the browser and only the first 128 bits of its SHA-256 digest leave the library, as 32 hex characters.

## Related pages

- [webgl_image](https://whiskerjs.com/signals/webgl-image/): The WebGL drawing, also rendered twice and checked for noise.
- [canvas_readback](https://whiskerjs.com/signals/canvas-readback/): A 1x1 probe that reports whether canvas reads are exact or altered.
- [fonts_canvas](https://whiskerjs.com/signals/fonts-canvas/): Font detection with canvas text measurement.
- [Canvas fingerprinting](https://whiskerjs.com/glossary/#canvas-fingerprinting): The technique in one definition.
- [The double render](https://whiskerjs.com/docs/how-it-works/#noise-handling-the-double-render): How WhiskerJS spots canvas and WebGL noise.
- [Brave](https://whiskerjs.com/browsers/brave/): Why canvas is excluded there.


---

# color_depth

> The screen's colour depth in bits, usually 24 or 30.

Source: https://whiskerjs.com/signals/color-depth/ (last updated 2026-10-26)

**color_depth at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `color_depth` |
| In the visitorId | yes |
| structuredId group | [device (screen, memory, CPU)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Colour depth is how many bits the screen uses to describe the colour of one pixel. Almost every screen says 24; some wide-colour and HDR setups say 30. It separates only a few groups of devices on its own, but it costs nothing to read and adds to the device picture.

## What it reads

`screen.colorDepth`, reported as a whole number in plain text.

## How the technique works

The value comes straight from the browser’s `screen` object, which reflects the display and the operating system’s colour settings. If it is not a finite number, the component is `unavailable` / `no_api`.

## Why it helps

Few distinct values exist, so the signal is weak alone. It helps in combination: a 30-bit screen narrows the device group, and it moves with display changes that other `device` components may not see. It is in the `device` group of the structuredId. On your server it is also a cheap consistency check: a phone user agent with a 30-bit colour depth, or a value that changes between two requests in the same session, is worth a look together with the other screen values.

## Stability

Very stable. It changes when the window moves to a display with a different colour depth, when HDR or the display’s colour mode is switched in the operating system, or on a different device.

## Browser support and what blocks it

`ok` in all browsers; not in the exclusion table. The container test runs used for these pages reported `24` in headless Chromium, Firefox and WebKit. The same value is compared with a clean iframe by [`iframe_mismatch`](https://whiskerjs.com/docs/integrity/#iframe_mismatch), and its getter is checked by [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering).

Because most displays report 24, expect the same value on most of your traffic; the component then adds little on its own, and its main use is the combination with the other `device` and `prefs` values.

## Privacy

A single coarse number, read without permission or prompt. WhiskerJS sends nothing itself.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | for example `24` |
| `unavailable` | `no_api` | no `screen` or no numeric `colorDepth` |
| `blocked` | `security_error`, `threw` | reading threw |
| `excluded` | `caller_excluded` | your `exclude` list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, budget, abort |

## Example value

```json
"color_depth": { "status": "ok", "value": "24", "hashed": false }
```

## Questions and answers

### What values does color_depth usually have?

Most screens report 24. Some wide-colour or high dynamic range setups report 30. Other values are rare.

### Is color_depth the same as color_gamut?

No. color_depth is the number of bits per pixel the screen reports; color_gamut is the colour space the display covers (srgb, p3 or rec2020), read with a media query.

## Related pages

- [color_gamut](https://whiskerjs.com/signals/color-gamut/): The display's colour space.
- [dynamic_range](https://whiskerjs.com/signals/dynamic-range/): Whether the display is HDR.
- [screen_resolution](https://whiskerjs.com/signals/screen-resolution/): The screen size.
- [iframe_mismatch flag](https://whiskerjs.com/docs/integrity/#iframe_mismatch): Compares colorDepth with a clean frame.


---

# color_gamut

> The widest colour range the display and browser support, from the color-gamut media query: rec2020, p3 or srgb.

Source: https://whiskerjs.com/signals/color-gamut/ (last updated 2026-10-26)

**color_gamut at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `color_gamut` |
| In the visitorId | yes |
| structuredId group | [prefs (display and accessibility preferences)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Screens can show a wider or narrower range of colours. Ordinary monitors cover the standard range (sRGB); many newer phones, laptops and monitors cover a wider one (Display P3), and a few even more (Rec. 2020). The browser lets pages ask which range the screen supports. WhiskerJS records the widest one that matches.

## What it reads

The CSS `color-gamut` media feature through `window.matchMedia()`.

## How the technique works

WhiskerJS asks three queries in this order and reports the first that matches:

| Order | Query | Value reported |
| --- | --- | --- |
| 1 | `(color-gamut: rec2020)` | `rec2020` |
| 2 | `(color-gamut: p3)` | `p3` |
| 3 | `(color-gamut: srgb)` | `srgb` |

A wider gamut also matches the narrower queries, so asking from widest to narrowest gives the real capability. If none matches, the component is `unavailable` with `no_match`.

## Why it helps

It separates wide-gamut displays (common on recent Apple devices and high-end phones and monitors) from standard ones. Only three values exist, so it tells few devices apart alone, but it is a hardware property that rarely changes.

On your server, read it together with the other four preference components. They share the `prefs` part of the [structuredId](https://whiskerjs.com/glossary/#structured-id), so a result where only that part moved usually means a display or accessibility setting changed, not a different device. See [Comparing two results](https://whiskerjs.com/docs/identifiers/#comparing-two-results).

## Stability

Stable for a given main display. It changes when the browser window is on a different monitor, or the user changes the primary display.

## Browser support and what blocks it

Current [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/), [Safari](https://whiskerjs.com/browsers/safari-macos/), [iOS browsers](https://whiskerjs.com/browsers/safari-ios/) and [Firefox](https://whiskerjs.com/browsers/firefox/) answer `color-gamut` queries. A browser that does not understand the feature matches none of them and reports `no_match`. No browser class excludes it.

## Privacy

It describes the display hardware, shared by everyone with similar screens. It is not a personal setting.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | `rec2020`, `p3` or `srgb` |
| `unavailable` | `no_api` | no `matchMedia` |
| `unavailable` | `no_match` | no query matched |
| `blocked` | `threw`, `security_error` | `matchMedia` throws |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

## Example value

All three headless test browsers in the container reported `srgb` (a virtual display). A recent MacBook or iPhone typically reports `p3`.

## Questions and answers

### Why does my MacBook report p3?

Many recent Apple displays and phones cover the Display P3 colour space, and the browser reports that through the color-gamut media query. Most other monitors report srgb.

### Can color_gamut change on the same computer?

Yes, when the browser window moves to another monitor with a different gamut, or a different screen becomes the main display.

## Related pages

- [dynamic_range](https://whiskerjs.com/signals/dynamic-range/): HDR or standard, the other display capability query.
- [color_depth](https://whiskerjs.com/signals/color-depth/): Bits per pixel from screen.colorDepth.
- [screen_resolution](https://whiskerjs.com/signals/screen-resolution/): The screen size.


---

# content_blockers

> Which of eight off-screen bait elements with ad-like names a content blocker hid. No request is made and everything is removed. Not in either id.

Source: https://whiskerjs.com/signals/content-blockers/ (last updated 2026-10-26)

**content_blockers at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `content_blockers` |
| In the visitorId | no (reported, kept out of both ids) |
| structuredId group | none |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 3](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Ad blockers hide page elements whose names look like ads. WhiskerJS puts eight tiny, invisible test boxes with ad-like names on the page for a moment and checks which ones were hidden. That shows whether a blocker is active here, without loading anything. Users switch blockers on and off, so the result is reported but kept out of the identifiers.

## What it reads

Whether each bait element has an `offsetParent` after 50 ms. The baits are 1x1 `div` elements with these selectors: classes `ad-banner`, `adsbox`, `ad-slot`, `banner-ad`, `sponsored-ad`, `textAd`, and ids `ad-unit`, `ad_leaderboard`. They are reported by the keys `ad_banner`, `ad_box`, `ad_slot`, `banner_ad`, `sponsored`, `text_ad`, `ad_unit`, `ad_leaderboard`.

## How the technique works

1. It needs a `document.body`; otherwise `unavailable` / `no_document`.
2. An off-screen container (`position: absolute; left: -9999px`) gets the eight baits and is appended to the body.
3. After 50 ms (time for cosmetic filters to apply), a bait whose `offsetParent` is `null` counts as hidden.
4. If all eight look hidden and the container itself has no `offsetParent`, the page is not laid out (for example `display: none` on the body): `unavailable` / `no_layout`.
5. The value is the keys of the hidden baits, comma-separated, or `none`.
6. The container is removed in a `finally` block, so it leaves nothing behind.

## Why it helps

It tells your server whether cosmetic filtering is active on this page, and roughly which kind of filter list: different blockers and lists hide different subsets of the baits. It also helps explain other values, such as missing page elements.

## Stability

Low to medium: users enable and disable blockers per site, and filter lists update. Outside both ids for that reason.

## Browser support and what blocks it

Works in any browser with a laid-out page: [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Firefox](https://whiskerjs.com/browsers/firefox/), [Safari](https://whiskerjs.com/browsers/safari-macos/), [iOS browsers](https://whiskerjs.com/browsers/safari-ios/), [Edge](https://whiskerjs.com/browsers/edge/). [Brave](https://whiskerjs.com/browsers/brave/) has a built-in blocker, so baits may be hidden there by default. Pages that are hidden or not laid out give `no_layout`. On slow or emulated setups the 50 ms wait plus layout can exceed the 1000 ms inner timeout.

## Privacy

It reveals whether an ad blocker hides these names on this page. No ad or filter list is loaded, nothing is requested, and the elements are removed before `collect()` resolves. Leave it out with `collect({ exclude: ['content_blockers'] })` if you do not need it; no id changes.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | `none` or a list of hidden bait keys |
| `unavailable` | `no_document` | no `document.body` |
| `unavailable` | `no_layout` | the container itself is not laid out |
| `blocked` | `threw`, `security_error` | adding the elements throws |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

## Example value

In the container test, headless Chromium and Firefox reported `none`; headless WebKit reported `timed_out` / `timeout` (the run was slow under emulation). With a common ad blocker you might see something like `ad_banner,ad_box,banner_ad`.

## Questions and answers

### Does WhiskerJS load ads or test URLs to detect blockers?

No. It only adds eight small elements with ad-like class names and ids to the page, waits 50 ms and checks which were hidden. No request is made, and the names are WhiskerJS's own, not copied from any filter list.

### What does none mean?

No bait was hidden: either no content blocker is active on this page, or the blocker does not hide these names. It is not proof that no blocker is installed.

### Why is it not in the visitorId?

Users turn blockers on and off per site and filter lists update often, so the value changes too easily.

## Related pages

- [canvas_readback](https://whiskerjs.com/signals/canvas-readback/): Another diagnostic about the browser setup.
- [Content blocker](https://whiskerjs.com/glossary/#content-blocker): What cosmetic filtering is.
- [Privacy](https://whiskerjs.com/docs/privacy/): The hidden elements and when they are removed.


---

# cpu_architecture

> The high byte of a computed NaN, which differs between x86 (255) and ARM (127) processors.

Source: https://whiskerjs.com/signals/cpu-architecture/ (last updated 2026-10-26)

**cpu_architecture at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `cpu_architecture` |
| In the visitorId | yes |
| structuredId group | [device (screen, memory, CPU)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 2](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> When a computer works out “infinity minus infinity”, the answer is a special “not a number” value. Intel and AMD processors write that value with one bit set, ARM processors (phones, Apple Silicon Macs) without. WhiskerJS does this one calculation and reads the bit. It tells the two big processor families apart even when the browser hides them in its user agent.

## What it reads

A one-element `Float32Array` shares its buffer with a `Uint8Array`. WhiskerJS stores `Infinity`, then `Infinity - Infinity` in the float, and reports byte 3 of the buffer (the high byte on little-endian machines) as a plain number.

## How the technique works

```js
// The idea, in a few lines of browser JavaScript:
const f = new Float32Array(1);
const bytes = new Uint8Array(f.buffer);
f[0] = Infinity;
f[0] = f[0] - f[0];      // NaN, with a bit pattern chosen by the CPU
bytes[3];                // 255 on x86, 127 on ARM
```

IEEE 754 leaves the sign of a generated NaN to the hardware. x86 produces the “default NaN” with the sign bit set (top byte `0xFF`), while ARM produces it without (top byte `0x7F`). The calculation is pure: no API, no permission, no timing.

## Why it helps

It is a robust CPU family hint that does not depend on what the browser chooses to say about itself. Your server can compare it with the platform, the user agent header and, in Chromium, the `arch` field of [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/). It is in the `device` group.

## Stability

Very stable: it changes only when the code runs on a different CPU family, for example a new device, or a browser running under an emulation layer that translates x86 code to ARM or the other way round.

## Browser support and what blocks it

`ok` in all browsers with typed arrays, which is every current browser, and not in the exclusion table. It is `unavailable` / `no_api` only where `Float32Array` or `Uint8Array` is missing. The container test runs used for these pages, on an ARM host, reported `127` in headless Chromium, Firefox and WebKit.

## Privacy

Two possible values in practice, about the processor family only. No permission, no prompt, no request.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | `255` or `127` |
| `unavailable` | `no_api` | no typed arrays |
| `blocked` | `security_error`, `threw` | the calculation threw (not expected) |
| `excluded` | `caller_excluded` | your `exclude` list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, budget, abort |

## Example value

```json
"cpu_architecture": { "status": "ok", "value": "127", "hashed": false }
```

## Questions and answers

### How can a calculation reveal the processor?

Infinity minus Infinity gives NaN, and the processor decides the NaN's bit pattern. x86 chips set the sign bit and ARM chips do not, so the top byte of the 32-bit float is 255 on x86 and 127 on ARM.

### Can it tell an Apple Silicon Mac from an Intel Mac?

It reports the CPU family the JavaScript engine runs on, so an ARM-based Mac and an x86-based Mac give different values, even though both may send similar user agents.

## Related pages

- [ua_client_hints](https://whiskerjs.com/signals/ua-client-hints/): Architecture from Client Hints, Chromium only.
- [platform](https://whiskerjs.com/signals/platform/): navigator.platform.
- [hardware_concurrency](https://whiskerjs.com/signals/hardware-concurrency/): CPU threads.
- [Signal group](https://whiskerjs.com/glossary/#signal-group): cpu_architecture is in the device group.


---

# device_memory

> Approximate device memory in GB, in coarse buckets. Offered only by Chromium-based browsers.

Source: https://whiskerjs.com/signals/device-memory/ (last updated 2026-10-26)

**device_memory at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `device_memory` |
| In the visitorId | yes |
| structuredId group | [device (screen, memory, CPU)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Chrome and other Chromium-based browsers tell pages roughly how much memory the device has, rounded to a few fixed steps such as 4 or 8 GB, so sites can serve lighter pages to small devices. Safari, every browser on iPhone and iPad, and Firefox do not offer this. WhiskerJS reads it where it exists and reports “unavailable” elsewhere, which is expected.

## What it reads

`navigator.deviceMemory`, reported as a plain number when it is a finite number.

## How the technique works

The browser rounds the real memory to a coarse value before exposing it, so pages only learn a bucket. WhiskerJS reads the property; a missing property gives `unavailable` / `no_api`, a throwing getter `blocked`.

## Why it helps

The bucket separates device classes (small phones, mid-range laptops, large desktops) and combines with CPU threads, architecture and the heap limit in the `device` group. Its absence also carries information: an `unavailable` value next to a Chrome user agent is unusual and worth a look on your server.

## Stability

Fixed for a given device and browser. It changes only on a different device, or when a browser changes its bucketing.

## Browser support and what blocks it

- `ok` in Chromium-based browsers: [Chrome desktop](https://whiskerjs.com/browsers/chrome-desktop/), [Chrome on Android](https://whiskerjs.com/browsers/chrome-android/), [Edge](https://whiskerjs.com/browsers/edge/), [Brave](https://whiskerjs.com/browsers/brave/) (not in Brave’s exclusion row), [Samsung Internet](https://whiskerjs.com/browsers/samsung-internet/).
- `unavailable` / `no_api` by design in [Safari on macOS](https://whiskerjs.com/browsers/safari-macos/), [every iOS browser](https://whiskerjs.com/browsers/safari-ios/) and [Firefox](https://whiskerjs.com/browsers/firefox/).

The early lab sample, an early, small sample at signalsVersion 1, not a benchmark, matched this: `device_memory` was `unavailable` on Mac Safari, iPhone Safari and iPhone Chrome (which runs on WebKit), and each of the four device-browser pairs still kept one id across its runs.

Related checks: [`impossible_hardware`](https://whiskerjs.com/docs/integrity/#impossible_hardware) fires when the value is a number but not a power of two from 0.25 to 64, [`navigator_own_property`](https://whiskerjs.com/docs/integrity/#navigator_own_property) and [`iframe_mismatch`](https://whiskerjs.com/docs/integrity/#iframe_mismatch) look at the same property.

## Privacy

A coarse bucket chosen by the browser to limit what pages learn. Read without permission or prompt, never sent by WhiskerJS.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | for example `8` |
| `unavailable` | `no_api` | not offered (Safari, iOS, Firefox) or not a number |
| `blocked` | `security_error`, `threw` | the getter threw |
| `excluded` | `caller_excluded` | your `exclude` list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, budget, abort |

## Example value

```json
"device_memory": { "status": "ok", "value": "8", "hashed": false }
```

In Safari and Firefox: `{ "status": "unavailable", "ruleId": "no_api" }`.

## Questions and answers

### Why is device_memory unavailable on my iPhone or in Safari?

Only Chromium-based browsers offer navigator.deviceMemory. Safari, every iOS browser (they all run on WebKit) and Firefox do not, so the component is unavailable with ruleId no_api by design.

### Does an unavailable device_memory change the visitorId?

Not from run to run. Every non-ok status adds the same placeholder line, so a browser that never offers the API gives a stable id.

### Can device_memory report my exact RAM?

No. Browsers round it to a coarse bucket, such as 4 or 8, on purpose.

## Related pages

- [heap_limit](https://whiskerjs.com/signals/heap-limit/): The JavaScript heap limit, also Chromium only.
- [hardware_concurrency](https://whiskerjs.com/signals/hardware-concurrency/): CPU threads.
- [impossible_hardware flag](https://whiskerjs.com/docs/integrity/#impossible_hardware): Catches memory values no browser reports.
- [Safari and every iOS browser](https://whiskerjs.com/browsers/safari-ios/): Where it is unavailable.
- [FAQ](https://whiskerjs.com/docs/faq/): Why device_memory is unavailable in Safari.


---

# dynamic_range

> Whether the display and browser support high dynamic range (HDR), from the dynamic-range media query: high or standard.

Source: https://whiskerjs.com/signals/dynamic-range/ (last updated 2026-10-26)

**dynamic_range at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `dynamic_range` |
| In the visitorId | yes |
| structuredId group | [prefs (display and accessibility preferences)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Some screens can show much brighter highlights and deeper shadows than others; this is called high dynamic range, or HDR. Browsers let pages ask whether the current screen supports it. WhiskerJS records the answer, `high` or `standard`.

## What it reads

The CSS `dynamic-range` media feature through `window.matchMedia()`.

## How the technique works

| Order | Query | Value reported |
| --- | --- | --- |
| 1 | `(dynamic-range: high)` | `high` |
| 2 | `(dynamic-range: standard)` | `standard` |

The first match is reported. An HDR display matches both, so `high` is asked first. If neither matches, the component is `unavailable` with `no_match`.

## Why it helps

It separates HDR-capable setups (many recent phones and laptops, some monitors with HDR turned on) from the rest. Two values make it a weak signal alone, but it is cheap and rarely changes.

On your server, read it together with the other four preference components. They share the `prefs` part of the [structuredId](https://whiskerjs.com/glossary/#structured-id), so a result where only that part moved usually means a display or accessibility setting changed, not a different device. See [Comparing two results](https://whiskerjs.com/docs/identifiers/#comparing-two-results).

## Stability

Stable for a given display and setting. It changes with the monitor the window is on and, on systems where HDR is an operating system switch, with that switch.

On laptops that can drive an external HDR monitor, the value can differ between the built-in screen and the external one. If you see `dynamic_range` flip together with [`color_gamut`](https://whiskerjs.com/signals/color-gamut/) while everything else holds, a monitor change is the likely cause.

## Browser support and what blocks it

Current Chromium browsers ([Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/)), [Safari](https://whiskerjs.com/browsers/safari-macos/) and [iOS browsers](https://whiskerjs.com/browsers/safari-ios/) answer it; browser versions that do not know the feature report `no_match`. Check [Firefox](https://whiskerjs.com/browsers/firefox/) results on your own traffic. No browser class excludes it.

## Privacy

A display capability, not a personal preference. Shared by everyone with the same kind of screen and setting.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | `high` or `standard` |
| `unavailable` | `no_api` | no `matchMedia` |
| `unavailable` | `no_match` | neither query matched |
| `blocked` | `threw`, `security_error` | `matchMedia` throws |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

## Example value

All three headless test browsers in the container (Chromium, Firefox, WebKit) reported `standard`.

## Questions and answers

### Does high mean HDR is switched on?

It means the browser reports that the current display can show high dynamic range. On some systems that depends on an HDR setting in the operating system, so switching it changes the value.

### Why only two values?

The dynamic-range media feature only defines high and standard. WhiskerJS asks high first, then standard.

## Related pages

- [color_gamut](https://whiskerjs.com/signals/color-gamut/): The display's colour range.
- [color_depth](https://whiskerjs.com/signals/color-depth/): Bits per pixel.
- [Comparing two results](https://whiskerjs.com/docs/identifiers/#comparing-two-results): A change here moves only the prefs part.


---

# font_preferences

> The width of one sentence in seven default font settings, including the minimum font size, as a digest.

Source: https://whiskerjs.com/signals/font-preferences/ (last updated 2026-10-26)

**font_preferences at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `font_preferences` |
| In the visitorId | yes |
| structuredId group | [fonts](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | always a digest (first 128 bits of SHA-256) |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 3](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Browsers let people choose their default fonts and a minimum text size, and the operating system has its own system font. WhiskerJS writes one sentence in each of these defaults, invisibly, and measures how wide it is. The widths follow the user’s settings and the system, and only a short code of them is kept.

## What it reads

Seven hidden `<span>` elements with the text “Whiskers quietly judge 0123456789”, in one off-screen container (`left: -9999px`, `visibility: hidden`) appended to the body and removed in a `finally` block:

| Name | Style |
| --- | --- |
| `default` | no font family (the browser default) |
| `serif` | `font-family: serif` |
| `sans` | `font-family: sans-serif` |
| `mono` | `font-family: monospace` |
| `system` | `font-family: system-ui` |
| `apple` | `font-family: -apple-system` |
| `min` | browser default family at `font-size: 1px` |

Each span’s `offsetWidth` is read and the seven widths are written as `default=…;serif=…;…;min=…` and hashed.

## How the technique works

Each generic family name maps to a concrete font chosen by the browser settings and the operating system. Measuring the same text in each reveals that mapping without asking for it. `-apple-system` resolves only on Apple platforms, so its width differs elsewhere. The 1 px span is drawn at the browser’s minimum font size. If every width is zero, nothing was laid out and the result is `unavailable` / `no_layout`.

## Why it helps

Users rarely change these settings, but when they do the values differ clearly, and operating systems differ in their default and system fonts. It is part of the `fonts` group of the structuredId.

## Stability

It changes when the user changes the default fonts, the default font size or the minimum font size, or when an operating system or browser update changes the system font or the fonts the generic names map to. The page’s own styles do not matter much, because each span sets its own family and the container sits outside the page flow.

## Browser support and what blocks it

`ok` in every browser with a document and layout; not in the exclusion table. `unavailable` / `no_document` before `document.body` exists, `no_layout` when the body is not laid out. See the [browser pages](https://whiskerjs.com/browsers/) for each family.

## Privacy

It reveals font settings, not content. Only a digest leaves the library. The spans are invisible and removed at once. No permission, no prompt, no request.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | value is a digest |
| `unavailable` | `no_document` | no document or body |
| `unavailable` | `no_layout` | all widths were zero |
| `unavailable` | `no_digest` | no Web Crypto |
| `blocked` | `security_error`, `threw` | the DOM work threw |
| `excluded` | `caller_excluded` | your `exclude` list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, budget, abort |

## Example value

From a headless Chromium test browser in a container:

```json
"font_preferences": { "status": "ok", "value": "374bafbd56b68b15ac31e242b3cc90f7", "hashed": true }
```

## Questions and answers

### What does the 1 px measurement show?

Browsers enforce a minimum font size setting. Text asked for at 1 px is drawn at that minimum, so its width reveals the setting.

### Is font_preferences excluded anywhere?

No. It is not in the exclusion table, so it is read in every browser class, including Brave and Firefox resistFingerprinting.

## Related pages

- [fonts](https://whiskerjs.com/signals/fonts/): Installed font detection.
- [fonts_canvas](https://whiskerjs.com/signals/fonts-canvas/): Canvas-based font detection.
- [languages](https://whiskerjs.com/signals/languages/): Language settings, which can change default fonts.
- [Signal group](https://whiskerjs.com/glossary/#signal-group): font_preferences is in the fonts group.


---

# fonts_canvas

> The same 54 font families, detected with canvas text measurement instead of page layout.

Source: https://whiskerjs.com/signals/fonts-canvas/ (last updated 2026-10-26)

**fonts_canvas at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `fonts_canvas` |
| In the visitorId | yes |
| structuredId group | [fonts](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | always a digest, except the plain value none when nothing is found |
| Excluded under | Brave (brave_farbling) |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 3](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> This is a second way of checking which fonts are installed. Instead of placing text in the page, WhiskerJS asks an invisible canvas how wide a word would be in each font. If a font is missing, the browser falls back to a plain font and the width is the same as the plain font’s. Only a short code of the found fonts is kept.

## What it reads

It creates a detached `<canvas>` and its 2D context. For each of the same 54 families used by [`fonts`](https://whiskerjs.com/signals/fonts/), it sets `ctx.font` to `72px '<family>', <fallback>` for the fallbacks `monospace`, `sans-serif` and `serif`, calls `measureText('mmmmmmmmmmlliWWQ@#0OfiflK')` and compares the width with the fallback alone.

## How the technique works

1. Measure the sample text width in each of the three generic fallbacks.
2. For each family and each fallback, measure the text with the family first in the font stack.
3. A family is present when any of its three widths differs from the matching fallback width.
4. Found families are sorted, joined and hashed; with none found the plain word `none` is reported.

Because `measureText` uses the font engine directly, no element is added to the page and the page’s CSS cannot change the measurement. If all fallback widths are zero or not numbers, there is no usable text layout and the result is `unavailable` / `no_layout`.

## Why it helps

It sees the same font differences as `fonts` through a different path. Canvas text measurement does not depend on the document’s layout or styles, so it still works when the page CSS would disturb span measurement. It sits in the `fonts` group.

## Stability

Like `fonts`: it changes when one of the 54 families is installed or removed, or when an update changes which system fonts the browser exposes.

## Browser support and what blocks it

- `ok` in all browsers with a 2D canvas.
- [Brave](https://whiskerjs.com/browsers/brave/): `excluded` / `brave_farbling` (added to the Brave row in signalsVersion 3), because Brave randomises the visible font set.
- Not excluded under [Firefox resistFingerprinting](https://whiskerjs.com/browsers/firefox-rfp-and-tor/).

## Privacy

Same as `fonts`: it shows which of 54 common families are present, as a digest only. Nothing is drawn on screen, no permission, no prompt, no request.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | digest of the found list, or plain `none` |
| `unavailable` | `no_document`, `no_api`, `no_context` | no document, no `getContext`, no 2D context with `measureText` |
| `unavailable` | `no_layout` | the fallback widths were zero or invalid |
| `unavailable` | `no_digest` | no Web Crypto |
| `blocked` | `security_error`, `threw` | a canvas call threw |
| `excluded` | `brave_farbling`, `caller_excluded` | exclusion table or your list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, budget, abort |

## Example value

From headless Chromium, Firefox and WebKit test browsers in a container (all three found the same families):

```json
"fonts_canvas": { "status": "ok", "value": "e2727c20c7bf4d2b9aa270f3427907a0", "hashed": true }
```

## Questions and answers

### Why measure fonts twice?

The span method in fonts depends on page layout and CSS; the canvas method does not touch the DOM. Two independent methods make the fonts group more robust, and a difference between them can itself be telling.

### Can fonts and fonts_canvas give the same digest?

Yes. Both hash the sorted list of found families in the same form, so when both methods find the same families the digests are equal, as in the container test runs used for these pages.

## Related pages

- [fonts](https://whiskerjs.com/signals/fonts/): The span-width method.
- [font_preferences](https://whiskerjs.com/signals/font-preferences/): Default font settings.
- [canvas](https://whiskerjs.com/signals/canvas/): The 2D canvas image.
- [Font fingerprinting](https://whiskerjs.com/glossary/#font-fingerprinting): The technique.


---

# fonts

> Which of 54 common font families are installed, found by measuring hidden text, reported as a digest.

Source: https://whiskerjs.com/signals/fonts/ (last updated 2026-10-26)

**fonts at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `fonts` |
| In the visitorId | yes |
| structuredId group | [fonts](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | always a digest, except the plain value none when nothing is found |
| Excluded under | Brave (brave_farbling) |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Different computers have different fonts installed, depending on the operating system, its language packs and the software people install. A web page cannot ask for the font list, but it can write a word in a font and see whether its size changes compared with a plain fallback font. WhiskerJS does this, invisibly, for 54 common fonts and keeps only a short code of which ones it found.

## What it reads

The 54 families are a fixed list of fonts common on Windows, macOS, Linux, Android and iOS, for example Arial Black, Calibri, Consolas, Helvetica Neue, Menlo, Noto Color Emoji, Roboto, Segoe UI, SimSun, Ubuntu and Yu Gothic. For each family WhiskerJS creates three `<span>` elements with the sample text `mmmmmmmmmmlliWWQ@#0OfiflK` at 64 px, set to `'<family>', monospace`, `'<family>', sans-serif` and `'<family>', serif`, plus one span per plain fallback. All spans sit in one container placed at `left: -9999px` with `visibility: hidden`, appended to `document.body`, measured, and removed in a `finally` block.

## How the technique works

1. Measure the width and height (`offsetWidth`, `offsetHeight`) of the text in each generic fallback alone.
2. Measure the same text in each family with each fallback behind it.
3. If the family is missing, the browser uses the fallback and the size is identical. If it is installed, at least one width or height differs, and the family counts as present.
4. The found families are sorted and joined; the list is hashed. When none is found, the component reports the plain word `none` instead of a digest.

All spans are created first and measured afterwards, so the browser lays out the container once.

## Why it helps

Installed fonts vary a lot: an office suite, design software or a language pack each add families, and each operating system ships its own set. The list of found families is one of the more distinguishing values in the `fonts` group.

## Stability

It changes when the user installs or removes one of the 54 fonts, when an operating system update adds or removes one, or when a browser restricts which system fonts pages can use. Page zoom does not change which fonts are found.

## Browser support and what blocks it

- `ok` in every browser with a document and layout.
- [Brave](https://whiskerjs.com/browsers/brave/): `excluded` / `brave_farbling`, because Brave randomises the set of fonts visible to pages.
- Browsers or privacy settings that limit pages to a small allowlist of fonts make the found list short; it is still read and reported. [Firefox resistFingerprinting](https://whiskerjs.com/browsers/firefox-rfp-and-tor/) is not excluded for this component.
- `unavailable` / `no_document` without `document.body` (for example when collecting before the body exists), `no_layout` when nothing is laid out.

## Privacy

It reveals which of 54 well-known fonts are present, which can hint at the operating system, languages or installed software. Only a digest of the found list leaves the library. The spans are invisible, exist only for the measurement and are removed at once. No permission, no prompt, no request.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | a digest of the found list, or plain `none` |
| `unavailable` | `no_document` | no `document`, no `document.body` |
| `unavailable` | `no_layout` | the fallback spans had no width |
| `unavailable` | `no_digest` | no Web Crypto |
| `blocked` | `security_error`, `threw` | the DOM work threw |
| `excluded` | `brave_farbling`, `caller_excluded` | exclusion table or your list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, budget, abort |

## Example value

From a headless Chromium test browser in a container:

```json
"fonts": { "status": "ok", "value": "e2727c20c7bf4d2b9aa270f3427907a0", "hashed": true }
```

## Questions and answers

### Can WhiskerJS list every font on my computer?

No. It only tests a fixed list of 54 common families and reports a digest of the ones it found. Fonts outside the list are never seen.

### Why is fonts unavailable with no_layout?

The test spans were added but the page laid nothing out, for example because the body has display none. Without layout there are no widths to compare.

### Why are there two font signals?

fonts measures HTML spans, which needs page layout; fonts_canvas measures text on a canvas, which page CSS cannot disturb. They detect the same 54 families in two independent ways.

## Related pages

- [fonts_canvas](https://whiskerjs.com/signals/fonts-canvas/): The same families, measured on a canvas.
- [font_preferences](https://whiskerjs.com/signals/font-preferences/): The user's default font settings.
- [Font fingerprinting](https://whiskerjs.com/glossary/#font-fingerprinting): The technique in one definition.
- [Brave](https://whiskerjs.com/browsers/brave/): Where both font probes are excluded.


---

# forced_colors

> Whether a forced colour mode is on, such as a Windows contrast theme, from the forced-colors media query: active or none.

Source: https://whiskerjs.com/signals/forced-colors/ (last updated 2026-10-26)

**forced_colors at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `forced_colors` |
| In the visitorId | yes |
| structuredId group | [prefs (display and accessibility preferences)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Some people use a mode where the system replaces every website’s colours with a small set of their own, usually with strong contrast. Windows calls these contrast themes. Browsers tell pages whether such a mode is active. WhiskerJS records `active` or `none`.

## What it reads

The CSS `forced-colors` media feature through `window.matchMedia()`.

## How the technique works

| Order | Query | Value reported |
| --- | --- | --- |
| 1 | `(forced-colors: active)` | `active` |
| 2 | `(forced-colors: none)` | `none` |

The first match is reported; neither matching gives `unavailable` with `no_match`.

## Why it helps

Almost everyone reports `none`, so the value tells most devices nothing. For the users who rely on forced colours it is a long-lasting setting, which makes it stable and distinctive for them.

On your server, read it together with the other four preference components. They share the `prefs` part of the [structuredId](https://whiskerjs.com/glossary/#structured-id), so a result where only that part moved usually means a display or accessibility setting changed, not a different device. See [Comparing two results](https://whiskerjs.com/docs/identifiers/#comparing-two-results).

## Stability

Very stable: people who need forced colours keep them on, and people who do not never switch them on. It changes only when the setting changes.

## Browser support and what blocks it

Current Chromium browsers ([Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/)) and [Firefox](https://whiskerjs.com/browsers/firefox/) understand `forced-colors`; [Safari](https://whiskerjs.com/browsers/safari-macos/) versions that know the feature answer it too, otherwise the result is `no_match`. Forced colour modes are mostly a desktop Windows feature. No browser class excludes it.

## Privacy

This is an accessibility setting. `active` can hint that a user has visual needs, which in some laws can come close to sensitive information. WhiskerJS reads it only to tell devices apart, never shows it anywhere and never decides anything. If you do not need it, leave it out with `collect({ exclude: ['forced_colors'] })` (that changes ids, since it is in the visitorId). See [Privacy](https://whiskerjs.com/docs/privacy/#data-minimisation).

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | `active` or `none` |
| `unavailable` | `no_api` | no `matchMedia` |
| `unavailable` | `no_match` | neither query matched |
| `blocked` | `threw`, `security_error` | `matchMedia` throws |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

## Example value

All three headless test browsers in the container reported `none`.

## Questions and answers

### What turns forced_colors to active?

An operating system or browser mode that replaces page colours with a limited palette chosen by the user, best known as the contrast themes on Windows.

### Is this an accessibility setting?

Yes. Users who need high contrast turn it on, so active can say something about a user's needs. Mention it in your privacy notice and use it only for its purpose.

## Related pages

- [prefers_contrast](https://whiskerjs.com/signals/prefers-contrast/): The user's contrast preference.
- [reduced_motion](https://whiskerjs.com/signals/reduced-motion/): Another accessibility setting.
- [What a privacy notice should say](https://whiskerjs.com/privacy/privacy-notice/): How to describe device signals to users.


---

# hardware_concurrency

> The number of logical CPU threads the browser reports, such as 8 or 12.

Source: https://whiskerjs.com/signals/hardware-concurrency/ (last updated 2026-10-26)

**hardware_concurrency at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `hardware_concurrency` |
| In the visitorId | yes |
| structuredId group | [device (screen, memory, CPU)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | Brave (brave_farbling); Firefox resistFingerprinting and Tor Browser (firefox_rfp) |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Browsers tell pages how many tasks the processor can run at once, so that sites can split heavy work. A typical laptop says 8 or 12, a big desktop more, a phone usually 6 or 8. WhiskerJS reads this number as it is. Privacy browsers that fake it are skipped instead of read.

## What it reads

`navigator.hardwareConcurrency`, reported as a plain number when it is a finite number.

## How the technique works

The browser reports the number of logical processors available to it. WhiskerJS reads the property through the page’s `navigator`. If the property is missing or not a finite number the component is `unavailable` / `no_api`; if the getter throws (for example because a script replaced it with one that throws) the runner reports `blocked` / `threw` or `security_error`.

## Why it helps

CPU thread counts differ across device classes and models, and they combine well with memory, architecture and screen values in the `device` group of the [structuredId](https://whiskerjs.com/glossary/#structured-id).

## Stability

It is fixed for a given machine and browser, but it can change when a browser starts capping or rounding the value in an update, when a virtual machine is given a different number of processors, or on a different device.

## Browser support and what blocks it

- `ok` in all current browsers ([Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/), [Safari](https://whiskerjs.com/browsers/safari-macos/), [Firefox](https://whiskerjs.com/browsers/firefox/), mobile browsers). Some browsers cap or round it; WhiskerJS reports what they give.
- [Brave](https://whiskerjs.com/browsers/brave/): `excluded` / `brave_farbling`.
- [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): `excluded` / `firefox_rfp`.

Related integrity checks look at the same property: [`impossible_hardware`](https://whiskerjs.com/docs/integrity/#impossible_hardware) (not a whole number from 1 to 256), [`navigator_own_property`](https://whiskerjs.com/docs/integrity/#navigator_own_property) (defined on the navigator object itself), [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering) (the getter does not look native) and [`iframe_mismatch`](https://whiskerjs.com/docs/integrity/#iframe_mismatch) (a clean frame reports a different number).

## Privacy

A single number about the processor, read without permission or prompt, never sent by WhiskerJS.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | for example `8` |
| `unavailable` | `no_api` | missing or not a finite number |
| `blocked` | `security_error`, `threw` | the getter threw |
| `excluded` | `brave_farbling`, `firefox_rfp`, `caller_excluded` | exclusion table or your list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, budget, abort |

## Example value

```json
"hardware_concurrency": { "status": "ok", "value": "8", "hashed": false }
```

The container test runs used for these pages reported `14` (headless Chromium and Firefox) and `8` (headless WebKit) on the same host, which shows that browsers do not all report the same number for one machine.

## Questions and answers

### Is hardware_concurrency the number of CPU cores?

It is the number of logical processors the browser exposes, which usually counts threads, not physical cores. Some browsers cap or round it.

### Why is it excluded in Brave and Firefox resistFingerprinting?

Brave randomises it per site and session, and Firefox resistFingerprinting reports a fixed number. Neither describes the device, so the exclusion table skips it.

### What does impossible_hardware mean?

The integrity check of that name fires when hardwareConcurrency is a number but not a whole number from 1 to 256, which points to a value set by hand.

## Related pages

- [device_memory](https://whiskerjs.com/signals/device-memory/): Approximate memory, Chromium only.
- [cpu_architecture](https://whiskerjs.com/signals/cpu-architecture/): x86 or ARM from a NaN bit.
- [impossible_hardware flag](https://whiskerjs.com/docs/integrity/#impossible_hardware): Catches values no real device reports.
- [navigator_own_property flag](https://whiskerjs.com/docs/integrity/#navigator_own_property): Catches overrides on the navigator object.
- [Brave](https://whiskerjs.com/browsers/brave/): Where it is excluded.


---

# heap_limit

> The maximum JavaScript heap size Chromium allows the page, in bytes. Chromium only.

Source: https://whiskerjs.com/signals/heap-limit/ (last updated 2026-10-26)

**heap_limit at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `heap_limit` |
| In the visitorId | yes |
| structuredId group | [device (screen, memory, CPU)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 2](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Chrome-family browsers give each page a ceiling for how much memory its scripts may use. That ceiling depends on the device and on the browser build, and Chromium shows it to pages. WhiskerJS reads only this ceiling, not what the page actually uses. Other browsers do not offer it.

## What it reads

`performance.memory.jsHeapSizeLimit`, reported as a plain number of bytes when it is a finite number greater than zero.

## How the technique works

`performance.memory` is a Chromium extension of the Performance API with three numbers: the heap limit, the total heap and the used heap. Only the limit is stable enough to be useful; the other two change constantly while the page runs and are not read. Anything other than a positive finite number gives `unavailable` / `no_api`.

## Why it helps

The limit is set by the browser build and its configuration, and can differ between devices, so it adds a further distinction inside the Chromium population, where the other browsers’ values are not available anyway. On your server it is also a consistency check: a result that claims to be Chrome but has no `heap_limit`, or a value that changes between two requests in one session, deserves a closer look. Because the value is tied to the browser build, a new Chromium version that changes the limit would move many devices to a new value at once, which would show up as a change of the `device` part of the structuredId across your traffic rather than on one device. It is in the `device` group.

## Stability

It changes rarely, mostly with a browser version that changes its heap configuration or on a different device.

## Browser support and what blocks it

- `ok` in Chromium-based browsers: [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Chrome on Android](https://whiskerjs.com/browsers/chrome-android/), [Edge](https://whiskerjs.com/browsers/edge/), [Brave](https://whiskerjs.com/browsers/brave/), [Samsung Internet](https://whiskerjs.com/browsers/samsung-internet/).
- `unavailable` / `no_api` in [Safari](https://whiskerjs.com/browsers/safari-macos/), [every iOS browser](https://whiskerjs.com/browsers/safari-ios/) and [Firefox](https://whiskerjs.com/browsers/firefox/).
- Not in the exclusion table.

## Privacy

A single number about the browser’s memory configuration. No permission, no prompt, no request.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | for example `4294705152` |
| `unavailable` | `no_api` | no `performance.memory`, or not a positive number |
| `blocked` | `security_error`, `threw` | reading threw |
| `excluded` | `caller_excluded` | your `exclude` list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, budget, abort |

## Example value

```json
"heap_limit": { "status": "ok", "value": "4294705152", "hashed": false }
```

The headless Chromium test browser used for these pages reported `3760000000`; headless Firefox and WebKit reported `unavailable` / `no_api`.

## Questions and answers

### Why is heap_limit unavailable in Safari and Firefox?

performance.memory is a non-standard Chromium feature. Other engines do not offer it, so the component reports unavailable with ruleId no_api by design.

### Does heap_limit measure how much memory the page uses?

No. It reads only the limit, jsHeapSizeLimit, which the browser sets from the device and its own configuration. The current usage values are not read.

## Related pages

- [device_memory](https://whiskerjs.com/signals/device-memory/): Approximate device memory, also Chromium only.
- [hardware_concurrency](https://whiskerjs.com/signals/hardware-concurrency/): CPU threads.
- [cpu_architecture](https://whiskerjs.com/signals/cpu-architecture/): x86 or ARM.
- [Chrome desktop](https://whiskerjs.com/browsers/chrome-desktop/): Where it is read.


---

# intl_locale

> The locale, calendar, numbering system and hour cycle the browser's Intl API resolves to, plus the number locale.

Source: https://whiskerjs.com/signals/intl-locale/ (last updated 2026-10-26)

**intl_locale at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `intl_locale` |
| In the visitorId | yes |
| structuredId group | [locale](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 2](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Browsers format dates and numbers the local way: which calendar, which digits, a 12 or a 24 hour clock. WhiskerJS asks the browser’s formatting engine which settings it would use and writes them down. They follow the language and region settings of the device and rarely change.

## What it reads

- from `new Intl.DateTimeFormat().resolvedOptions()`: `locale`, `calendar` and `numberingSystem`;
- from `new Intl.DateTimeFormat(undefined, { hour: 'numeric' }).resolvedOptions()`: `hourCycle`;
- from `new Intl.NumberFormat().resolvedOptions()`: `locale`.

The value is `locale=…;calendar=…;numbering=…;hour_cycle=…;number_locale=…`. A failed hour cycle or number format read is written as `!` inside the value. If no date locale is resolved, the component is `unavailable` / `no_value`.

## How the technique works

The Intl API resolves the requested default locale against the data the engine ships and the operating system’s regional settings. The result shows not only the language but also derived formats: a Gregorian or another calendar, Latin or other digits, and the hour cycle. The hour cycle is read with an explicit `hour` option because only then does the engine resolve it.

## Why it helps

Two users with the same language list can still differ here, for example by region or by a 24 hour clock setting. It is part of the `locale` group of the structuredId.

## Stability

It changes when the user changes language or region settings, or when a browser update ships different locale data (rare). Travel does not change it unless the device’s region settings change.

## Browser support and what blocks it

`ok` in all current browsers; not in the exclusion table. `unavailable` / `no_api` only where `Intl.DateTimeFormat` is missing. Some privacy modes normalise the locale (for example to `en-US`); WhiskerJS reports what the browser resolves.

## Privacy

Regional formatting preferences, read without permission or prompt, never sent by WhiskerJS. The value is short ASCII and reported as plain text.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | the five fields |
| `unavailable` | `no_api` | no `Intl.DateTimeFormat` |
| `unavailable` | `no_value` | no resolved locale |
| `blocked` | `security_error`, `threw` | the main `resolvedOptions` call threw |
| `excluded` | `caller_excluded` | your `exclude` list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, budget, abort |

## Example value

From the headless test browsers in a container (all three agreed):

```json
"intl_locale": {
  "status": "ok",
  "value": "locale=en-US;calendar=gregory;numbering=latn;hour_cycle=h12;number_locale=en-US",
  "hashed": false
}
```

## Questions and answers

### How is intl_locale different from languages?

languages is the user's list of preferred languages. intl_locale is what the JavaScript Intl API actually resolves to for dates and numbers, including the calendar, digits and 12 or 24 hour clock, which also follow regional settings.

### What does hour_cycle h12 or h23 mean?

It is the clock format Intl uses for hours: h12 is a 12 hour clock with AM and PM, h23 a 24 hour clock from 0 to 23. It follows the locale and, in some systems, the user's clock setting.

## Related pages

- [languages](https://whiskerjs.com/signals/languages/): The language list.
- [time_zone](https://whiskerjs.com/signals/time-zone/): The IANA time zone.
- [Signal group](https://whiskerjs.com/glossary/#signal-group): intl_locale is in the locale group.
- [Comparing two results](https://whiskerjs.com/docs/identifiers/#comparing-two-results): What a change in the locale part means.


---

# keyboard_layout

> The characters that 19 physical keys produce in the active keyboard layout, from navigator.keyboard.getLayoutMap(). Chromium only, no prompt, not in either id.

Source: https://whiskerjs.com/signals/keyboard-layout/ (last updated 2026-10-26)

**keyboard_layout at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `keyboard_layout` |
| In the visitorId | no (reported, kept out of both ids) |
| structuredId group | none |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 2](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Keyboards in different countries put different letters on the same keys: the key that types Q on a US keyboard types A on a French one. Chromium browsers let a page ask which character each physical key produces. WhiskerJS asks for 19 telling keys and records the answer. Users switch layouts, so it is reported but kept out of the identifiers.

## What it reads

`navigator.keyboard.getLayoutMap()` and, from the map, the character for these physical key codes: KeyQ, KeyW, KeyY, KeyZ, KeyA, KeyM, Semicolon, Quote, BracketLeft, BracketRight, Backquote, Backslash, IntlBackslash, Minus, Equal, Comma, Period, Slash, Digit2.

## How the technique works

1. Without `navigator.keyboard.getLayoutMap` the component is `unavailable` / `no_api`.
2. The promise is awaited. If the result has no `get` method, `unavailable` / `no_value`.
3. For each key, the character is taken; a missing or empty one becomes `_`.
4. The 19 characters are joined without separators. A layout with characters outside printable ASCII (for example Cyrillic or Greek) is hashed.

The API needs no permission and shows no prompt.

## Why it helps

The keys chosen separate the common layouts: QWERTY against QWERTZ (Y and Z swap) and AZERTY (A, Q, M move), and national variants that differ in punctuation, brackets and the extra key next to left Shift. For your server it is context about the user’s region and a check against `languages`.

## Stability

Medium: it follows the layout that is active at that moment, and many people switch layouts. That is why it is outside both ids.

## Browser support and what blocks it

- Chromium desktop browsers ([Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/), [Brave](https://whiskerjs.com/browsers/brave/)) offer the Keyboard Map API.
- [Firefox](https://whiskerjs.com/browsers/firefox/), [Safari](https://whiskerjs.com/browsers/safari-macos/) and [iOS browsers](https://whiskerjs.com/browsers/safari-ios/): `unavailable` / `no_api`.
- On Android, expect `unavailable`; check your own traffic.
- In cross-origin iframes the browser refuses the call: `blocked`.

No browser class excludes it.

## Privacy

A layout hints at a region or language, much like the language settings your server already sees in `Accept-Language`. No keystrokes are captured. Leave it out with `collect({ exclude: ['keyboard_layout'] })` if you do not need it; no id changes.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | 19 characters, or a digest for non-ASCII layouts |
| `unavailable` | `no_api` | no Keyboard Map API |
| `unavailable` | `no_value` | the map has no `get` |
| `unavailable` | `no_digest` | a non-ASCII layout without `crypto.subtle` |
| `blocked` | `security_error`, `threw` | the browser refused or failed the call (for example in a cross-origin iframe) |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

## Example value

A US English layout gives `` qwyzam;'[]`\\-=,./2 `` (the IntlBackslash key reports `\` on many layouts). Headless Chromium in the container returned an empty map: `___________________` (19 underscores). Firefox and WebKit: `unavailable` / `no_api`.

## Questions and answers

### Does keyboard_layout record what I type?

No. It asks the browser which character each of 19 physical keys would produce in the current layout. No key presses are read or recorded.

### Why is it blocked in my embedded frame?

Browsers refuse getLayoutMap() in cross-origin iframes. WhiskerJS then reports blocked with ruleId security_error or threw, depending on the error the browser raises.

### Why only underscores in my headless browser?

The layout map was empty, so every key was reported as the placeholder _. That is common in headless and virtual setups.

## Related pages

- [languages](https://whiskerjs.com/signals/languages/): The user's language list, in the id.
- [intl_locale](https://whiskerjs.com/signals/intl-locale/): Locale, calendar and hour cycle.
- [Chrome on desktop](https://whiskerjs.com/browsers/chrome-desktop/): Where the Keyboard Map API is offered.


---

# languages

> The browser's preferred languages in order, such as en-US,en.

Source: https://whiskerjs.com/signals/languages/ (last updated 2026-10-26)

**languages at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `languages` |
| In the visitorId | yes |
| structuredId group | [locale](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Browsers keep a list of the languages a person prefers, in order, for example English (United States) first, then English. Websites use it to pick a language. WhiskerJS reads that list as it is. Many people have only one or two languages, but the exact list and its order still separate groups of users.

## What it reads

`navigator.languages`, the string entries joined with commas. If the list is missing or empty, `navigator.language` alone. An empty result is `unavailable` / `no_api`.

## How the technique works

The list reflects the browser’s language settings, which by default follow the operating system’s languages and region. Joining the entries in order keeps both the choice and the priority. Values are short ASCII language tags in practice, so they are reported as plain text; a value longer than 128 characters or outside printable ASCII would be hashed.

## Why it helps

Language lists differ between regions and between people who add languages, and the order matters. It is in the `locale` group together with [`time_zone`](https://whiskerjs.com/signals/time-zone/) and [`intl_locale`](https://whiskerjs.com/signals/intl-locale/). It is also a strong consistency check against the request’s `Accept-Language` header; see [Recommended server checks](https://whiskerjs.com/docs/integration/#recommended-server-checks).

## Stability

It changes when the user adds, removes or reorders languages in the browser or the operating system. A change of only the `locale` part of the structuredId often has this cause.

## Browser support and what blocks it

`ok` in all browsers; not in the exclusion table. Some privacy modes report a reduced list (for example only the first language); WhiskerJS reports whatever the browser gives.

Integrity checks that look at the same properties: [`iframe_mismatch`](https://whiskerjs.com/docs/integrity/#iframe_mismatch) (`language` and `languages` against a clean frame), [`navigator_own_property`](https://whiskerjs.com/docs/integrity/#navigator_own_property) and [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering) (the `languages` getter).

## Privacy

It reveals language preferences, which can hint at origin or region. Read without permission or prompt, never sent by WhiskerJS.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | for example `en-US,en` |
| `unavailable` | `no_api` | no languages and no language |
| `unavailable` | `no_digest` | a long or non-ASCII value needed hashing without Web Crypto |
| `blocked` | `security_error`, `threw` | the getter threw |
| `excluded` | `caller_excluded` | your `exclude` list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, budget, abort |

## Example value

```json
"languages": { "status": "ok", "value": "en-US,en", "hashed": false }
```

## Questions and answers

### Is languages the same as the Accept-Language header?

They come from the same browser setting and usually match. Comparing them on your server is a useful check; a mismatch can point to a script that changed one but not the other.

### Why did my headless browser report en-US@posix?

Headless browsers take the language from the operating system environment. In the container test run used for these pages, headless Chromium inherited a POSIX locale and reported en-US@posix.

## Related pages

- [intl_locale](https://whiskerjs.com/signals/intl-locale/): The resolved Intl locale and formats.
- [time_zone](https://whiskerjs.com/signals/time-zone/): The other main locale setting.
- [iframe_mismatch flag](https://whiskerjs.com/docs/integrity/#iframe_mismatch): Compares language and languages with a clean frame.
- [navigator_own_property flag](https://whiskerjs.com/docs/integrity/#navigator_own_property): Catches overrides of languages.


---

# math

> The exact results of 24 Math operations on fixed inputs, hashed. Their last digits differ between JavaScript engines and engine versions.

Source: https://whiskerjs.com/signals/math/ (last updated 2026-10-26)

**math at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `math` |
| In the visitorId | yes |
| structuredId group | [browser (engine and build)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | always a digest (first 128 bits of SHA-256) |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Computers approximate mathematical functions such as sine or the exponential, and different browsers’ JavaScript engines do it in slightly different ways. For a few carefully chosen inputs, the very last digits of the answer differ. WhiskerJS computes 24 such results and keeps only a short hash of them. It needs no permission and draws nothing; it is pure arithmetic.

## What it reads

The window’s `Math` object, called with fixed inputs:

- `acos`, `asin` of 0.123124234234234242; `acosh` of 1e308; `asinh` of 1; `atanh` and `atan` of 0.5;
- `sin` and `tan` of -1e300; `cos` of 10.000000000123; `sinh`, `cosh`, `tanh`, `exp`, `expm1` of 1; `log1p` of 10;
- “polyfill” forms of some of them written with `log`, `sqrt` and `exp` (for example `log(1e154 + sqrt(1e154 * 1e154 - 1))` for acosh);
- `pow(PI, -100)`.

That is 24 named results in a fixed order.

## How the technique works

1. Each function is bound to the window’s `Math`. A function that is missing is replaced by one that returns 0, so a missing function changes the value instead of failing.
2. Each result is written as `name=<number>` with JavaScript’s default number printing, and the 24 pairs are joined with `;`.
3. The string is always hashed: SHA-256, first 128 bits, 32 hex characters.

The operations, constants and polyfill expressions are adapted from FingerprintJS 5.3.0 (MIT); the notice is kept beside the code and in `THIRD_PARTY_NOTICES.md`.

## Why it helps

The inputs sit where approximation errors show: huge arguments to `sin` and `tan`, values near the edge of the floating-point range, and expressions that lose precision. Different engines (V8, SpiderMonkey, JavaScriptCore), and sometimes different versions of one engine, round the last bits differently. The value says little about the device and a lot about the engine build, which is why it is in the `browser` group.

## Stability

- Stable within one browser version on one device: the same inputs always give the same outputs.
- It can change with a browser update, when an engine changes its maths library. That moves the visitorId and the `browser` part of the structuredId.
- It does not follow user settings.

## Browser support and what blocks it

Every browser has `Math`, so it is `ok` everywhere: [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Firefox](https://whiskerjs.com/browsers/firefox/), [Safari](https://whiskerjs.com/browsers/safari-macos/), [iOS browsers](https://whiskerjs.com/browsers/safari-ios/), [Brave](https://whiskerjs.com/browsers/brave/), [Edge](https://whiskerjs.com/browsers/edge/). No browser class excludes it. Because all iOS browsers share WebKit’s engine, they are expected to share the same math results with Safari on the same iOS version.

## Privacy

The value is a property of the browser’s engine build, shared by everyone on that build. It contains nothing about the user and leaves the library only as a digest.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | the digest of the 24 results |
| `unavailable` | `no_api` | there is no `Math` object or `Math.exp` is not a function |
| `unavailable` | `no_digest` | `crypto.subtle` is missing, so the value cannot be hashed (never sent raw) |
| `blocked` | `threw`, `security_error` | a patched `Math` function throws |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

There is no noise to detect: the results are deterministic.

## Example value

In headless test browsers in a Linux container on an ARM host, Chromium and Firefox both gave `93c6779db9af8debbf63b6d97bbcbd97` and WebKit gave `c5a6fcbb6b7bfc2c6aca4d4345d810bb`. A small example, not a measurement of how often engines agree.

## Questions and answers

### Why would Math.sin give different answers in different browsers?

The standard allows small differences in how functions such as sin, tan or exp are approximated. Engines use different algorithms or libraries, so the last digits can differ for some inputs.

### Is the math code taken from another library?

The list of operations, their input constants and the polyfill expressions are adapted from FingerprintJS 5.3.0 under the MIT licence, with the notice kept in THIRD_PARTY_NOTICES.md. The collector code around them is WhiskerJS's own.

### Does math tell the CPU apart?

Mostly it tells engines and their versions apart. Two engines can also agree on the same machine: in a container run, headless Chromium and Firefox produced the same math digest while WebKit differed.

## Related pages

- [cpu_architecture](https://whiskerjs.com/signals/cpu-architecture/): Another pure computation, about the CPU family.
- [browser_class](https://whiskerjs.com/signals/browser-class/): The engine family, from what the browser says.
- [engine_mismatch flag](https://whiskerjs.com/docs/integrity/#engine_mismatch): Cross-checks the claimed engine against how code behaves.
- [Digest](https://whiskerjs.com/glossary/#digest): How large values leave the library.


---

# media_codecs

> Which of 8 audio and 12 video formats the browser says it can play, asked of a media element and of MediaSource. Nothing is loaded or played.

Source: https://whiskerjs.com/signals/media-codecs/ (last updated 2026-10-26)

**media_codecs at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `media_codecs` |
| In the visitorId | yes |
| structuredId group | [browser (engine and build)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | always a digest (first 128 bits of SHA-256) |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Browsers support different audio and video formats, depending on the browser, its build and the operating system’s media libraries. WhiskerJS asks the browser, for 20 common formats, “could you play this?”, and hashes the answers. It never loads, downloads or plays any media.

## What it reads

For each of 8 audio and 12 video MIME types:

- the answer of `canPlayType(type)` on a new `<audio>` or `<video>` element: `probably`, `maybe` or an empty string (written as `no`);
- the answer of `MediaSource.isTypeSupported(type)`, written `1` or `0`.

The audio types include `audio/mp4; codecs="mp4a.40.2"`, `audio/mpeg;`, Vorbis in WebM and Ogg, WAV, Speex, FLAC and AMR in 3GPP. The video types include five H.264 profiles in MP4, two MPEG-4 Part 2 forms, VP8 in WebM, Theora and Dirac in Ogg, MPEG-4 in 3GPP and Theora in Matroska.

## How the technique works

1. One `<audio>` and one `<video>` element are created with `document.createElement`. They are never given a source and never attached, so the browser loads nothing.
2. For each type, `canPlayType` is called on the matching element, and `MediaSource.isTypeSupported` is called if MediaSource exists. A missing method gives `-`, a throw gives `!`.
3. Each answer is written `type=<play>/<source>`, joined with `;`, and always hashed (SHA-256, first 128 bits).

The two MIME lists are adapted from fpscanner 1.0.8 (MIT), with the notice kept.

## Why it helps

The answers follow the browser’s media stack: which decoders it ships, which it gets from the operating system, and how confidently it answers (`maybe` against `probably`). Chromium, Firefox and WebKit differ, and so can builds of one browser on different systems. MediaSource support adds a second, independent view.

## Stability

Stable between visits. It changes when the browser or operating system gains or drops a codec, which happens with updates. That moves the visitorId and the `browser` part of the structuredId.

## Browser support and what blocks it

All current browsers answer `canPlayType`. Where `MediaSource` is missing, the source half of each answer is `-` and the component is still `ok`. See the [browser pages](https://whiskerjs.com/browsers/) and the [support matrix](https://whiskerjs.com/browsers/support-matrix/). No browser class excludes it.

## Privacy

The value describes the browser build’s media support, which is shared by everyone with the same browser and system. It is reported only as a digest. No media is fetched, so there is no network trace.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | digest of the 20 answers |
| `unavailable` | `no_document` | no `document` or no `createElement` |
| `unavailable` | `no_api` | neither `canPlayType` nor `MediaSource.isTypeSupported` answered for any type (every entry `-/-`) |
| `unavailable` | `no_digest` | no `crypto.subtle`, so it cannot be hashed |
| `blocked` | `threw`, `security_error` | creating an element throws |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

Single failing calls become `!` inside the value instead of failing the component.

## Example value

In the container test, headless Chromium gave `dcdbcc9c150c1b84d9741e38cfcc6ddf`, Firefox `a20d8637fc821657c25051d9329cfb27` and WebKit `1e05ba5e0df74709cab1f47e421950b5`: three engines, three different answers.

## Questions and answers

### Does media_codecs download or play anything?

No. It creates an audio and a video element that never get a source and are never attached to the page, and asks them canPlayType(). MediaSource.isTypeSupported() is a pure question too.

### Why does it change after a browser update?

Browsers add and drop codec support over time, and canPlayType answers can move between maybe and probably. Any change in the 20 answers changes the digest.

### Where do the MIME types come from?

The two lists are adapted from fpscanner 1.0.8 under the MIT licence, with the notice kept. The probing code is WhiskerJS's own.

## Related pages

- [math](https://whiskerjs.com/signals/math/): Another engine-build signal in the browser group.
- [browser_class](https://whiskerjs.com/signals/browser-class/): The browser family guess.
- [ua_client_hints](https://whiskerjs.com/signals/ua-client-hints/): Brands and platform from Client Hints.
- [Comparing two results](https://whiskerjs.com/docs/identifiers/#comparing-two-results): Why a change here moves only the browser part.


---

# pdf_viewer

> Whether the browser says it shows PDF files itself, from navigator.pdfViewerEnabled.

Source: https://whiskerjs.com/signals/pdf-viewer/ (last updated 2026-10-26)

**pdf_viewer at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `pdf_viewer` |
| In the visitorId | yes |
| structuredId group | [browser (engine and build)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Most desktop browsers can show PDF files themselves. They also tell web pages whether that built-in viewer is on. WhiskerJS records that yes or no. It is a small signal: it mainly separates normal browsers from headless, embedded or specially configured ones.

## What it reads

`navigator.pdfViewerEnabled`, a boolean.

## How the technique works

The property is read once. `true` and `false` are reported as the plain words `true` and `false`. Any other type (the property is missing) gives `unavailable`. If the property’s getter throws, the error is not swallowed, so the component reports `blocked` instead of pretending the property is missing.

## Why it helps

The answer is the same for nearly every normal desktop browser, so on its own it tells few devices apart. It earns its place in the `browser` group because it separates groups that are otherwise similar: browsers where a policy or the user turned the viewer off, embedded browser views, and many headless and automation setups.

On your server, a `false` value is not suspicious by itself. It becomes interesting together with other hints: for example `false` with an empty [`plugins`](https://whiskerjs.com/signals/plugins/) list, a [`software_renderer`](https://whiskerjs.com/docs/integrity/#software_renderer) flag and a desktop user agent describes many automated setups, while the same `false` on a managed office computer may just be a policy.

## Stability

Very stable. It changes only when the user or an administrator changes the PDF setting, or the browser changes its default.

## Browser support and what blocks it

- Current desktop [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/), [Firefox](https://whiskerjs.com/browsers/firefox/), [Safari](https://whiskerjs.com/browsers/safari-macos/) and [Brave](https://whiskerjs.com/browsers/brave/) expose the property; usually `true`.
- Mobile browsers may report either value, depending on whether the browser itself shows PDFs.
- Older browsers without the property report `unavailable` / `no_api`.

No browser class excludes it.

## Privacy

A yes-or-no setting shared by most users. It reveals nothing personal.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | `true` or `false` |
| `unavailable` | `no_api` | the property is not a boolean (missing) |
| `blocked` | `threw`, `security_error` | the getter throws |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

Never hashed.

## Example value

In the container test, headless Chromium and Firefox reported `false` and headless WebKit reported `true`. A normal desktop Chrome usually reports `true`.

## Questions and answers

### Why is pdf_viewer false in my headless test browser?

Headless and embedded browsers often have no built-in PDF viewer, and some users turn it off so that PDFs download instead. Both give false.

### Does WhiskerJS open a PDF to check?

No. It only reads the navigator.pdfViewerEnabled property.

## Related pages

- [plugins](https://whiskerjs.com/signals/plugins/): The plugin list, which in current browsers mostly mirrors the PDF viewer.
- [headless_markers flag](https://whiskerjs.com/docs/integrity/#headless_markers): Other traits of headless browsers.
- [browser_class](https://whiskerjs.com/signals/browser-class/): The browser family guess.


---

# permissions

> The state of 24 browser permissions (granted, denied, prompt), read with navigator.permissions.query, which never asks the user anything. Hashed, not in either id.

Source: https://whiskerjs.com/signals/permissions/ (last updated 2026-10-26)

**permissions at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `permissions` |
| In the visitorId | no (reported, kept out of both ids) |
| structuredId group | none |
| Hashing | always a digest (first 128 bits of SHA-256) |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 2](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Browsers remember which sites may use the camera, send notifications and so on. A page can ask the browser for the current state of a permission without asking the user anything. WhiskerJS asks for 24 of them and keeps only a short hash of the answers. It never requests a permission and never shows a prompt.

## What it reads

The state of each of these permissions from `navigator.permissions.query({ name })`: accelerometer, background-fetch, background-sync, camera, clipboard-read, clipboard-write, display-capture, geolocation, gyroscope, idle-detection, keyboard-lock, local-fonts, magnetometer, microphone, midi, nfc, notifications, payment-handler, persistent-storage, pointer-lock, push, screen-wake-lock, storage-access, window-management.

## How the technique works

1. Without `navigator.permissions.query` the component is `unavailable` / `no_api`.
2. All 24 queries run in parallel. `push` is asked with `userVisibleOnly: true`, the only form browsers accept.
3. Each answer is the state `granted`, `denied` or `prompt`; any other state is `unknown`; a query that throws (the browser does not know that permission) is `unsupported`.
4. If every query is `unsupported`, the component is `unavailable` / `no_value`.
5. Otherwise the value is `name=state;...` in the fixed order above, always hashed (SHA-256, first 128 bits).
6. The notifications state is also kept internally for the [`permissions_inconsistent`](https://whiskerjs.com/docs/integrity/#permissions_inconsistent) check.

## Why it helps

Two things vary: which permission names the browser knows (a browser and version fingerprint of its own) and what the user has granted or refused. Both are useful to your server as context. The second is why it stays out of the ids.

## Stability

Medium: the set of known names changes with browser updates, and the states change whenever the user grants or revokes something. Neither moves the visitorId or the structuredId.

## Browser support and what blocks it

- Chromium browsers ([Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/), [Brave](https://whiskerjs.com/browsers/brave/), [Samsung Internet](https://whiskerjs.com/browsers/samsung-internet/)) know most of the names.
- [Firefox](https://whiskerjs.com/browsers/firefox/) and [Safari](https://whiskerjs.com/browsers/safari-macos/) implement `navigator.permissions.query` for fewer names; the rest come back `unsupported`.
- On slow or emulated setups the parallel queries can exceed the 1000 ms inner timeout; then the component is `timed_out`.

No browser class excludes it.

## Privacy

Permission states can say a little about how someone uses a site (for example that they allowed notifications). WhiskerJS reads them only, never asks, and reports a digest rather than the list. If you do not need it, leave it out with `collect({ exclude: ['permissions'] })`; since it is outside the ids, that does not change any id.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | digest of the 24 states |
| `unavailable` | `no_api` | no `navigator.permissions.query` |
| `unavailable` | `no_value` | every query was unsupported |
| `unavailable` | `no_digest` | no `crypto.subtle` |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | not all queries answered in time, or budget or abort |

## Example value

In the container test, headless Chromium gave `bcecb787af4b911800b26cdac1d7b6ea` and Firefox `3fb80d81dd1f71b5a083dc4dd324ada7`; in headless WebKit the queries did not finish within 1000 ms and the component was `timed_out` / `timeout`. The same Chromium run also set `permissions_inconsistent`.

## Questions and answers

### Will my visitors see a permission prompt?

No. navigator.permissions.query only reports the current state. WhiskerJS never calls an API that requests a permission, such as getUserMedia, geolocation or Notification.requestPermission.

### Why are permissions not in the id?

The state changes when the user grants or revokes a permission, which is a normal thing to do. In the id, that would change it.

### What is permissions_inconsistent?

An integrity flag that fires when Notification.permission is denied while the permissions query for notifications says prompt, a trait known from headless Chrome. Normal browsers keep the two in step.

## Related pages

- [permissions_inconsistent flag](https://whiskerjs.com/docs/integrity/#permissions_inconsistent): Uses the notifications state read here.
- [storage](https://whiskerjs.com/signals/storage/): Another read-only view of browser settings.
- [Privacy](https://whiskerjs.com/docs/privacy/): No prompts, no network, no storage.
- [keyboard_layout](https://whiskerjs.com/signals/keyboard-layout/): Another component outside the ids.


---

# pixel_ratio

> The ratio of physical to CSS pixels (devicePixelRatio), rounded to three decimals. Reported, but kept out of both ids because page zoom changes it.

Source: https://whiskerjs.com/signals/pixel-ratio/ (last updated 2026-10-26)

**pixel_ratio at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `pixel_ratio` |
| In the visitorId | no (reported, kept out of both ids) |
| structuredId group | none |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | Firefox resistFingerprinting and Tor Browser (firefox_rfp) |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Sharp screens pack more physical pixels into each unit a web page uses for layout; the browser reports this as the pixel ratio (for example 2 on many phones and Retina laptops). The same number also changes when you zoom a page. So WhiskerJS reports it for your server to look at, but never lets it change the identifiers.

## What it reads

`window.devicePixelRatio`.

## How the technique works

The number is read once and rounded to three decimals with WhiskerJS’s own rounding (so `1.2500000001` becomes `1.25`). A value that is not a finite positive number gives `unavailable`.

## Why it helps

It reflects the screen density and the operating system’s display scaling (for example 1.25 or 1.5 on Windows laptops), which separates many devices. That is useful context for your server, for example to check that a phone user agent comes with a phone-like ratio. It is not used for matching because it is not stable.

## Stability

Low on desktop: page zoom changes it, and so can moving the window to a monitor with different scaling. On phones it is usually fixed. This is exactly why it is kept out of both ids: neither the visitorId nor the structuredId moves when a user zooms.

On your server, if you compare two results from the same device and only `pixel_ratio` differs, the user most likely zoomed or moved the window. Nothing in the ids changes in that case, which is the intended behaviour.

## Browser support and what blocks it

- Available everywhere: [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Firefox](https://whiskerjs.com/browsers/firefox/), [Safari](https://whiskerjs.com/browsers/safari-macos/), [iOS browsers](https://whiskerjs.com/browsers/safari-ios/), [Android browsers](https://whiskerjs.com/browsers/chrome-android/).
- [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): `excluded` with ruleId `firefox_rfp`, because the value is normalised to 1 there. A pixel ratio of 1 is also one of the traits WhiskerJS needs before it classes a Firefox as `firefox_rfp`.

## Privacy

It describes screen density and the zoom level at that moment. It is not stored and does not join an id.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | the ratio, up to three decimals |
| `unavailable` | `no_api` | not a finite positive number |
| `excluded` | `firefox_rfp` | browser class `firefox_rfp` |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

## Example value

All three headless test browsers in the container reported `1`. Typical values elsewhere: `2`, `3`, `1.25`, `1.5`.

## Questions and answers

### Why is pixel_ratio not in the visitorId?

In desktop browsers, zooming the page in or out changes devicePixelRatio. If it were in the id, a user pressing Ctrl and plus would get a new id.

### Why is it excluded under Firefox resistFingerprinting?

resistFingerprinting reports a pixel ratio of 1 regardless of the screen, so reading it adds nothing. The exclusion table reports it as excluded with ruleId firefox_rfp.

### What can my server use it for?

As a consistency hint: a phone user agent with a ratio of 1, or a value that does not fit the reported screen, is worth a look. Do not use it to match devices.

## Related pages

- [screen_resolution](https://whiskerjs.com/signals/screen-resolution/): The screen size, which is in the id.
- [screen_frame](https://whiskerjs.com/signals/screen-frame/): Another screen value kept out of the ids.
- [What changes the id](https://whiskerjs.com/docs/identifiers/#what-changes-the-id): And what does not.
- [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): Where this component is excluded.


---

# platform

> The operating system family the browser reports in navigator.platform, such as MacIntel, Win32, Linux x86_64 or iPhone.

Source: https://whiskerjs.com/signals/platform/ (last updated 2026-10-26)

**platform at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `platform` |
| In the visitorId | yes |
| structuredId group | [browser (engine and build)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Every browser tells web pages a short name for the operating system it runs on, such as `Win32` for Windows or `iPhone`. WhiskerJS records that word as it is. It separates big families of devices from each other and is a useful cross-check: if it disagrees with what your server sees in the request, something may have been changed.

## What it reads

`navigator.platform`, a string.

## How the technique works

The property is read once and reported as it is. An empty string or a value that is not a string gives `unavailable`. If the getter throws, the error reaches the runner and the component reports `blocked`. A value longer than 128 characters or containing a character outside printable ASCII would be hashed; real platform strings are short ASCII and appear in plain text.

## Why it helps

It separates operating system families (Windows, macOS, Linux, Android variants, iPhone, iPad) cheaply. Many values are shared by huge numbers of devices, so it adds little uniqueness, but it is very stable and it is one of the values spoofing tools change. Because it is in the id, a tool that changes it on one visit and not on another changes the id.

On your server, compare it with the platform in the request’s user agent header and, on Chromium, with the `platform` field of [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/). Agreement is the normal case; disagreement is a hint, not proof, since some privacy tools change one value and not the others.

## Stability

Very stable: it changes with the operating system family, not with updates. Browsers freeze some values on purpose; for example Macs report `MacIntel` regardless of the CPU.

## Browser support and what blocks it

Every browser exposes `navigator.platform`, including [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Firefox](https://whiskerjs.com/browsers/firefox/), [Safari](https://whiskerjs.com/browsers/safari-macos/), [iOS browsers](https://whiskerjs.com/browsers/safari-ios/) and [Android browsers](https://whiskerjs.com/browsers/chrome-android/). Browsers can freeze or simplify the value for compatibility or privacy; WhiskerJS reports whatever the browser returns. No browser class excludes it.

## Privacy

A coarse operating system family, shared by many users. Your server usually sees the same information in the user agent header.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | the platform string |
| `unavailable` | `no_api` | missing, empty or not a string |
| `blocked` | `threw`, `security_error` | the getter throws |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

Three integrity checks watch this property: [`navigator_own_property`](https://whiskerjs.com/docs/integrity/#navigator_own_property) (defined on the navigator object instead of its prototype), [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering) (its getter does not look native) and [`iframe_mismatch`](https://whiskerjs.com/docs/integrity/#iframe_mismatch) (a fresh iframe reads a different value).

## Example value

In the container test, headless Chromium and Firefox reported `Linux x86_64` and WebKit `Linux aarch64`, all on the same ARM host: the string is what the browser chooses to say, not a hardware measurement. Typical values elsewhere: `MacIntel`, `Win32`, `iPhone`.

## Questions and answers

### Why does an Apple Silicon Mac report MacIntel?

Browsers keep the historic value MacIntel on every Mac for compatibility with old sites. The platform value tells operating system families apart, not CPU types; for the CPU family see cpu_architecture.

### Can platform be faked?

Yes, by an extension or a script. WhiskerJS checks for common overrides: navigator_own_property, native_tampering and iframe_mismatch all look at navigator.platform.

### Should my server compare platform with the User-Agent header?

Yes. A platform of Win32 with a Mac user agent header, or one that disagrees with the ua_client_hints platform, is worth a look.

## Related pages

- [ua_client_hints](https://whiskerjs.com/signals/ua-client-hints/): The platform as Client Hints report it, on Chromium.
- [cpu_architecture](https://whiskerjs.com/signals/cpu-architecture/): x86 or ARM, even when platform says MacIntel.
- [navigator_own_property flag](https://whiskerjs.com/docs/integrity/#navigator_own_property): Fires when platform is defined on the navigator object itself.
- [iframe_mismatch flag](https://whiskerjs.com/docs/integrity/#iframe_mismatch): Compares platform with a clean iframe.
- [Recommended server checks](https://whiskerjs.com/docs/integration/#recommended-server-checks): Consistency with what your server sees.


---

# plugins

> The browser's plugin list: each plugin's name, file name and MIME types, sorted and hashed. Excluded under Brave.

Source: https://whiskerjs.com/signals/plugins/ (last updated 2026-10-26)

**plugins at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `plugins` |
| In the visitorId | yes |
| structuredId group | [browser (engine and build)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | always a digest, except the plain value none when nothing is found |
| Excluded under | Brave (brave_farbling) |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Browsers used to list add-ons such as Flash for web pages. Today the list is short and mostly describes the built-in PDF viewer, but it still differs between browsers, and automated browsers often show an empty or odd list. WhiskerJS records the list as a short hash, or the word `none` when it is empty.

## What it reads

`navigator.plugins`: for each plugin, its `name`, its `filename` and the `type` of each MIME type it handles.

## How the technique works

1. If `navigator.plugins` is missing or has no numeric `length`, the component is `unavailable`.
2. Each plugin becomes `name|filename|mime1,mime2,...` with its MIME types sorted.
3. The entries are sorted and joined with `;`. The result is always hashed (SHA-256, first 128 bits).
4. An empty list reports the plain value `none`, unhashed.

## Why it helps

Current Chromium, Firefox and WebKit builds expose different fixed lists (different names, file names and MIME types), embedded and older browsers expose others, and many headless setups expose none. That makes the value a cheap way to separate engine families and unusual setups.

## Stability

Stable for a given browser build. It changes when the browser changes its fixed list in an update or when a setting such as the PDF viewer is turned off.

## Browser support and what blocks it

- Available in all current browsers, including [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Firefox](https://whiskerjs.com/browsers/firefox/), [Safari](https://whiskerjs.com/browsers/safari-macos/) and [Edge](https://whiskerjs.com/browsers/edge/).
- [Brave](https://whiskerjs.com/browsers/brave/): `excluded` with ruleId `brave_farbling`, because Brave randomises the list. See [the exclusion table](https://whiskerjs.com/docs/how-it-works/#the-exclusion-table).
- Headless and embedded browsers often report `none`.

## Privacy

The list describes the browser build, not the person. In current browsers it no longer reveals installed third-party software the way old plugin lists did. It is reported only as a digest or `none`.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | a digest, or plain `none` for an empty list |
| `unavailable` | `no_api` | `navigator.plugins` missing or without a length |
| `unavailable` | `no_digest` | no `crypto.subtle` for a non-empty list |
| `blocked` | `threw`, `security_error` | reading the list throws |
| `excluded` | `brave_farbling` | browser class `brave` |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

The [`plugins_inconsistent`](https://whiskerjs.com/docs/integrity/#plugins_inconsistent) check looks at the same data from another angle: it fires when `navigator.plugins` or `navigator.mimeTypes` are not the native `PluginArray` and `MimeTypeArray`, when only one of them is empty, or when a MIME type’s `enabledPlugin` is not one of the listed plugins. `native_tampering` and `navigator_own_property` also watch `navigator.plugins`.

## Example value

In the container test, headless Chromium and Firefox reported `none`, while headless WebKit reported the digest `0a49ecbdc428ee2eb82dc9f7e83cd2ef`.

## Questions and answers

### Browsers no longer support plugins. Why read them?

Current browsers still expose a fixed list, mostly PDF viewer entries, and that list differs between engines and some embedded browsers. Headless browsers often report none, and fake lists can be detected.

### Why is plugins excluded in Brave?

Brave's farbling randomises the plugin list per site and session, so reading it would only add noise. The exclusion table reports it as excluded with ruleId brave_farbling.

### What does none mean?

The list was empty. none is reported as a plain word, not a digest, so you can see it directly.

## Related pages

- [plugins_inconsistent flag](https://whiskerjs.com/docs/integrity/#plugins_inconsistent): Fires when the plugin and MIME type lists do not fit together.
- [pdf_viewer](https://whiskerjs.com/signals/pdf-viewer/): The built-in PDF viewer setting.
- [Brave](https://whiskerjs.com/browsers/brave/): Why seven components are excluded there.
- [Farbling](https://whiskerjs.com/glossary/#farbling): Brave's per-site randomisation.


---

# prefers_contrast

> The user's contrast preference from the prefers-contrast media query: more, less, custom or none.

Source: https://whiskerjs.com/signals/prefers-contrast/ (last updated 2026-10-26)

**prefers_contrast at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `prefers_contrast` |
| In the visitorId | yes |
| structuredId group | [prefs (display and accessibility preferences)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Operating systems let people ask for more contrast (or less) to make screens easier to read. Browsers pass that preference on to web pages so they can adapt. WhiskerJS records the preference: `more`, `less`, `custom` or `none` for no preference.

## What it reads

The CSS `prefers-contrast` media feature through `window.matchMedia()`.

## How the technique works

| Order | Query | Value reported |
| --- | --- | --- |
| 1 | `(prefers-contrast: more)` | `more` |
| 2 | `(prefers-contrast: less)` | `less` |
| 3 | `(prefers-contrast: custom)` | `custom` |
| 4 | `(prefers-contrast: no-preference)` | `none` |

The first match is reported; none matching gives `unavailable` with `no_match`.

## Why it helps

Most users have no preference, but those who set one keep it. That makes the uncommon values stable and distinctive, while the common value is shared by most devices.

On your server, read it together with the other four preference components. They share the `prefs` part of the [structuredId](https://whiskerjs.com/glossary/#structured-id), so a result where only that part moved usually means a display or accessibility setting changed, not a different device. See [Comparing two results](https://whiskerjs.com/docs/identifiers/#comparing-two-results).

## Stability

Very stable: it follows a system accessibility setting that people rarely toggle.

## Browser support and what blocks it

Current [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/), [Firefox](https://whiskerjs.com/browsers/firefox/), [Safari](https://whiskerjs.com/browsers/safari-macos/) and [iOS browsers](https://whiskerjs.com/browsers/safari-ios/) answer `prefers-contrast`; a browser version that does not know the feature reports `no_match`. No browser class excludes it.

## Privacy

An accessibility preference. `more` can hint at visual needs. WhiskerJS uses it only as a device characteristic and never acts on it. Drop it with `collect({ exclude: ['prefers_contrast'] })` if your purpose does not need it (this changes ids). Describe it in your [privacy notice](https://whiskerjs.com/privacy/privacy-notice/).

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | `more`, `less`, `custom` or `none` |
| `unavailable` | `no_api` | no `matchMedia` |
| `unavailable` | `no_match` | no query matched |
| `blocked` | `threw`, `security_error` | `matchMedia` throws |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

## Example value

All three headless test browsers in the container reported `none`.

## Questions and answers

### What does custom mean?

The user has a contrast setting that is neither clearly more nor clearly less, for example a forced colour palette with medium contrast. Browsers report it as custom.

### Why is none the most common value?

none is reported when prefers-contrast is no-preference, which is the default for most users.

## Related pages

- [forced_colors](https://whiskerjs.com/signals/forced-colors/): Forced colour modes.
- [reduced_motion](https://whiskerjs.com/signals/reduced-motion/): The motion preference.
- [Privacy](https://whiskerjs.com/docs/privacy/): Data minimisation and the exclude option.


---

# private_click

> Whether the browser supports WebKit's Private Click Measurement, read from a link element that is never attached to the page.

Source: https://whiskerjs.com/signals/private-click/ (last updated 2026-10-26)

**private_click at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `private_click` |
| In the visitorId | yes |
| structuredId group | [browser (engine and build)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 2](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Apple’s WebKit engine has a privacy-preserving way to measure ad clicks, called Private Click Measurement. Browsers that support it give every link element an extra property. WhiskerJS checks whether that property exists on a fresh link that it never shows. It tells WebKit browsers that support the feature apart from all others.

## What it reads

The `attributionSourceId` property (or its lower-case form `attributionsourceid`) of a new `<a>` element.

## How the technique works

1. One `<a>` element is created with `document.createElement('a')`. It gets no `href` and is never attached to the document.
2. The property is read. If it is `undefined` or `null`, the value is `none`; otherwise it is the property’s value as a string (for a fresh element usually `0`).

## Why it helps

Only WebKit builds with the feature have the property, so the value splits browsers into two groups along an engine and version line. It adds little within a group but is very stable, which is why it is in the visitorId’s `browser` group.

For your server it is also a consistency check: a result that claims to be Safari (by user agent or [`vendor`](https://whiskerjs.com/signals/vendor/)) but has `none` here, or a Chromium user agent with a WebKit attribution value, deserves a closer look. Combine it with [`apple_pay`](https://whiskerjs.com/signals/apple-pay/), the other WebKit-only signal in the group.

## Stability

Very stable: it changes only if the browser adds or removes the feature in an update.

## Browser support and what blocks it

- [Safari on macOS](https://whiskerjs.com/browsers/safari-macos/) and [Safari on iOS](https://whiskerjs.com/browsers/safari-ios/): the property exists when the WebKit build has the feature. Other iOS browsers share WebKit, but whether they expose it can depend on how they embed it.
- Chromium browsers ([Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/), [Brave](https://whiskerjs.com/browsers/brave/)) and [Firefox](https://whiskerjs.com/browsers/firefox/): `none`.

No browser class excludes it.

## Privacy

The value is a feature flag of the browser build. The element is never attached, so no click attribution data is created, read or sent.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | `none` or the property value |
| `unavailable` | `no_document` | no `document` or no `createElement` |
| `blocked` | `threw`, `security_error` | creating the element throws |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

Never hashed in practice (the value is short ASCII).

## Example value

In the container test, headless Chromium and Firefox reported `none` and headless WebKit reported `0`: the property existed on the fresh link.

## Questions and answers

### Does private_click measure clicks or ads?

No. It creates one link element without an address, reads one property and throws the element away. It never attaches it, never clicks it and never sends anything.

### Why is the value none in Chrome?

Private Click Measurement is a WebKit feature. Browsers without it have no attributionSourceId property, so the component reports none, which is an ok value.

## Related pages

- [apple_pay](https://whiskerjs.com/signals/apple-pay/): The other WebKit-only signal in the browser group.
- [Private Click Measurement](https://whiskerjs.com/glossary/#private-click-measurement): What the feature is.
- [Safari and every iOS browser](https://whiskerjs.com/browsers/safari-ios/): WebKit on iPhone and iPad.


---

# reduced_motion

> Whether the user asked the system to reduce animation, from the prefers-reduced-motion media query: reduce or none.

Source: https://whiskerjs.com/signals/reduced-motion/ (last updated 2026-10-26)

**reduced_motion at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `reduced_motion` |
| In the visitorId | yes |
| structuredId group | [prefs (display and accessibility preferences)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Phones and computers have a setting to reduce animations, used by people who find motion uncomfortable or distracting. Browsers tell web pages about it so they can calm their animations down. WhiskerJS records `reduce` when the setting is on and `none` when it is not.

## What it reads

The CSS `prefers-reduced-motion` media feature through `window.matchMedia()`.

## How the technique works

| Order | Query | Value reported |
| --- | --- | --- |
| 1 | `(prefers-reduced-motion: reduce)` | `reduce` |
| 2 | `(prefers-reduced-motion: no-preference)` | `none` |

The first match is reported; neither matching gives `unavailable` with `no_match`.

## Why it helps

It splits users into two groups along a long-lived setting. Most report `none`; those who report `reduce` usually keep it, so the value is stable for them.

On your server, read it together with the other four preference components. They share the `prefs` part of the [structuredId](https://whiskerjs.com/glossary/#structured-id), so a result where only that part moved usually means a display or accessibility setting changed, not a different device. See [Comparing two results](https://whiskerjs.com/docs/identifiers/#comparing-two-results).

## Stability

Stable. It changes only when the user toggles the system setting.

Because it is a system setting, every browser on the same device normally reports the same value, so it does not help tell two browsers on one device apart.

## Browser support and what blocks it

Supported by all current major browsers: [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Chrome Android](https://whiskerjs.com/browsers/chrome-android/), [Edge](https://whiskerjs.com/browsers/edge/), [Firefox](https://whiskerjs.com/browsers/firefox/), [Safari](https://whiskerjs.com/browsers/safari-macos/), [iOS browsers](https://whiskerjs.com/browsers/safari-ios/) and [Samsung Internet](https://whiskerjs.com/browsers/samsung-internet/). No browser class excludes it.

## Privacy

An accessibility preference that can hint at a user’s needs. WhiskerJS only reads it as one device characteristic. Exclude it with `collect({ exclude: ['reduced_motion'] })` if you do not need it (ids change). See [Privacy](https://whiskerjs.com/docs/privacy/#data-minimisation).

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | `reduce` or `none` |
| `unavailable` | `no_api` | no `matchMedia` |
| `unavailable` | `no_match` | neither query matched |
| `blocked` | `threw`, `security_error` | `matchMedia` throws |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

## Example value

All three headless test browsers in the container reported `none`.

## Questions and answers

### Who turns on reduced motion?

People who find animation distracting or uncomfortable, for example because of motion sensitivity, and people who simply prefer a calmer interface.

### Does WhiskerJS change animations on my page?

No. It only reads the media query. What your page does with the preference is up to your own CSS and code.

## Related pages

- [prefers_contrast](https://whiskerjs.com/signals/prefers-contrast/): The contrast preference.
- [forced_colors](https://whiskerjs.com/signals/forced-colors/): Forced colour modes.
- [color_gamut](https://whiskerjs.com/signals/color-gamut/): A display property in the same group.


---

# screen_frame

> The space the system keeps at each screen edge for the taskbar, dock or menu bar, as top,right,bottom,left in CSS pixels. Not in either id.

Source: https://whiskerjs.com/signals/screen-frame/ (last updated 2026-10-26)

**screen_frame at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `screen_frame` |
| In the visitorId | no (reported, kept out of both ids) |
| structuredId group | none |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | Firefox resistFingerprinting and Tor Browser (firefox_rfp) |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 2](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Your operating system keeps part of the screen for itself: the Windows taskbar, the macOS menu bar and Dock, a Linux panel. Browsers tell pages how much of the screen is available, so the difference shows how big that frame is and on which edge. WhiskerJS reports it as four numbers but keeps it out of the identifiers, because people move and hide their taskbars.

## What it reads

From `window.screen`: `width`, `height`, `availWidth`, `availHeight`, and, where the browser has them, `availTop` and `availLeft`.

## How the technique works

1. All four of `width`, `height`, `availWidth`, `availHeight` must be finite numbers, otherwise `unavailable`.
2. `top` is `availTop` (0 when missing), `left` is `availLeft` (0 when missing).
3. `right` is `width - availWidth - left`, `bottom` is `height - availHeight - top`.
4. The four values are rounded and written as `top,right,bottom,left`.

## Why it helps

The frame follows the operating system and the user’s layout: a 48 px taskbar at the bottom (`0,0,48,0`) is typical of Windows, a menu bar at the top is typical of macOS, and many setups are custom. It is useful context for your server and a consistency check against the platform.

Read it together with [`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/) and [`platform`](https://whiskerjs.com/signals/platform/): a frame that fits the platform (a bottom taskbar on Windows, a top menu bar on macOS) is ordinary, while a desktop user agent with no frame at all is common in virtual machines, kiosks and headless setups.

## Stability

Medium to low. It changes when the taskbar or dock is moved, resized or set to hide, and with multiple monitors (on some systems `availTop` and `availLeft` are positions within a larger desktop, which then shows up here). That is why it is outside both ids.

## Browser support and what blocks it

- Available in all current browsers. Phones and tablets often report `0,0,0,0` or a small top frame for the status bar, depending on the browser.
- [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): `excluded` / `firefox_rfp`: there the available area is reported equal to the screen. “No taskbar space” is also one of the traits WhiskerJS needs before it classes a Firefox as `firefox_rfp`.

## Privacy

It reveals the user’s screen layout preference (taskbar position and size), nothing more. It is not in an id.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | `top,right,bottom,left` |
| `unavailable` | `no_api` | no `screen`, or a size is not a finite number |
| `excluded` | `firefox_rfp` | browser class `firefox_rfp` |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

## Example value

All three headless test browsers in the container reported `0,0,0,0` (no taskbar on a virtual display). A Windows laptop with a bottom taskbar typically reports something like `0,0,48,0`.

## Questions and answers

### Why is screen_frame not in the id?

It changes when the user moves or resizes the taskbar or dock, hides it, or the window is on another monitor. That is too common for an identifier.

### What does 0,0,0,0 mean?

The browser reports no space kept by the system: for example a phone, a full-screen setup, a headless browser, or a browser that normalises the available area.

## Related pages

- [screen_resolution](https://whiskerjs.com/signals/screen-resolution/): The screen size, in the id.
- [pixel_ratio](https://whiskerjs.com/signals/pixel-ratio/): Another screen value outside the ids.
- [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): Where this component is excluded.


---

# screen_resolution

> The screen size in CSS pixels, larger side first, so that rotating a phone does not change it.

Source: https://whiskerjs.com/signals/screen-resolution/ (last updated 2026-10-26)

**screen_resolution at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `screen_resolution` |
| In the visitorId | yes |
| structuredId group | [device (screen, memory, CPU)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | Firefox resistFingerprinting and Tor Browser (firefox_rfp) |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> This is the size of your screen as the browser reports it, for example 1920x1080 on a common monitor or 932x430 on a large phone. WhiskerJS always writes the longer side first, so turning a phone sideways does not change it. It is a simple value, but it separates many devices.

## What it reads

`screen.width` and `screen.height`. Both are rounded to whole numbers and written as `<larger>x<smaller>`.

## How the technique works

The `screen` object describes the display the window is on, in CSS pixels. On phones and tablets the two numbers swap when the device rotates; sorting them removes that difference. If either value is missing or not a finite number, the component is `unavailable` / `no_api`.

## Why it helps

Screen sizes cluster around common models, but the combination with other device values (colour depth, CPU threads, memory, touch support) separates devices well. On phones the CSS screen size often follows the model closely. It is in the `device` group.

## Stability

It changes when the window moves to a different monitor, when the primary display changes, when the operating system’s display scaling changes (which changes the CSS pixel size), or on a new device. It does not follow the window size in normal browsers. Because the value is in CSS pixels, some browsers also report a different size while the page is zoomed; WhiskerJS does not correct for that. Note that a different monitor or scaling setting changes the `device` part of the structuredId; see [What changes the id](https://whiskerjs.com/docs/identifiers/#what-changes-the-id).

## Browser support and what blocks it

- `ok` in all browsers.
- [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): `excluded` / `firefox_rfp`, because the screen is reported as the content area.
- Headless browsers often report a fixed default size; the container test runs used for these pages reported `1280x720` in Chromium, Firefox and WebKit.

The same `screen.width` and `screen.height` are compared with a clean iframe by the [`iframe_mismatch`](https://whiskerjs.com/docs/integrity/#iframe_mismatch) check and checked for patched getters by [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering).

## Privacy

A screen size is coarse device information, read without permission or prompt, reported as plain text (it is short and ASCII). WhiskerJS sends nothing itself.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | for example `1920x1080` |
| `unavailable` | `no_api` | no `screen`, or width or height not a number |
| `blocked` | `security_error`, `threw` | reading threw |
| `excluded` | `firefox_rfp`, `caller_excluded` | exclusion table or your list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, budget, abort |

## Example value

```json
"screen_resolution": { "status": "ok", "value": "2560x1440", "hashed": false }
```

Other typical values: `1920x1080`, `932x430`.

## Questions and answers

### Does rotating my phone change screen_resolution?

No. WhiskerJS always reports the larger side first, so portrait and landscape give the same value, for example 932x430.

### Is this the physical resolution of the display?

No. screen.width and screen.height are in CSS pixels. A high-density display reports a smaller size than its physical pixels; the ratio between them is the separate pixel_ratio component.

### Why is it excluded under Firefox resistFingerprinting?

That mode reports the content area of the window as the screen size, so the value describes the window, not the screen.

## Related pages

- [pixel_ratio](https://whiskerjs.com/signals/pixel-ratio/): The device pixel ratio, outside the ids.
- [screen_frame](https://whiskerjs.com/signals/screen-frame/): Taskbar and dock space, outside the ids.
- [color_depth](https://whiskerjs.com/signals/color-depth/): Another screen property in the device group.
- [Firefox resistFingerprinting and Tor](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): Where it is excluded.
- [iframe_mismatch flag](https://whiskerjs.com/docs/integrity/#iframe_mismatch): Compares screen width and height with a clean frame.


---

# speech_voices

> The installed speech synthesis voices (name, language, local, default), sorted and hashed. Nothing is spoken. Kept out of both ids because some browsers fill the list late.

Source: https://whiskerjs.com/signals/speech-voices/ (last updated 2026-10-26)

**speech_voices at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `speech_voices` |
| In the visitorId | no (reported, kept out of both ids) |
| structuredId group | none |
| Hashing | always a digest, except the plain value none when nothing is found |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Computers and phones come with voices for reading text aloud, and which voices are installed depends on the operating system, its language packs and the browser. WhiskerJS asks the browser for that list and keeps a short hash of it. Nothing is ever spoken. Some browsers deliver the list late, so it is reported but kept out of the identifiers.

## What it reads

`speechSynthesis.getVoices()`: for each voice its `name`, `lang`, `localService` and `default` flags.

## How the technique works

1. Without `speechSynthesis.getVoices` the component is `unavailable` / `no_api`.
2. The list is read. If it is empty and the browser supports events, WhiskerJS listens for `voiceschanged` and waits up to 600 ms, whichever comes first, then reads the list again and removes the listener.
3. Each voice becomes `name|lang|local|default` (the flags as `1` or `0`); the entries are sorted and joined with `;`.
4. The value is always hashed; an empty list gives the plain value `none`.

## Why it helps

Voice lists differ a lot between operating systems, system languages and browsers (some browsers add network voices of their own, marked not local). Two devices with the same screen and fonts can still differ here.

Your server can use it as context next to the stable ids, for example to see that two results with the same visitorId also have the same voices, or to notice a minimal environment with no voices at all.

## Stability

Medium: some browsers fill the list only after a delay, so one run can see `none` and the next the full list. Installing a language pack or voice changes it too. That is why it is outside both ids.

## Browser support and what blocks it

Most current browsers, including [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/), [Safari](https://whiskerjs.com/browsers/safari-macos/), [iOS browsers](https://whiskerjs.com/browsers/safari-ios/) and [Firefox](https://whiskerjs.com/browsers/firefox/), have `speechSynthesis`. Headless and minimal builds often have no voices and report `none`. No browser class excludes it.

## Privacy

Installed voices can hint at the system languages a user has added. WhiskerJS reports only a digest and produces no sound. Leave it out with `collect({ exclude: ['speech_voices'] })` if you do not need it; no id changes.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | a digest, or plain `none` |
| `unavailable` | `no_api` | no `speechSynthesis.getVoices` |
| `unavailable` | `no_digest` | a non-empty list without `crypto.subtle` |
| `blocked` | `threw`, `security_error` | reading the voices throws |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

The 600 ms wait sits inside the 1000 ms inner timeout.

## Example value

In the container test, headless Chromium and Firefox reported `none` and headless WebKit reported the digest `89cde6c218596206e4119d0f5cf15c09`.

## Questions and answers

### Does WhiskerJS make the browser speak?

No. It only calls speechSynthesis.getVoices() to read the list. No utterance is created and nothing is spoken.

### Why is the list sometimes empty?

Some browsers load voices asynchronously. WhiskerJS waits up to 600 ms for the voiceschanged event; if the list is still empty it reports the plain value none.

## Related pages

- [fonts](https://whiskerjs.com/signals/fonts/): Another view of installed system resources.
- [languages](https://whiskerjs.com/signals/languages/): Language settings, in the id.
- [Timeouts and budgets](https://whiskerjs.com/docs/how-it-works/#timeouts-and-budgets): The voices wait and the other limits.


---

# storage

> Whether localStorage, sessionStorage and IndexedDB are reachable and cookies are enabled. Nothing is read from or written to any storage.

Source: https://whiskerjs.com/signals/storage/ (last updated 2026-10-26)

**storage at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `storage` |
| In the visitorId | yes |
| structuredId group | [browser (engine and build)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Web pages can usually keep small amounts of data in the browser (local storage, session storage, a database called IndexedDB, and cookies). Some users and browsers turn these off. WhiskerJS checks only whether each one is available, as four yes-or-no answers. It never stores or reads anything.

## What it reads

- whether `window.localStorage`, `window.sessionStorage` and `window.indexedDB` can be reached and are truthy;
- whether `navigator.cookieEnabled` is `true`.

## How the technique works

Each storage property is looked up on the window inside a `try` block. A truthy object gives `1`; a missing property, a falsy value or a throw (browsers throw a `SecurityError` where storage is blocked) gives `0`. The property is never called, read from or written to. The cookie flag is `1` only when `navigator.cookieEnabled` is exactly `true`. The value is `local=<0|1>,session=<0|1>,indexed_db=<0|1>,cookies=<0|1>`.

## Why it helps

Most browsers report all four as available, so the common value says little. The less common values (cookies off, storage blocked by a setting or policy) are stable per browser setup and separate those setups from the crowd.

On your server it also explains other behaviour: if your own login flow relies on a cookie and `cookies=0`, you know why the session did not stick. A browser that reports storage blocked in a top-level page, where normal browsers allow it, is an unusual setup worth weighing.

## Stability

Stable unless the user changes their cookie or site data settings, or the page is loaded in a context where storage is blocked (some sandboxed or third-party frames). A page that sometimes runs WhiskerJS in such a frame and sometimes not would see two values.

## Browser support and what blocks it

All current browsers have these APIs. Values of `0` come from settings, policies and frame contexts, not from missing support. The component always reports `ok`. No browser class excludes it. See the [browser pages](https://whiskerjs.com/browsers/).

## Privacy

Four yes-or-no answers about settings. WhiskerJS does not touch the stored data itself, does not set a cookie and keeps nothing between calls: each `collect()` starts from nothing. The test suite records every storage and cookie access on a fake browser to check this.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | always when it runs |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

Throws while reading a storage property are caught and reported as `0` inside the value. Never hashed.

## Example value

All three headless test browsers in the container reported `local=1,session=1,indexed_db=1,cookies=1`, the most common value.

## Questions and answers

### Does WhiskerJS store anything or read cookies?

No. This component only looks up whether the storage properties exist and reads navigator.cookieEnabled. It never reads, writes or sets a cookie or any stored value.

### Why would a storage API be reported as 0?

The property is missing, empty, or reading it throws, which browsers do when storage is blocked for the page, for example by a site data setting or in some sandboxed frames.

## Related pages

- [Privacy](https://whiskerjs.com/docs/privacy/): What WhiskerJS never does, and how the tests enforce it.
- [Fingerprinting without cookies](https://whiskerjs.com/privacy/fingerprinting-without-cookies/): Why WhiskerJS is stateless.
- [permissions](https://whiskerjs.com/signals/permissions/): Another view of the user's browser settings.


---

# time_zone

> The IANA time zone name, such as Europe/Berlin, from Intl; a UTC offset when Intl is missing.

Source: https://whiskerjs.com/signals/time-zone/ (last updated 2026-10-26)

**time_zone at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `time_zone` |
| In the visitorId | yes |
| structuredId group | [locale](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | Firefox resistFingerprinting and Tor Browser (firefox_rfp) |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Your computer or phone knows which time zone it is set to, for example Europe/Berlin or America/New_York, and browsers tell pages so they can show local times. WhiskerJS reads the name as it is. It is a simple, rarely changing setting, and a useful check against where your server thinks the visitor is.

## What it reads

The `timeZone` field of `new Intl.DateTimeFormat().resolvedOptions()`. If Intl is missing or gives nothing, WhiskerJS falls back to the offsets of 1 January and 1 July (of the year 2000) from `Date.prototype.getTimezoneOffset()`, takes the larger one (in minutes, as that method returns them) and reports it as `UTC+n` or `UTC-n`.

## How the technique works

The IANA name is the operating system’s time zone setting as the JavaScript engine sees it. It is more precise than an offset: two zones can share an offset today and differ in their daylight saving rules. The fallback uses two dates half a year apart so that daylight saving does not change the reported value from season to season.

The same Intl time zone also feeds the browser class: Firefox is only classed `firefox_rfp` when, among other traits, the time zone is `UTC`, `Etc/UTC` or `Atlantic/Reykjavik`.

## Why it helps

Time zones split visitors by region, and the value rarely changes for a given device. It is in the `locale` group of the [structuredId](https://whiskerjs.com/glossary/#structured-id), so a change of only that part often means a travel or a settings change rather than a new device.

## Stability

It changes when the user travels and the device updates its time zone automatically, when the user changes it by hand, and in rare cases when time zone rules or names are updated in the operating system’s data.

## Browser support and what blocks it

- `ok` in all current browsers.
- [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): `excluded` / `firefox_rfp`.
- Not excluded in [Brave](https://whiskerjs.com/browsers/brave/).

The [`iframe_mismatch`](https://whiskerjs.com/docs/integrity/#iframe_mismatch) check compares the Intl time zone with a clean iframe, and [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering) checks `Intl.DateTimeFormat.prototype.resolvedOptions` and `Date.prototype.getTimezoneOffset` for patches, which is how time zone spoofing scripts often show themselves.

On your server, compare it with the region of the request’s IP address. A large difference is worth a look, but VPNs, travel and corporate networks explain many of them; see [Recommended server checks](https://whiskerjs.com/docs/integration/#recommended-server-checks).

## Privacy

A coarse location hint at time zone level, chosen by the operating system. No permission, no geolocation, no prompt, no request.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | an IANA name or a `UTC+n` fallback |
| `unavailable` | `no_api` | neither Intl nor Date gave a value |
| `blocked` | `security_error`, `threw` | reading threw outside the guards |
| `excluded` | `firefox_rfp`, `caller_excluded` | exclusion table or your list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, budget, abort |

## Example value

```json
"time_zone": { "status": "ok", "value": "Europe/Berlin", "hashed": false }
```

## Questions and answers

### Does time_zone reveal my location?

Only at the level of a time zone, which usually covers a region or country. It is set by the operating system, not measured from GPS or the network.

### Why is time_zone excluded under Firefox resistFingerprinting?

That mode always reports UTC (newer releases Atlantic/Reykjavik), so the value says nothing about the device. The exclusion table reports excluded with ruleId firefox_rfp.

### Why does my automated test show UTC?

Many servers, containers and automation tools run in UTC. The headless test browsers used for these pages all reported UTC.

## Related pages

- [intl_locale](https://whiskerjs.com/signals/intl-locale/): Locale, calendar and hour cycle.
- [languages](https://whiskerjs.com/signals/languages/): The browser's language list.
- [resistFingerprinting](https://whiskerjs.com/glossary/#resistfingerprinting): Firefox's normalising mode.
- [Recommended server checks](https://whiskerjs.com/docs/integration/#recommended-server-checks): Comparing the time zone with the IP address region.
- [iframe_mismatch flag](https://whiskerjs.com/docs/integrity/#iframe_mismatch): Compares the Intl time zone with a clean frame.


---

# touch_support

> Maximum touch points, whether a TouchEvent can be created and whether ontouchstart exists, in one short value.

Source: https://whiskerjs.com/signals/touch-support/ (last updated 2026-10-26)

**touch_support at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `touch_support` |
| In the visitorId | yes |
| structuredId group | [device (screen, memory, CPU)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Touch screens report how many fingers they can track at once, and browsers on touch devices offer touch events to pages. WhiskerJS writes down three simple facts about this. A desktop usually says no touch at all, a phone says five or more touch points and touch events, and touch laptops are somewhere in between.

## What it reads

- `navigator.maxTouchPoints` (or the old `msMaxTouchPoints`), 0 when missing;
- whether `document.createEvent('TouchEvent')` succeeds (1) or throws (0);
- whether `ontouchstart` exists on the window (1 or 0).

The value is `points=<n>,event=<0|1>,start=<0|1>`.

## How the technique works

Each part is read in its own guard, so a missing property or a throwing call only sets that part to 0. Together they describe the input hardware and how the browser exposes it, which separates more cases than any part alone: desktop browsers, touch laptops, tablets that present a desktop user agent, and phones.

## Why it helps

It splits device classes cheaply and is a useful consistency check for your server: a phone user agent with `points=0,event=0,start=0`, or a desktop platform with ten touch points, is unusual. It is in the `device` group.

## Stability

Stable for a given device and browser. It can change when a touch screen or pen tablet is attached, when a browser’s device emulation is switched on in developer tools, or with a browser update that changes which touch APIs are exposed.

## Browser support and what blocks it

`ok` in all browsers; not in the exclusion table. Typical values: `points=0,event=0,start=0` on desktops, `points=5,event=1,start=1` on phones. See [Chrome on Android](https://whiskerjs.com/browsers/chrome-android/), [Safari and every iOS browser](https://whiskerjs.com/browsers/safari-ios/) and [Samsung Internet](https://whiskerjs.com/browsers/samsung-internet/) for touch devices.

## Privacy

Three coarse facts about touch input. No permission, no prompt, no request; no touch event is listened to or dispatched.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | always, in practice |
| `blocked` | `security_error`, `threw` | only if something outside the guards throws (not expected) |
| `excluded` | `caller_excluded` | your `exclude` list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, budget, abort |

## Example value

From the headless test browsers in a container: `points=0,event=0,start=0` (Chromium and Firefox) and `points=0,event=1,start=0` (WebKit).

```json
"touch_support": { "status": "ok", "value": "points=5,event=1,start=1", "hashed": false }
```

## Questions and answers

### Why does a desktop sometimes show event=1?

Some browsers let pages create a TouchEvent even without a touch screen; the headless WebKit test browser used for these pages did. That is why WhiskerJS reports three separate parts instead of one yes or no.

### Can touch_support fail?

Practically not. Each part has a safe default of 0, so the component is almost always ok. It can only be excluded by you or time out.

## Related pages

- [screen_resolution](https://whiskerjs.com/signals/screen-resolution/): The screen size.
- [platform](https://whiskerjs.com/signals/platform/): navigator.platform.
- [ua_client_hints](https://whiskerjs.com/signals/ua-client-hints/): The mobile flag in Chromium.
- [Safari and every iOS browser](https://whiskerjs.com/browsers/safari-ios/): Touch devices on WebKit.


---

# ua_client_hints

> Chromium's User-Agent Client Hints, without version numbers: brands (GREASE removed), mobile, platform, and the stable high-entropy hints.

Source: https://whiskerjs.com/signals/ua-client-hints/ (last updated 2026-10-26)

**ua_client_hints at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `ua_client_hints` |
| In the visitorId | yes |
| structuredId group | [browser (engine and build)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 2](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Chromium-based browsers (Chrome, Edge, Brave, Samsung Internet and others) describe themselves in a structured way called User-Agent Client Hints: the browser brands, whether it is a phone, the operating system, and on request a few more details such as the CPU architecture. WhiskerJS keeps the parts that rarely change and leaves out version numbers. Other browsers do not offer this, and the component then says so.

## What it reads

From `navigator.userAgentData`:

- `brands`: the brand names, without their versions;
- `mobile` and `platform`;
- from one `getHighEntropyValues()` call: `architecture`, `bitness`, `wow64`, `model` and `formFactors`.

The same call also asks for `fullVersionList` and `platformVersion`, which go to the separate [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) component. One request per collection is shared by both.

## How the technique works

1. If `navigator.userAgentData` is not an object, the component is `unavailable` with `no_api`.
2. Brands are filtered: any brand that reads `notabrand` once reduced to lower-case letters is a [GREASE](https://whiskerjs.com/glossary/#grease) brand (for example `Not_A Brand` or `Not)A;Brand`) and is dropped. The rest are sorted by name.
3. `getHighEntropyValues([...])` is called once. Booleans become `1` or `0`; form factors are sorted and joined with `+`.
4. The value is `brands=...;mobile=...;platform=...;arch=...;bitness=...;wow64=...;model=...;form=...`.
5. If the detailed call is refused (`NotAllowedError` or `SecurityError`, as when a [Permissions Policy](https://whiskerjs.com/glossary/#permissions-policy) blocks it), the end of the value is the stable marker `he=blocked`. Another error gives `he=failed`; a browser without `getHighEntropyValues` gives `he=none`.

## Why it helps

It states the device class and architecture more reliably than the user agent string, which Chromium has reduced: `mobile`, the platform, `arm` or `x86`, 32 or 64 bit, the Windows-on-Windows flag, the Android model name and the form factor. Brand names separate Chrome, Edge, Brave and other Chromium builds. Without versions the value stays put across browser updates.

## Stability

- Brands without versions, platform and architecture rarely change.
- A new GREASE brand in a browser update does not change the value, because GREASE brands are filtered.
- The value changes if the browser renames a brand, if the page context changes from allowed to refused for the detailed hints (the `he=blocked` marker replaces the details), or when the device or form factor changes.

## Browser support and what blocks it

| Browser | What you get |
| --- | --- |
| [Chrome desktop](https://whiskerjs.com/browsers/chrome-desktop/), [Chrome Android](https://whiskerjs.com/browsers/chrome-android/), [Edge](https://whiskerjs.com/browsers/edge/), [Brave](https://whiskerjs.com/browsers/brave/), [Samsung Internet](https://whiskerjs.com/browsers/samsung-internet/) | `ok` (Chromium-based) |
| [Safari](https://whiskerjs.com/browsers/safari-macos/), [every iOS browser](https://whiskerjs.com/browsers/safari-ios/), [Firefox](https://whiskerjs.com/browsers/firefox/) | `unavailable` / `no_api` by design |
| Chromium in a frame or page whose Permissions Policy refuses the detailed hints | `ok` ending in `he=blocked` |

## Privacy

The low-entropy part (brands, mobile, platform) is what Chromium already sends to servers by default. The detailed hints add the architecture, bitness and, on Android, the model name. WhiskerJS requests no version numbers for this component, makes no request and shows no prompt. Values over 128 characters or with non-ASCII characters (for example an unusual model name) are hashed.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | the value, with details or a `he=blocked`, `he=failed` or `he=none` marker |
| `unavailable` | `no_api` | no `navigator.userAgentData` |
| `unavailable` | `no_digest` | the value needs hashing and there is no `crypto.subtle` |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | the detailed hints did not answer within 1000 ms, or budget or abort |

Errors of the detailed call never fail the component; they become a marker. Your server can compare the `platform` here with the user agent header it receives; see [Recommended server checks](https://whiskerjs.com/docs/integration/#recommended-server-checks).

## Example value

From headless Chromium in a Linux container: `brands=Chromium,HeadlessChrome;mobile=0;platform=Linux;arch=arm;bitness=64;wow64=0;model=;form=Desktop`. Firefox and WebKit in the same run: `unavailable` / `no_api`. A desktop Chrome on a Mac looks like `brands=Chromium,Google Chrome;mobile=0;platform=macOS;arch=arm;bitness=64;wow64=0;model=;form=Desktop`.

## Questions and answers

### What is the GREASE brand and why is it removed?

Chromium adds a deliberately odd brand such as Not_A Brand that changes between versions, so that sites do not depend on an exact brand list. WhiskerJS drops any brand that reads notabrand once reduced to letters, so the id does not change with it.

### Does getHighEntropyValues prompt the user?

No. It is a promise-based read with no prompt and no network request. A page or frame can be refused by a Permissions Policy, which WhiskerJS reports with the stable marker he=blocked.

### Why are version numbers not in this component?

They change with every browser and operating system update. They are reported separately in ua_versions, which is outside both ids.

### Why is it unavailable in Safari and Firefox?

Only Chromium-based browsers implement navigator.userAgentData. Elsewhere the component is unavailable with ruleId no_api, by design.

## Related pages

- [ua_versions](https://whiskerjs.com/signals/ua-versions/): The full version numbers, kept out of the ids.
- [Client Hints](https://whiskerjs.com/glossary/#client-hints): What User-Agent Client Hints are.
- [GREASE](https://whiskerjs.com/glossary/#grease): Why brand lists contain a fake brand.
- [Permissions Policy](https://whiskerjs.com/glossary/#permissions-policy): How a page can refuse the detailed hints.
- [platform](https://whiskerjs.com/signals/platform/): navigator.platform, available in every browser.


---

# ua_versions

> Full brand versions and the operating system version from Chromium's Client Hints. Reported for your server, kept out of both ids because every update changes them.

Source: https://whiskerjs.com/signals/ua-versions/ (last updated 2026-10-26)

**ua_versions at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `ua_versions` |
| In the visitorId | no (reported, kept out of both ids) |
| structuredId group | none |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 2](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Chromium-based browsers can tell a page their exact version numbers and the operating system version. That is useful for your server, for example to spot an outdated browser or a mismatch with the request headers, but it changes with every update. WhiskerJS reports it separately and never lets it touch the identifiers.

## What it reads

From `navigator.userAgentData`: `fullVersionList` and `platformVersion` from the shared `getHighEntropyValues()` call, or the low-entropy `brands` list when the detailed call gives nothing.

## How the technique works

1. Without `navigator.userAgentData` the component is `unavailable` / `no_api`.
2. It uses the same single high-entropy request as [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/).
3. Brands are filtered for [GREASE](https://whiskerjs.com/glossary/#grease) and sorted. When `fullVersionList` is present and not empty it is used; otherwise the low-entropy `brands`, whose versions are major versions only.
4. The value is `brands=Name/version,...;platform_version=<v>` when the detailed hints came back, or `brands=...;he=<state>` when they were blocked (`he=blocked`), failed (`he=failed`) or do not exist (`he=none`).
5. Longer than 128 characters means it is hashed.

## Why it helps

Exact versions are a strong consistency check against the user agent header and the [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) brands, and they show outdated or unusual builds. They also explain id changes: if the `browser` group moved and `ua_versions` moved too, a browser update is the likely cause.

Keep it with the stored result so you can explain id changes later: when you see a new visitorId for a known account, an older and a newer `ua_versions` side by side often answer the question in seconds.

## Stability

Low by design: it changes with every browser or operating system update. That is the reason it is outside both ids.

## Browser support and what blocks it

- Chromium-based browsers: [Chrome desktop](https://whiskerjs.com/browsers/chrome-desktop/), [Chrome Android](https://whiskerjs.com/browsers/chrome-android/), [Edge](https://whiskerjs.com/browsers/edge/), [Brave](https://whiskerjs.com/browsers/brave/), [Samsung Internet](https://whiskerjs.com/browsers/samsung-internet/).
- [Safari](https://whiskerjs.com/browsers/safari-macos/), [iOS browsers](https://whiskerjs.com/browsers/safari-ios/) and [Firefox](https://whiskerjs.com/browsers/firefox/): `unavailable` / `no_api`.
- A [Permissions Policy](https://whiskerjs.com/glossary/#permissions-policy) that refuses the detailed hints gives `he=blocked`.

## Privacy

Version numbers are shared by everyone on the same release, so they identify a release rather than a person. Your server already receives similar information in the user agent header. The value is not in an id.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | versions, or a `he=` marker |
| `unavailable` | `no_api` | no `navigator.userAgentData` |
| `unavailable` | `no_digest` | a long value needs hashing without `crypto.subtle` |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | the hints did not answer in 1000 ms, or budget or abort |

## Example value

From headless Chromium in a Linux container: `brands=Chromium/140.0.7339.16,HeadlessChrome/140.0.7339.16;platform_version=7.0.14`. Firefox and WebKit in the same run: `unavailable` / `no_api`.

## Questions and answers

### Why are versions kept out of the visitorId?

Browsers update every few weeks and operating systems often. With versions in the id, every update would give the same device a new id.

### What do I get when the detailed hints are refused?

The brand list falls back to the low-entropy brands with their major versions only, and the second part becomes he=blocked (or he=failed, he=none) instead of platform_version.

### Why is ua_versions sometimes a digest?

Any value longer than 128 characters is hashed. A long brand list with full versions can pass that limit.

## Related pages

- [ua_client_hints](https://whiskerjs.com/signals/ua-client-hints/): The stable part of Client Hints, in the id.
- [High-entropy hints](https://whiskerjs.com/glossary/#high-entropy-hints): The detailed Client Hints.
- [Recommended server checks](https://whiskerjs.com/docs/integration/#recommended-server-checks): Compare versions with the request headers.


---

# vendor_flavors

> Which of ten browser-specific global objects exist on the page, such as window.chrome or the globals iOS browsers inject.

Source: https://whiskerjs.com/signals/vendor-flavors/ (last updated 2026-10-26)

**vendor_flavors at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `vendor_flavors` |
| In the visitorId | yes |
| structuredId group | [browser (engine and build)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Some browsers leave their own named objects on every web page, such as `chrome` in Chrome or the helper objects that Chrome and Firefox add on iPhone. WhiskerJS checks which of ten such names exist. It is a simple way to tell apart browsers that otherwise look alike, including different apps on iOS that all use Apple’s engine, and in-app browsers.

## What it reads

Whether each of these globals exists on the window and is not `null` or `undefined`: `__crWeb`, `__firefox__`, `__gCrWeb`, `chrome`, `opr`, `safari`, `samsungAr`, `ucweb`, `webkit`, `yandex`.

## How the technique works

For each name, in the fixed order above, WhiskerJS checks `name in window` and that the value is not `null` or `undefined`. A throwing lookup counts as absent. The found names are joined with commas; if none is found the value is `none`. Only presence is checked: the objects are not called or inspected.

## Why it helps

The globals come from the browser build, not the device: `chrome` in Chromium browsers, `opr` in Opera, `yandex` in Yandex Browser, `samsungAr` in some Samsung Internet builds, `safari` in Safari, `webkit` in some WebKit-based in-app browser views, and `__crWeb`, `__gCrWeb` and `__firefox__` injected by Chrome and Firefox on iOS. That separates browser apps that share an engine and would otherwise give very similar results.

## Stability

Stable for a given browser build. It changes when a browser adds or removes one of these globals in an update. Pages that define a global with one of these names themselves (rare) would change it too.

Because the value lists names rather than reading the objects, a browser that changes what is inside `window.chrome` between versions does not change it; only a global appearing or disappearing does.

## Browser support and what blocks it

Every browser can be checked; the value just differs. Desktop [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/) and [Brave](https://whiskerjs.com/browsers/brave/) usually show `chrome`; [Safari](https://whiskerjs.com/browsers/safari-macos/) usually shows `safari`; [Firefox](https://whiskerjs.com/browsers/firefox/) usually shows `none`; [iOS browsers](https://whiskerjs.com/browsers/safari-ios/) can show their injected helpers. No browser class excludes it.

## Privacy

The names describe the browser app, not the user. No global is read beyond checking that it exists.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | a comma-separated list, or `none` |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

Errors during a lookup are caught per name. Never hashed in practice. The related [`headless_markers`](https://whiskerjs.com/docs/integrity/#headless_markers) flag fires when the user agent is desktop Chrome but `window.chrome` is missing.

## Example value

In the container test, headless Chromium and Firefox reported `none` and headless WebKit reported `safari`.

## Questions and answers

### Can vendor_flavors tell Chrome on iPhone from Safari?

Often yes. Chrome and Firefox on iOS inject their own globals (for example __gCrWeb or __firefox__) into pages, which Safari does not have, even though all of them run on WebKit.

### What does none mean?

None of the ten globals exists. It is an ok value; headless Chromium without window.chrome reports it, for example.

## Related pages

- [vendor](https://whiskerjs.com/signals/vendor/): The vendor string.
- [browser_class](https://whiskerjs.com/signals/browser-class/): Uses window.chrome as one input.
- [headless_markers flag](https://whiskerjs.com/docs/integrity/#headless_markers): Fires for a desktop Chrome user agent without window.chrome.
- [Safari and every iOS browser](https://whiskerjs.com/browsers/safari-ios/): Where injected globals matter most.


---

# vendor

> The browser vendor string from navigator.vendor: Google Inc., Apple Computer, Inc., or empty in Firefox.

Source: https://whiskerjs.com/signals/vendor/ (last updated 2026-10-26)

**vendor at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `vendor` |
| In the visitorId | yes |
| structuredId group | [browser (engine and build)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Browsers report a vendor name to web pages. Chromium-based browsers say Google, Safari and every browser on iPhone say Apple, and Firefox says nothing. WhiskerJS records that short string. On its own it only splits browsers into three big families, but it is stable and is checked against other values for signs of spoofing.

## What it reads

`navigator.vendor`, a string.

## How the technique works

The property is read once. An empty string is reported as the word `empty`; any other string as it is; a non-string gives `unavailable`. A throwing getter reaches the runner and gives `blocked`.

## Why it helps

It is one of the clearest engine hints a page can read: `Google Inc.` for Chromium browsers, `Apple Computer, Inc.` for WebKit, empty for Gecko. It feeds [`browser_class`](https://whiskerjs.com/signals/browser-class/), and because it is in the id, a tool that changes it changes the id.

Its most useful role on your server is as a cross-check. A result whose `vendor` is `Google Inc.` while the request’s user agent header names Safari, or whose `vendor` is `empty` while [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) is available (only Chromium offers it), describes a browser that is not what it claims. WhiskerJS never draws that conclusion itself; it gives you the values.

## Stability

Fixed per engine family. It changes only when the browser changes engine, or a user agent switcher changes it.

## Browser support and what blocks it

| Browser | Typical value |
| --- | --- |
| [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/), [Brave](https://whiskerjs.com/browsers/brave/), [Samsung Internet](https://whiskerjs.com/browsers/samsung-internet/) | `Google Inc.` |
| [Safari](https://whiskerjs.com/browsers/safari-macos/) and [every iOS browser](https://whiskerjs.com/browsers/safari-ios/) | `Apple Computer, Inc.` |
| [Firefox](https://whiskerjs.com/browsers/firefox/) | `empty` |

No browser class excludes it.

## Privacy

A family name shared by every user of that engine. Nothing personal.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` |   | the vendor string, or `empty` |
| `unavailable` | `no_api` | not a string |
| `blocked` | `threw`, `security_error` | the getter throws |
| `excluded` | `caller_excluded` | you excluded it |
| `timed_out` | `timeout`, `aborted` | budget or abort |

`vendor` is also compared with a clean iframe by [`iframe_mismatch`](https://whiskerjs.com/docs/integrity/#iframe_mismatch) and watched by [`navigator_own_property`](https://whiskerjs.com/docs/integrity/#navigator_own_property). The [`engine_mismatch`](https://whiskerjs.com/docs/integrity/#engine_mismatch) flag checks whether the class it helped pick matches how the engine behaves.

## Example value

In the container test: headless Chromium `Google Inc.`, Firefox `empty`, WebKit `Apple Computer, Inc.`.

## Questions and answers

### Why does Firefox report empty?

Firefox returns an empty string for navigator.vendor. WhiskerJS writes it as the word empty so that it is a visible, ok value rather than looking like a missing one.

### Why do all iPhone browsers say Apple Computer, Inc.?

They all run on WebKit, which reports that vendor. It is one reason WhiskerJS classes every iOS browser as safari.

## Related pages

- [browser_class](https://whiskerjs.com/signals/browser-class/): vendor is one input to the class.
- [vendor_flavors](https://whiskerjs.com/signals/vendor-flavors/): Browser-specific globals that tell builds apart.
- [iframe_mismatch flag](https://whiskerjs.com/docs/integrity/#iframe_mismatch): Compares vendor with a fresh iframe.
- [navigator_own_property flag](https://whiskerjs.com/docs/integrity/#navigator_own_property): Fires when vendor is overridden on navigator itself.


---

# webgl_image

> A 32 by 32 pixel WebGL drawing of one shaded triangle, read back twice and reported as a digest.

Source: https://whiskerjs.com/signals/webgl-image/ (last updated 2026-10-26)

**webgl_image at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `webgl_image` |
| In the visitorId | yes |
| structuredId group | [gpu (graphics)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | always a digest (first 128 bits of SHA-256) |
| Excluded under | Brave (brave_farbling); Firefox resistFingerprinting and Tor Browser (firefox_rfp) |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> WhiskerJS asks the graphics chip to draw one small coloured triangle with a tiny shader program and reads the resulting pixels back. Different GPUs and drivers compute colours and edges in slightly different ways, so the pixels differ between devices. The drawing is done twice: if the two results are not identical, the browser is adding noise and the value is left out.

## What it reads

`webgl_image` uses the shared WebGL context of the collection: a detached 32 by 32 pixel canvas with a `webgl` (or `experimental-webgl`) context created with `preserveDrawingBuffer: true` and `antialias: false`. It compiles a vertex shader and a fragment shader, draws one triangle whose colour is computed per pixel from its position (with `fract` and `sin`), and reads all 32 by 32 RGBA pixels back with `readPixels()`. Those 4096 bytes are the value.

## How the technique works

1. Compile and link a minimal shader program, upload three vertices, clear the canvas to a fixed colour and draw the triangle.
2. Read the pixel buffer with `readPixels()`.
3. Draw and read again.
4. Compare the two buffers byte by byte. Any difference means `noisy` with ruleId `render_mismatch`.
5. If they match, the bytes are hashed with SHA-256 and the first 128 bits are reported.

The shader’s procedural colour depends on floating-point precision in the GPU’s fragment pipeline, and the triangle’s edges depend on the rasteriser, which is where devices tend to differ.

## Why it helps

Shader arithmetic and rasterisation are implemented by the GPU, its driver and the browser’s graphics layer (for example ANGLE on many Chromium builds). Different combinations can round colours or place edge pixels differently. The same combination normally gives the same bytes. It is part of the `gpu` group of the [structuredId](https://whiskerjs.com/glossary/#structured-id).

## Stability

It can change after a GPU driver update, a browser update that changes the graphics back end, switching hardware acceleration on or off, moving a window to a GPU that the browser treats differently, or a browser mode or extension that adds readback noise. A change of only the `gpu` structuredId part is the typical pattern; see [Comparing two results](https://whiskerjs.com/docs/identifiers/#comparing-two-results).

## Browser support and what blocks it

- `ok` wherever WebGL 1 is available, which includes current desktop and mobile versions of [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/), [Safari](https://whiskerjs.com/browsers/safari-macos/), [Firefox](https://whiskerjs.com/browsers/firefox/) and [Samsung Internet](https://whiskerjs.com/browsers/samsung-internet/), unless WebGL is turned off or blocked.
- [Brave](https://whiskerjs.com/browsers/brave/): `excluded` / `brave_farbling`.
- [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): `excluded` / `firefox_rfp`.
- Without WebGL (turned off, blocklisted GPU, some containers): `unavailable` / `no_context`. In the headless Firefox test run in a container used for these pages, all four WebGL components were `unavailable` / `no_context`.

## Privacy

The image is a fixed test pattern; it contains nothing about the page or the user. It reveals graphics hardware and driver behaviour. It leaves the library only as a 32-character digest. WebGL needs no permission and WhiskerJS makes no request.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | two identical reads; value is a digest |
| `noisy` | `render_mismatch` | the two reads differed |
| `unavailable` | `no_document`, `no_api`, `no_context` | no document, no `getContext`, or no WebGL context |
| `unavailable` | `no_digest` | no Web Crypto to hash the bytes |
| `blocked` | `security_error`, `threw` | a WebGL call threw |
| `excluded` | `brave_farbling`, `firefox_rfp`, `caller_excluded` | exclusion table or your `exclude` list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, overall budget, abort |

## Example value

From a headless Chromium test browser in a container (software rendering through SwiftShader):

```json
"webgl_image": { "status": "ok", "value": "fc51c63a9379589055c4503f7b7a2cb6", "hashed": true }
```

## Questions and answers

### Why is webgl_image unavailable with no_context?

The browser could not create a WebGL 1 context: WebGL is turned off, the GPU is blocklisted, or the environment has no graphics support at all. The other WebGL components report the same reason because they share one context.

### Does WhiskerJS keep WebGL running after collect()?

No. One WebGL context is created per collection and released with the WEBGL_lose_context extension once every collector has settled.

### Why is it excluded in Brave and Firefox resistFingerprinting?

Both randomise or block WebGL readback on purpose. Reading it would only add noise, so the exclusion table skips it and reports brave_farbling or firefox_rfp.

## Related pages

- [canvas](https://whiskerjs.com/signals/canvas/): The 2D canvas scene, also drawn twice.
- [webgl_params](https://whiskerjs.com/signals/webgl-params/): WebGL limits, precisions and extensions.
- [webgl_renderer](https://whiskerjs.com/signals/webgl-renderer/): The GPU name from the same context.
- [Double render](https://whiskerjs.com/glossary/#double-render): Why drawing twice detects noise.
- [Noise handling](https://whiskerjs.com/docs/how-it-works/#noise-handling-the-double-render): The double render in the docs.


---

# webgl_params

> 21 WebGL parameters, the precision of eight shader formats and the sorted list of extensions, as one digest.

Source: https://whiskerjs.com/signals/webgl-params/ (last updated 2026-10-26)

**webgl_params at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `webgl_params` |
| In the visitorId | yes |
| structuredId group | [gpu (graphics)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | always a digest (first 128 bits of SHA-256) |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Every graphics setup tells web pages what it can do: the biggest texture it can handle, how many inputs a shader may have, how precise its numbers are, and which optional features (extensions) it supports. WhiskerJS reads that list and turns it into one short code. Different GPUs, drivers and browsers report different lists.

## What it reads

From the shared WebGL 1 context of the collection:

- 21 parameters with `getParameter()`: `ALIASED_LINE_WIDTH_RANGE`, `ALIASED_POINT_SIZE_RANGE`, `ALPHA_BITS`, `BLUE_BITS`, `DEPTH_BITS`, `GREEN_BITS`, `MAX_COMBINED_TEXTURE_IMAGE_UNITS`, `MAX_CUBE_MAP_TEXTURE_SIZE`, `MAX_FRAGMENT_UNIFORM_VECTORS`, `MAX_RENDERBUFFER_SIZE`, `MAX_TEXTURE_IMAGE_UNITS`, `MAX_TEXTURE_SIZE`, `MAX_VARYING_VECTORS`, `MAX_VERTEX_ATTRIBS`, `MAX_VERTEX_TEXTURE_IMAGE_UNITS`, `MAX_VERTEX_UNIFORM_VECTORS`, `MAX_VIEWPORT_DIMS`, `RED_BITS`, `SHADING_LANGUAGE_VERSION`, `STENCIL_BITS` and `VERSION`;
- with `getShaderPrecisionFormat()`, the range and precision of `HIGH_FLOAT`, `MEDIUM_FLOAT`, `LOW_FLOAT` and `HIGH_INT` in both the vertex and the fragment shader (eight entries);
- the list from `getSupportedExtensions()`, sorted alphabetically.

## How the technique works

Each value is written as `NAME=value` (arrays joined with commas, `!` when a call throws, an empty value when it returns nothing), the precision entries as `SHADER.PRECISION=rangeMin,rangeMax,precision`, and the extensions as one comma-separated list. All parts are joined with semicolons into one string, which is always hashed with SHA-256 because `webgl_params` is a large component. Sorting the extension list makes the value independent of the order the browser returns them in.

## Why it helps

Limits and extensions come from the GPU, the driver and the browser’s graphics layer together. A laptop’s integrated GPU, a desktop card and a phone’s GPU report different texture limits and precisions, and browsers expose different extension sets. The combination separates graphics setups that a renderer name alone might group together. It is part of the `gpu` group.

## Stability

These values change rarely. They can change with a browser update (new or removed extensions, changed limits), a driver update, switching hardware acceleration, or a different GPU being used. They do not depend on the page, the zoom level or the window size.

## Browser support and what blocks it

`ok` wherever a WebGL 1 context can be created. It is not in the exclusion table, so it is collected in [Brave](https://whiskerjs.com/browsers/brave/) and in [Firefox resistFingerprinting](https://whiskerjs.com/browsers/firefox-rfp-and-tor/) too (those modes change the rendered image and the GPU strings, not this list). Without WebGL it is `unavailable` / `no_context`, together with the other WebGL components.

## Privacy

It reveals the capabilities of the graphics stack, not what the user does. The whole list leaves the library only as a 32-character digest. No permission, no prompt, no request.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | the list was read; value is a digest |
| `unavailable` | `no_document`, `no_api`, `no_context` | no document, no `getContext`, or no WebGL context |
| `unavailable` | `no_digest` | no Web Crypto |
| `blocked` | `security_error`, `threw` | a WebGL call threw outside the per-parameter guards |
| `excluded` | `caller_excluded` | your `exclude` list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, overall budget, abort |

A single parameter that throws does not fail the component: it is written as `!` inside the hashed string.

## Example value

From a headless Chromium test browser in a container:

```json
"webgl_params": { "status": "ok", "value": "79906793c9fee64879c122d10676691b", "hashed": true }
```

## Questions and answers

### Why is webgl_params not checked for noise?

It reads numbers and names the browser reports, not rendered pixels, so there is nothing for readback noise to change. The rendered image is checked separately in webgl_image.

### Can a browser update change it?

Yes. A new browser version can add or remove WebGL extensions or change a reported limit, and the digest then changes.

## Related pages

- [webgl_image](https://whiskerjs.com/signals/webgl-image/): The rendered image from the same context.
- [webgl_renderer](https://whiskerjs.com/signals/webgl-renderer/): The GPU name.
- [webgpu](https://whiskerjs.com/signals/webgpu/): A newer view of the GPU's limits and features.
- [Digest](https://whiskerjs.com/glossary/#digest): How large values are reported.


---

# webgl_renderer

> The GPU name the browser reports through WebGL, often with the graphics back end.

Source: https://whiskerjs.com/signals/webgl-renderer/ (last updated 2026-10-26)

**webgl_renderer at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `webgl_renderer` |
| In the visitorId | yes |
| structuredId group | [gpu (graphics)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | Firefox resistFingerprinting and Tor Browser (firefox_rfp) |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Browsers can tell a page which graphics chip draws its 3D content, for example “Apple M2” or a model of Intel, AMD or NVIDIA GPU, often wrapped in the name of the browser’s graphics layer. WhiskerJS reads that name as text. It is one of the most readable device details there is, and it also shows when there is no GPU at all.

## What it reads

From the shared WebGL 1 context:

- in browsers other than Firefox, WhiskerJS asks for the `WEBGL_debug_renderer_info` extension and, when it exists, reads `UNMASKED_RENDERER_WEBGL` with `getParameter()`;
- if that gives nothing (no extension, or an empty answer), it reads the plain `gl.RENDERER` value instead;
- in Firefox (browser class `firefox` or `firefox_rfp`) the extension is not requested at all: Firefox prints a deprecation warning in the console when it is, and its plain `RENDERER` already carries the unmasked string. WhiskerJS writes nothing to the console, so it avoids that call.

An empty result is `unavailable` / `no_value`.

## How the technique works

The browser’s “masked” renderer value is often a generic word such as “WebKit WebGL”. The debug extension exposes the underlying string the graphics driver reports. Chromium browsers usually wrap it in ANGLE, the translation layer they use, for example `ANGLE (Apple, ANGLE Metal Renderer: Apple M2, Unspecified Version)`. The string is reported as is unless it is longer than 128 characters or not printable ASCII, in which case it is hashed like any other value.

The raw string is also kept, inside the library only, for the [`software_renderer`](https://whiskerjs.com/docs/integrity/#software_renderer) check, which fires when it names SwiftShader, llvmpipe, softpipe, a “software rasterizer”, the “basic render driver” or Mesa offscreen.

## Why it helps

It names the GPU family and often the model and graphics back end (Metal, Direct3D, OpenGL, Vulkan). That separates devices clearly and, read together with the platform and the user agent your server sees, can expose inconsistencies such as a desktop GPU on a phone user agent. It is in the `gpu` group.

## Stability

Stable until the browser or driver changes how the GPU is described, or a different GPU is used (an external display on a laptop with two GPUs, or hardware acceleration switched off). Browser updates sometimes change the ANGLE wrapping text.

## Browser support and what blocks it

- `ok` wherever WebGL 1 is available: [Chrome](https://whiskerjs.com/browsers/chrome-desktop/), [Edge](https://whiskerjs.com/browsers/edge/), [Brave](https://whiskerjs.com/browsers/brave/), [Safari](https://whiskerjs.com/browsers/safari-macos/), [Firefox](https://whiskerjs.com/browsers/firefox/) and mobile browsers. Some browsers report only a generic name (the headless WebKit test run in a container used for these pages reported `Apple GPU`).
- [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): `excluded` / `firefox_rfp`.
- No WebGL: `unavailable` / `no_context`.

## Privacy

It reveals the graphics hardware, which is device information and can be personal data together with the rest of the result. It is read without any permission or prompt and nothing is sent by WhiskerJS. Long or unusual strings leave only as a digest.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | plain text, or a digest when long or not printable ASCII |
| `unavailable` | `no_value` | both the unmasked and the plain value were empty |
| `unavailable` | `no_document`, `no_api`, `no_context` | no document, no `getContext`, no WebGL |
| `unavailable` | `no_digest` | the string needed hashing and Web Crypto is missing |
| `blocked` | `security_error`, `threw` | `getParameter` threw |
| `excluded` | `firefox_rfp`, `caller_excluded` | exclusion table or your `exclude` list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, overall budget, abort |

## Example value

From a headless Chromium test browser in a container, drawing in software:

```json
"webgl_renderer": {
  "status": "ok",
  "value": "ANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (LLVM 10.0.0) (0x0000C0DE)), SwiftShader driver)",
  "hashed": false
}
```

That run also had the `software_renderer` flag. On a typical Mac with Chrome the docs show `ANGLE (Apple, ANGLE Metal Renderer: Apple M2, Unspecified Version)`.

## Questions and answers

### Why does my renderer say SwiftShader or llvmpipe?

The browser is drawing in software instead of on a GPU: hardware acceleration is off, the GPU is blocklisted, or the machine is a server, container or virtual machine. WhiskerJS then also sets the software_renderer integrity flag.

### Is the renderer string ever hashed?

Only when it is longer than 128 characters or contains a character outside printable ASCII. Otherwise it is reported as plain text with hashed false.

### Why is it excluded under Firefox resistFingerprinting?

That mode replaces the WebGL strings with placeholders, so the value would not describe the device. The exclusion table reports excluded with ruleId firefox_rfp.

## Related pages

- [webgl_vendor](https://whiskerjs.com/signals/webgl-vendor/): The vendor string read the same way.
- [webgpu](https://whiskerjs.com/signals/webgpu/): Adapter info from the newer GPU API.
- [software_renderer flag](https://whiskerjs.com/docs/integrity/#software_renderer): Fires when the renderer names a software rasteriser.
- [Software renderer](https://whiskerjs.com/glossary/#software-renderer): What it means and who has one.
- [Firefox](https://whiskerjs.com/browsers/firefox/): Why the debug extension is not requested there.


---

# webgl_vendor

> The GPU vendor string the browser reports through WebGL, read the same way as the renderer.

Source: https://whiskerjs.com/signals/webgl-vendor/ (last updated 2026-10-26)

**webgl_vendor at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `webgl_vendor` |
| In the visitorId | yes |
| structuredId group | [gpu (graphics)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | Firefox resistFingerprinting and Tor Browser (firefox_rfp) |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 1](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> Next to the GPU name, browsers report who made the graphics driver, for example Apple, Intel or NVIDIA, sometimes wrapped in the browser’s own name. WhiskerJS reads this short text as it is. On its own it only separates a few big vendors; together with the renderer name it describes the graphics setup.

## What it reads

The method is the same as for [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/), on the shared WebGL 1 context:

- outside Firefox, `getParameter(UNMASKED_VENDOR_WEBGL)` from the `WEBGL_debug_renderer_info` extension;
- if that is missing or empty, the plain `gl.VENDOR` value;
- in Firefox the extension is never requested (it would print a console warning), and the plain value is used.

## How the technique works

WebGL offers a “masked” vendor (often a generic browser name such as “WebKit”) and, through the debug extension, the underlying driver vendor. WhiskerJS prefers the unmasked value, falls back to the plain one, and reports the text unless it is longer than 128 characters or not printable ASCII, in which case it is hashed. The raw value is also used, inside the library only, by the [`software_renderer`](https://whiskerjs.com/docs/integrity/#software_renderer) check: a vendor such as “Brian Paul” with Mesa offscreen rendering points to software rendering.

## Why it helps

It splits devices by GPU vendor and graphics layer, and it is a simple cross-check: an Apple GPU vendor with a Windows platform, or a software vendor on what claims to be a phone, is worth a look on your server. It is in the `gpu` group.

## Stability

Very stable: it changes when the GPU in use changes, when hardware acceleration is switched, or when a browser update changes how its graphics layer names the vendor.

## Browser support and what blocks it

- `ok` wherever WebGL 1 is available. Typical values: `Google Inc. (Apple)` in Chrome on a Mac, `Apple Inc.` in the headless WebKit test run used for these pages, `Google Inc. (Google)` with SwiftShader in headless Chromium.
- [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): `excluded` / `firefox_rfp`.
- No WebGL: `unavailable` / `no_context`.

## Privacy

A short vendor name, read without permission or prompt, never sent by WhiskerJS. Values outside printable ASCII or over 128 characters leave only as a digest.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | plain text (or a digest when long or unusual) |
| `unavailable` | `no_value` | both values were empty |
| `unavailable` | `no_document`, `no_api`, `no_context` | no document, no `getContext`, no WebGL |
| `unavailable` | `no_digest` | needed hashing without Web Crypto |
| `blocked` | `security_error`, `threw` | `getParameter` threw |
| `excluded` | `firefox_rfp`, `caller_excluded` | exclusion table or your list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, budget, abort |

## Example value

From a headless WebKit test browser in a container:

```json
"webgl_vendor": { "status": "ok", "value": "Apple Inc.", "hashed": false }
```

## Questions and answers

### Why does Chrome report Google Inc. as the vendor?

Chromium browsers draw WebGL through their ANGLE layer, so the unmasked vendor usually reads like Google Inc. followed by the real GPU vendor in brackets, for example Google Inc. (Apple).

### Is webgl_vendor useful on its own?

It tells apart only a handful of vendors. Its value is in combination with webgl_renderer and the rest of the gpu group, and as a consistency check against the platform.

## Related pages

- [webgl_renderer](https://whiskerjs.com/signals/webgl-renderer/): The GPU name from the same extension.
- [webgpu](https://whiskerjs.com/signals/webgpu/): The adapter vendor through WebGPU.
- [software_renderer flag](https://whiskerjs.com/docs/integrity/#software_renderer): Also checks the vendor string.
- [Firefox resistFingerprinting and Tor](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): Where it is excluded.


---

# webgpu

> The WebGPU adapter's vendor, architecture, device and description, its features and seven limits, as one digest.

Source: https://whiskerjs.com/signals/webgpu/ (last updated 2026-10-26)

**webgpu at a glance (from the library code, signalsVersion 5)**

| Field | Value |
| --- | --- |
| Component name | `webgpu` |
| In the visitorId | yes |
| structuredId group | [gpu (graphics)](https://whiskerjs.com/docs/identifiers/#structuredid) |
| Hashing | always a digest (first 128 bits of SHA-256) |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | [signalsVersion 3](https://whiskerjs.com/whats-new/) |

> **In plain words:**
>
> WebGPU is the newer way for web pages to use the graphics chip. Before doing any work, a page can ask for an “adapter” and read what it is and what it can do. WhiskerJS reads only that description and turns it into a short code. It gives a second, independent view of the GPU next to WebGL.

## What it reads

1. `navigator.gpu.requestAdapter()`, with no options.
2. From the adapter’s `info` attribute: `vendor`, `architecture`, `device` and `description` (non-string values become empty).
3. The adapter’s `features` set, as a sorted list of names.
4. Seven entries of the adapter’s `limits`: `maxBindGroups`, `maxBufferSize`, `maxComputeInvocationsPerWorkgroup`, `maxComputeWorkgroupStorageSize`, `maxStorageBufferBindingSize`, `maxTextureDimension2D` and `maxVertexBuffers`.

No device is requested and the deprecated `requestAdapterInfo()` method is not called.

## How the technique works

The parts are written as `vendor=...;architecture=...;device=...;description=...;features=a,b,c;limits=n1,n2,...` and the whole string is always hashed, since `webgpu` is a large component. Sorting the features makes the value independent of the order the browser lists them in. The call is asynchronous; like every collector it races its own 1000 ms timeout.

## Why it helps

WebGPU adapters expose the GPU vendor and architecture as the browser chooses to present them, plus feature and limit sets that follow the GPU, the driver and the browser’s WebGPU implementation. That complements the WebGL components in the `gpu` group, and a mismatch between WebGPU and WebGL vendors is something your server can look at.

## Stability

It changes when the browser’s WebGPU implementation changes what it reports (new features or limits in an update), with a driver update, or when a different GPU is used. Where WebGPU is not available the component is consistently `unavailable`, which is stable too.

## Browser support and what blocks it

- `ok` in browsers that offer `navigator.gpu` and return an adapter, in [secure contexts](https://whiskerjs.com/glossary/#secure-context) only. Availability depends on the browser, its version and the operating system; check the [support matrix](https://whiskerjs.com/browsers/support-matrix/).
- `unavailable` / `no_api` where `navigator.gpu` is missing. In the container test runs used for these pages, headless Firefox and WebKit had no `navigator.gpu`.
- `unavailable` / `no_context` when no adapter is returned: headless Chromium in the same container exposed the API but returned no adapter.
- Not in the exclusion table.

## Privacy

It reveals graphics hardware details. Everything leaves the library only as a 32-character digest. `requestAdapter()` shows no prompt, and WhiskerJS makes no request.

## How WhiskerJS handles noise and failures

| Status | ruleId | When |
| --- | --- | --- |
| `ok` | none | adapter read; value is a digest |
| `unavailable` | `no_api` | no `navigator.gpu` or no `requestAdapter` |
| `unavailable` | `no_context` | `requestAdapter()` returned no adapter |
| `unavailable` | `no_digest` | no Web Crypto |
| `blocked` | `security_error`, `threw` | `requestAdapter()` rejected or a read threw |
| `excluded` | `caller_excluded` | your `exclude` list |
| `timed_out` | `timeout`, `aborted` | 1000 ms inner timeout, budget, abort |

## Example value

```json
"webgpu": { "status": "ok", "value": "862da19ca084b185c1d8c76af676a08b", "hashed": true }
```

The headless test browsers used for these pages reported `{ "status": "unavailable", "ruleId": "no_context" }` (Chromium) and `no_api` (Firefox, WebKit).

## Questions and answers

### Does reading WebGPU start using my GPU?

WhiskerJS only calls navigator.gpu.requestAdapter() and reads the adapter's info, features and limits. It never requests a device, so no GPU work is submitted.

### Why is webgpu unavailable in my browser?

Either the browser has no navigator.gpu (no_api), for example because WebGPU is not shipped or not enabled there or the page is not a secure context, or it returned no adapter (no_context), which happens without a supported GPU.

### Why is the deprecated requestAdapterInfo not used?

It prints a warning in the console in browsers that deprecated it, and WhiskerJS never writes to the console. The adapter's info attribute gives the same fields.

## Related pages

- [webgl_renderer](https://whiskerjs.com/signals/webgl-renderer/): The GPU name through WebGL.
- [webgl_params](https://whiskerjs.com/signals/webgl-params/): WebGL limits and extensions.
- [WebGPU](https://whiskerjs.com/glossary/#webgpu): The API in one definition.
- [Secure context](https://whiskerjs.com/glossary/#secure-context): WebGPU is offered only on https pages.


---

# Glossary

> Short, plain definitions of every term the WhiskerJS documentation uses, each with a note on how the library applies it.

Source: https://whiskerjs.com/glossary/ (last updated 2026-10-26)

> **In plain words:**
>
> Browser fingerprinting has its own vocabulary. This page explains each word the WhiskerJS docs use, in one to three sentences first, then how WhiskerJS applies it. Each term has its own anchor, so you can link straight to it, for example [/glossary/#farbling](https://whiskerjs.com/glossary/#farbling).

## Anti-replay

Anti-replay is any measure that stops a recorded message from being accepted a second time. For device signals it means a result made once cannot be sent again later, or from another machine, and still pass.

WhiskerJS supports it with the optional binding: your server issues a single-use nonce and a timestamp, `collect({ binding })` copies them into the result and adds a digest over the whole result. Your server checks that the nonce is its own, unused and recent, and that the digest matches.

See: [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding), [Nonce](https://whiskerjs.com/glossary/#nonce), [Binding digest](https://whiskerjs.com/glossary/#binding-digest).

## Automation globals

Automation globals are variables that browser automation tools leave on the page’s `window` or `document`, such as properties added by Selenium, PhantomJS or ChromeDriver. Their presence suggests the page is driven by a tool rather than a person.

WhiskerJS checks a list of 32 known global names, `document` properties starting with `$cdc_`, `$wdc_` or `cdc_`, and `webdriver`, `selenium` or `driver` attributes on `<html>`. A hit sets the `automation_globals` flag.

See: [automation_globals](https://whiskerjs.com/docs/integrity/#automation_globals), [WebDriver](https://whiskerjs.com/glossary/#webdriver).

## Binding digest

The binding digest is a 128-bit hash that WhiskerJS computes over a whole result, including the nonce and timestamp your server passed in. It lets your server notice whether the result was changed after it was made.

It is the first 128 bits of SHA-256 over the text that the exported `bindingInput(result)` returns. It is not a signature: code running in the page can compute it too, so it stops replay and accidental edits, not a forged result.

See: [The digest](https://whiskerjs.com/docs/integration/#the-digest), [Anti-replay](https://whiskerjs.com/glossary/#anti-replay).

## Browser class

A browser class is WhiskerJS’s own coarse label for the browser family: `brave`, `firefox_rfp`, `firefox`, `safari`, `chromium` or `other`. It is worked out from cheap, prompt-free hints such as `navigator.brave`, the user agent and `navigator.vendor`.

The class picks the row of the exclusion table and is reported as the `browser_class` component. It is a guess from values the client controls, so treat it as a hint.

See: [browser_class](https://whiskerjs.com/signals/browser-class/), [Browsers](https://whiskerjs.com/browsers/), [Exclusion table](https://whiskerjs.com/glossary/#exclusion-table).

## Canvas fingerprinting

Canvas fingerprinting draws a fixed picture (text, shapes, colours) on an HTML canvas and reads the pixels back. Small differences in fonts, anti-aliasing and graphics stacks make the result differ between devices.

WhiskerJS’s `canvas` component draws a 260x80 scene with text, a cat emoji, blended circles and an even-odd ring, exports it with `toDataURL()` and reports only a digest.

See: [canvas](https://whiskerjs.com/signals/canvas/), [Canvas noise](https://whiskerjs.com/glossary/#canvas-noise), [Double render](https://whiskerjs.com/glossary/#double-render).

## Canvas noise

Canvas noise is small random change that a browser or extension adds to canvas or WebGL readback on purpose, so that the picture differs a little on every read. It defeats fingerprints that rely on an exact image.

WhiskerJS does not try to undo it. It detects it with the double render and reports the component as `noisy`; the separate `canvas_readback` probe reports `exact` or `altered`.

See: [Noise handling](https://whiskerjs.com/docs/how-it-works/#noise-handling-the-double-render), [canvas_readback](https://whiskerjs.com/signals/canvas-readback/).

## Clean iframe realm

A clean iframe realm is a fresh, untouched copy of the browser’s built-in objects, taken from a new `about:blank` iframe. Scripts that override functions usually do so only in the page, so the fresh copy shows the original behaviour.

WhiskerJS creates one hidden iframe with no `src` after the collectors finish, compares against it for the `iframe_mismatch` and `prototype_lie` checks, and removes it straight away. After an abort no iframe is made.

See: [The clean iframe realm](https://whiskerjs.com/docs/how-it-works/#the-clean-iframe-realm), [Lie detection](https://whiskerjs.com/glossary/#lie-detection).

## Client Hints

User-Agent Client Hints are a browser API (`navigator.userAgentData`) that reports the browser brands, platform and whether the device is mobile, with more detail available on request. It is offered by Chromium-based browsers.

WhiskerJS reads them into two components: `ua_client_hints` (brands without versions, platform, architecture and similar, in the visitorId) and `ua_versions` (full versions, outside both ids). Safari and Firefox do not offer the API, so both are `unavailable` there.

See: [ua_client_hints](https://whiskerjs.com/signals/ua-client-hints/), [ua_versions](https://whiskerjs.com/signals/ua-versions/), [GREASE](https://whiskerjs.com/glossary/#grease), [High-entropy hints](https://whiskerjs.com/glossary/#high-entropy-hints).

## Collision

A collision is two different devices producing the same identifier. With browser fingerprints it happens when devices share the same hardware, software and settings, such as two identical phones on the same system version.

WhiskerJS’s ids describe a browser setup, not a person, so collisions are expected for identical setups. No collision rate is published yet: the measurement that could give one has not run.

See: [Identifiers](https://whiskerjs.com/docs/identifiers/), [Entropy](https://whiskerjs.com/glossary/#entropy).

## Component

A component (also called a signal) is one measurement in a WhiskerJS result, such as the screen size or a digest of the installed fonts. Each component has a status and, when it was read, a value.

WhiskerJS reports 46 components, always all of them. 37 are stable and make up the ids; 9 are reported but kept out of the ids.

See: [Signals](https://whiskerjs.com/signals/), [Statuses and reason codes](https://whiskerjs.com/docs/how-it-works/#statuses-and-reason-codes).

## Content blocker

A content blocker is a browser feature or extension that hides or blocks page elements and requests, typically ads and trackers. Cosmetic filters hide elements whose class names or ids look like ads.

WhiskerJS’s `content_blockers` component adds eight 1x1 bait elements off screen, waits 50 ms and reports which ones were hidden. It makes no request and is outside both ids, because users switch blockers on and off.

See: [content_blockers](https://whiskerjs.com/signals/content-blockers/).

## Digest

A digest is a short, fixed-length hash computed from a larger value. It stays the same for the same input, but the input cannot be read back from it.

WhiskerJS uses the first 128 bits of SHA-256, written as 32 lowercase hex characters. Large values (images, audio samples, font lists and similar) leave the library only as a digest; a component carries `hashed: true` when its value is one.

See: [Hashing](https://whiskerjs.com/docs/how-it-works/#hashing), [Web Crypto](https://whiskerjs.com/glossary/#web-crypto).

## Double render

The double render is WhiskerJS’s way of noticing canvas and WebGL noise: it draws the same scene twice and compares the two results. Identical drawings should give identical output, so a difference means something adds randomness.

When the two differ, the component is `noisy` with ruleId `render_mismatch` and carries no value, which keeps the id the same from run to run instead of changing every time. It is used by `canvas` and `webgl_image`; `audio` has no double render.

See: [Noise handling](https://whiskerjs.com/docs/how-it-works/#noise-handling-the-double-render), [Canvas noise](https://whiskerjs.com/glossary/#canvas-noise).

## Entropy

Entropy, in fingerprinting, measures how much a signal tells devices apart, usually in bits: a signal with more possible, evenly spread values has more entropy. It depends on the audience, so the same signal has different entropy on different sites.

WhiskerJS publishes no entropy figures for its signals: none have been measured yet. Expectations in the project roadmap are labelled as expectations.

See: [Collision](https://whiskerjs.com/glossary/#collision), [Stability](https://whiskerjs.com/glossary/#stability).

## Exclusion table

The exclusion table is the fixed list, per browser class, of components WhiskerJS does not collect because that browser randomises or normalises them on purpose. Such components report status `excluded` with the table’s ruleId.

Brave loses seven components (`brave_farbling`) and Firefox with resistFingerprinting nine (`firefox_rfp`). The table is exported as `EXCLUSION_TABLE`; changing it bumps `signalsVersion`.

See: [The exclusion table](https://whiskerjs.com/docs/how-it-works/#the-exclusion-table), [Farbling](https://whiskerjs.com/glossary/#farbling), [resistFingerprinting](https://whiskerjs.com/glossary/#resistfingerprinting).

## Farbling

Farbling is Brave’s name for its fingerprinting protection: it adds small, per-site and per-session random changes to values such as canvas and audio output. A site sees stable values during a session, while different sites see different values.

WhiskerJS recognises Brave by `navigator.brave.isBrave` being a function and does not collect the farbled components (`audio`, `canvas`, `fonts`, `fonts_canvas`, `hardware_concurrency`, `plugins`, `webgl_image`); they report `excluded` with ruleId `brave_farbling`.

See: [Brave](https://whiskerjs.com/browsers/brave/), [Exclusion table](https://whiskerjs.com/glossary/#exclusion-table).

## Font fingerprinting

Font fingerprinting finds out which fonts are installed by measuring text: a font that exists changes the width or height of text set in it, compared with a generic fallback. Installed fonts vary with the operating system, language packs and software.

WhiskerJS probes 54 families two ways, with hidden spans (`fonts`) and with canvas `measureText()` (`fonts_canvas`), and measures the default font settings (`font_preferences`). Only digests leave the library.

See: [fonts](https://whiskerjs.com/signals/fonts/), [fonts_canvas](https://whiskerjs.com/signals/fonts-canvas/), [font_preferences](https://whiskerjs.com/signals/font-preferences/).

## GREASE

GREASE (Generate Random Extensions And Sustain Extensibility) is a deliberately fake brand that Chromium browsers add to their Client Hints brand list, with a name that changes between versions, such as “Not)A;Brand”. It keeps servers from depending on an exact list.

WhiskerJS removes it before using the brands: any brand that reads “notabrand” once reduced to letters is dropped, so the changing name does not change the id.

See: [ua_client_hints](https://whiskerjs.com/signals/ua-client-hints/), [Client Hints](https://whiskerjs.com/glossary/#client-hints).

## Headless browser

A headless browser runs without a visible window, usually controlled by a script for testing, scraping or automation. Headless builds often differ in small ways from a normal browser.

WhiskerJS has two flags for it: `headless_user_agent` (the user agent contains `HeadlessChrome`, `PhantomJS` or `SlimerJS`) and `headless_markers` (outer window size 0x0, or a desktop Chrome user agent without `window.chrome`). Neither is a verdict.

See: [headless_markers](https://whiskerjs.com/docs/integrity/#headless_markers), [headless_user_agent](https://whiskerjs.com/docs/integrity/#headless_user_agent), [Bot detection](https://whiskerjs.com/use-cases/bot-detection/).

## High-entropy hints

High-entropy hints are the detailed Client Hints values a page must ask for with `navigator.userAgentData.getHighEntropyValues()`, such as the CPU architecture, bitness, device model and full version list. The call does not prompt the user.

WhiskerJS makes one such request per collection. When a Permissions Policy refuses it, the component reports the stable marker `he=blocked` instead (or `he=failed`, `he=none`).

See: [ua_client_hints](https://whiskerjs.com/signals/ua-client-hints/), [Permissions Policy](https://whiskerjs.com/glossary/#permissions-policy).

## idVersion

`idVersion` is the version number of how WhiskerJS derives the visitorId and structuredId from the components: the line encoding, the prefix and the groups. It is in every result.

A new idVersion gives every device a new id, because the prefix line contains it. The current idVersion is 2. Compare ids only within the same idVersion and signalsVersion.

See: [Why versions bump](https://whiskerjs.com/docs/identifiers/#why-versions-bump), [signalsVersion](https://whiskerjs.com/glossary/#signalsversion).

## Integrity flag

An integrity flag is the name of a WhiskerJS check that fired, listed in `result.integrityFlags`. Each one is a sign that the page may be automated or that browser functions were changed.

There are 14 checks at signalsVersion 5. They are read-only, never a verdict, and their absence proves nothing: a client can remove them. Your server decides what they mean.

See: [Integrity checks](https://whiskerjs.com/docs/integrity/), [Lie detection](https://whiskerjs.com/glossary/#lie-detection).

## Lie detection

Lie detection looks for browser values or functions that were overridden to report something false, for example a spoofed user agent or a patched canvas function. It compares how a function prints and behaves with how a native one does.

WhiskerJS’s checks include `native_tampering`, `navigator_own_property`, `prototype_lie` and `iframe_mismatch`. Privacy extensions trigger them too, so a hit means “changed”, not “fraud”.

See: [native_tampering](https://whiskerjs.com/docs/integrity/#native_tampering), [prototype_lie](https://whiskerjs.com/docs/integrity/#prototype_lie), [Clean iframe realm](https://whiskerjs.com/glossary/#clean-iframe-realm).

## Nonce

A nonce is a value used only once. In anti-replay, the server makes a fresh random nonce for each request and accepts it back only once.

WhiskerJS accepts a nonce of 8 to 128 printable ASCII characters without spaces and recommends at least 128 random bits, for example 32 hex characters from a cryptographic source. It reads no randomness of its own for the binding.

See: [In the page](https://whiskerjs.com/docs/integration/#in-the-page), [Anti-replay](https://whiskerjs.com/glossary/#anti-replay).

## Offline audio rendering

Offline audio rendering asks the browser’s audio engine to compute sound into a buffer without playing it. The exact floating-point samples differ between engines, operating systems and CPUs.

WhiskerJS’s `audio` component renders a 10 kHz triangle wave through a dynamics compressor in an `OfflineAudioContext` (1 channel, 5000 frames at 44100 Hz) and hashes the last 500 samples. Nothing is played and no audio device is opened.

See: [audio](https://whiskerjs.com/signals/audio/).

## Permissions Policy

A Permissions Policy is a set of rules, sent by a site in an HTTP header or an iframe’s `allow` attribute, that decides which browser features a page or frame may use. It can, for example, refuse detailed Client Hints to an embedded frame.

When WhiskerJS’s high-entropy Client Hints request is refused this way, `ua_client_hints` and `ua_versions` end with the marker `he=blocked` instead of failing.

See: [High-entropy hints](https://whiskerjs.com/glossary/#high-entropy-hints), [ua_client_hints](https://whiskerjs.com/signals/ua-client-hints/).

## Private Click Measurement

Private Click Measurement is a Safari (WebKit) feature for measuring ad clicks without cross-site tracking. Links can carry an `attributionSourceId` attribute for it.

WhiskerJS’s `private_click` component reads `attributionSourceId` from a new `<a>` element that gets no `href` and is never attached. Outside Safari it reports the plain value `none`.

See: [private_click](https://whiskerjs.com/signals/private-click/), [Safari on macOS](https://whiskerjs.com/browsers/safari-macos/).

## resistFingerprinting

`privacy.resistFingerprinting` is a Firefox setting, also used by Tor Browser, that makes the browser report fixed or normalised values (for example UTC as the time zone and the content area as the screen size) so that users look alike.

WhiskerJS classes Firefox as `firefox_rfp` only when every resistFingerprinting trait holds at once and `navigator.webdriver` is not true, and then does not collect nine components (ruleId `firefox_rfp`).

See: [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/), [Exclusion table](https://whiskerjs.com/glossary/#exclusion-table).

## ruleId

A ruleId is the short reason code that WhiskerJS attaches to every component whose status is not `ok`, such as `no_api`, `timeout` or `brave_farbling`. It says why the value is missing.

A ruleId always matches `^[a-z0-9_]{1,32}$`. The binding uses its own ruleIds (`invalid_binding`, `invalid_nonce`, `invalid_timestamp`, `no_digest`).

See: [Statuses and reason codes](https://whiskerjs.com/docs/how-it-works/#statuses-and-reason-codes).

## Secure context

A secure context is a page the browser trusts to be delivered safely: served over https, or from `http://localhost` during development. Some APIs, including `crypto.subtle`, exist only there.

Without a secure context WhiskerJS cannot hash, so `visitorId` and `structuredId` are `null` and every component that must be hashed reports `unavailable` with ruleId `no_digest`.

See: [Getting started](https://whiskerjs.com/docs/getting-started/), [Web Crypto](https://whiskerjs.com/glossary/#web-crypto).

## Signal group

A signal group is one of the seven sets the stable components are sorted into: `gpu`, `audio`, `fonts`, `device`, `browser`, `locale` and `prefs`. Each stable component belongs to exactly one group.

Each group gives one 12-hex part of the structuredId, so two results can be compared group by group. The groups are exported as `ID_GROUPS` and their order as `ID_GROUP_ORDER`.

See: [structuredId](https://whiskerjs.com/docs/identifiers/#structuredid), [Signals](https://whiskerjs.com/signals/).

## signalsVersion

`signalsVersion` is the version number of what WhiskerJS measures: the collectors, the integrity checks and the exclusion table. It is in every result.

It goes up when a collector changes what it measures, a check changes or the exclusion table changes. A bump can change ids and flags. The current signalsVersion is 5.

See: [What’s new](https://whiskerjs.com/whats-new/), [idVersion](https://whiskerjs.com/glossary/#idversion).

## Software renderer

A software renderer draws graphics on the CPU instead of a GPU, for example SwiftShader, llvmpipe or Mesa’s offscreen renderer. It is common on servers, in containers and in virtual machines.

When the WebGL renderer or vendor names one, WhiskerJS sets the `software_renderer` flag. Real users with hardware acceleration turned off or remote desktops can trigger it too.

See: [software_renderer](https://whiskerjs.com/docs/integrity/#software_renderer), [webgl_renderer](https://whiskerjs.com/signals/webgl-renderer/).

## Stability

Stability is how often a signal or identifier stays the same for the same device over time and across visits. A stable signal changes only with real changes, such as a new GPU driver or an installed font.

WhiskerJS keeps signals it expects to change easily (zoom, taskbar, permissions, keyboard layout, voices, versions and others) out of the ids. No stability figures are published yet; the early lab sample (signalsVersion 1, four device-browser pairs) is not a benchmark.

See: [What changes the id](https://whiskerjs.com/docs/identifiers/#what-changes-the-id), [Stable component](https://whiskerjs.com/glossary/#stable-component).

## Stable component

A stable component is one of the 37 WhiskerJS components that are part of the visitorId and the structuredId. They were chosen because they are expected to change rarely for the same device.

In the code each collector has a `stable` flag. The other 9 components are still reported, but kept out of both ids.

See: [Signals](https://whiskerjs.com/signals/), [Signal group](https://whiskerjs.com/glossary/#signal-group).

## Structured id

The structured id (`structuredId`) is WhiskerJS’s identifier made of seven short hashes, one per signal group, so two results can match in some groups and differ in others. It tells you which part of a device changed.

Its format is `<idVersion>_<gpu>_<audio>_<fonts>_<device>_<browser>_<locale>_<prefs>`, each part the first 48 bits (12 hex characters) of SHA-256. It is `null` without a digest.

See: [structuredId](https://whiskerjs.com/docs/identifiers/#structuredid), [Comparing two results](https://whiskerjs.com/docs/identifiers/#comparing-two-results).

## Visitor id

The visitor id (`visitorId`) is WhiskerJS’s single identifier: one 128-bit hash over the 37 stable components. Two results either have the same visitor id or not.

It describes a browser setup, not a person: two identical devices can share one, and one person with two browsers has two. It is `null` without Web Crypto, and comparable only within the same idVersion and signalsVersion.

See: [visitorId](https://whiskerjs.com/docs/identifiers/#visitorid), [Structured id](https://whiskerjs.com/glossary/#structured-id).

## Web Crypto

Web Crypto is the browser’s built-in cryptography API, `crypto.subtle`. WhiskerJS uses only its `digest` function, for SHA-256.

It exists only in secure contexts. Without it, WhiskerJS never sends a raw large value: such components become `unavailable` with ruleId `no_digest`, and both ids are `null`.

See: [Hashing](https://whiskerjs.com/docs/how-it-works/#hashing), [Secure context](https://whiskerjs.com/glossary/#secure-context).

## WebDriver

WebDriver is the standard protocol that tools such as Selenium use to control a browser. A browser under WebDriver control sets `navigator.webdriver` to `true`; Playwright and Puppeteer set it by default too.

WhiskerJS sets `automation_webdriver` when `navigator.webdriver` is `true`, and `webdriver_writable` when the property was redefined, usually to hide automation. Your own end-to-end tests set the first flag as well.

See: [automation_webdriver](https://whiskerjs.com/docs/integrity/#automation_webdriver), [webdriver_writable](https://whiskerjs.com/docs/integrity/#webdriver_writable).

## WebGPU

WebGPU is a newer browser API for graphics and computation on the GPU, reached through `navigator.gpu`. Its adapter describes the GPU and its features and limits.

WhiskerJS’s `webgpu` component calls `requestAdapter()` (no prompt, no device requested) and hashes the adapter’s info, sorted features and seven limits. Without the API it is `unavailable`.

See: [webgpu](https://whiskerjs.com/signals/webgpu/).


---

# Browsers

> What WhiskerJS reads in each browser family, what the browser blocks, and what the library leaves out on purpose.

Source: https://whiskerjs.com/browsers/ (last updated 2026-10-26)

> **In plain words:**
>
> Browsers do not all offer the same features, and some privacy-focused browsers deliberately blur certain measurements. WhiskerJS works in all of them: it always returns all 46 components, each with a status that says whether it was read, missing, or left out on purpose. The pages below explain, for each browser family, what WhiskerJS can read, what the browser blocks, and what the library skips so that your ids do not fill with noise.

## Browser classes

Before it collects anything, WhiskerJS sorts the browser into one of six classes, using cheap hints that never prompt: `navigator.brave`, the user agent, `navigator.vendor` and, for Firefox, a set of resistFingerprinting traits. The checks run in this order, and the first match wins:

1. **`brave`**: `navigator.brave.isBrave` is a function.
2. **`firefox_rfp`** or **`firefox`**: the user agent has a `Firefox/<number>` token, or the window has `mozInnerScreenX`. It is `firefox_rfp` only when every resistFingerprinting trait holds at once (see [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/)).
3. **`chromium`**: the user agent has a `Chrome/<number>` or `Chromium/<number>` token, or `window.chrome` exists and the vendor is `Google Inc.`.
4. **`safari`**: the vendor is `Apple Computer, Inc.`, or the user agent has both `Safari/` and `Version/`.
5. **`other`**: anything else, for example a headless Chromium whose user agent says `HeadlessChrome` and which has no `window.chrome`.

The class does two things. It is reported as the [`browser_class`](https://whiskerjs.com/signals/browser-class/) component (part of the visitorId), and it picks the row of the [exclusion table](https://whiskerjs.com/docs/how-it-works/#the-exclusion-table). It is a guess from values the client controls, so your server should treat it as a hint.

## The nine browser families

| Family | Class | Excluded components | Page |
| --- | --- | --- | --- |
| Chrome (desktop) | `chromium` | none | [Chrome desktop](https://whiskerjs.com/browsers/chrome-desktop/) |
| Chrome on Android | `chromium` | none | [Chrome Android](https://whiskerjs.com/browsers/chrome-android/) |
| Safari on macOS | `safari` | none | [Safari macOS](https://whiskerjs.com/browsers/safari-macos/) |
| Safari and every iOS browser | `safari` | none | [Safari and iOS browsers](https://whiskerjs.com/browsers/safari-ios/) |
| Firefox | `firefox` | none | [Firefox](https://whiskerjs.com/browsers/firefox/) |
| Firefox resistFingerprinting and Tor Browser | `firefox_rfp` | 9 | [Firefox RFP and Tor](https://whiskerjs.com/browsers/firefox-rfp-and-tor/) |
| Brave | `brave` | 7 | [Brave](https://whiskerjs.com/browsers/brave/) |
| Microsoft Edge | `chromium` | none | [Edge](https://whiskerjs.com/browsers/edge/) |
| Samsung Internet | `chromium` | none | [Samsung Internet](https://whiskerjs.com/browsers/samsung-internet/) |

- [Chrome (desktop)](https://whiskerjs.com/browsers/chrome-desktop/): Every Chromium API, nothing excluded.
- [Chrome on Android](https://whiskerjs.com/browsers/chrome-android/): Client Hints with the device model, audio latency read.
- [Safari on macOS](https://whiskerjs.com/browsers/safari-macos/): Apple Pay and Private Click Measurement, no Chromium APIs.
- [Safari and every iOS browser](https://whiskerjs.com/browsers/safari-ios/): Why Chrome on iPhone is classed safari.
- [Firefox](https://whiskerjs.com/browsers/firefox/): WebGL strings without the debug extension.
- [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): The exact test and the nine excluded components.
- [Brave](https://whiskerjs.com/browsers/brave/): Farbling, and the seven components left out.
- [Microsoft Edge](https://whiskerjs.com/browsers/edge/): A Chromium browser like Chrome.
- [Samsung Internet](https://whiskerjs.com/browsers/samsung-internet/): Chromium on Android, with its own global.

## Four kinds of “missing”

A component that is not `ok` always says why, with a status and a ruleId. Across browsers you will mostly meet four cases:

- **The API does not exist here**: `unavailable` with ruleId `no_api`. Example: `device_memory` in Safari and Firefox, because only Chromium-based browsers offer `navigator.deviceMemory`.
- **WhiskerJS skips it here on purpose**: `unavailable` with ruleId `skipped`. Only [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) does this, outside Safari and Android, to avoid a console warning.
- **The browser blurs it on purpose**: `excluded` with ruleId `brave_farbling` or `firefox_rfp`, from the exclusion table.
- **The browser or an extension adds noise this time**: `noisy` with ruleId `render_mismatch`, when the [double render](https://whiskerjs.com/glossary/#double-render) of `canvas` or `webgl_image` differs.

Every non-ok status counts the same in the visitorId (as “missing”), so a component that is `blocked` in one run and `timed_out` in the next does not change the id. See [Statuses and reason codes](https://whiskerjs.com/docs/how-it-works/#statuses-and-reason-codes).

## How much is measured

Very little so far, and this section says so plainly. The [support matrix](https://whiskerjs.com/browsers/support-matrix/) is filled from the library code and documentation. The only real observations are an early, small sample at signalsVersion 1, not a benchmark: Mac Chrome (4 runs), Mac Safari (2 runs), iPhone Chrome (3 runs) and iPhone Safari (3 runs) each kept one id across their runs, the four ids differed from each other, and `device_memory` was unavailable on Safari and iOS. No head-to-head measurement against other libraries has run.

You can measure your own devices with the lab mode of the [live demo](https://whiskerjs.com/demo/#lab).

## Questions and answers

### Does WhiskerJS work in every browser?

collect() runs and resolves in every browser, because each component reports a status instead of failing. What differs is which components are ok: some APIs exist only in Chromium-based browsers, and some components are excluded on purpose in Brave and in Firefox with resistFingerprinting.

### Why is Chrome on iPhone treated like Safari?

On iOS every browser uses Apple's WebKit engine. Chrome, Firefox and Edge on iOS report the Apple vendor string and no Chrome/ token in the user agent, so WhiskerJS classes them as safari.

### Is the browser support table measured?

Mostly not yet. It is filled from the library code and documentation, plus one early lab sample of four device and browser pairs at signalsVersion 1. It will be refreshed from aggregated diagnostics later.

## Related pages

- [Browser support matrix](https://whiskerjs.com/browsers/support-matrix/): All 46 components in nine browser families, in one table.
- [The exclusion table](https://whiskerjs.com/docs/how-it-works/#the-exclusion-table): Which components are left out in Brave and Firefox resistFingerprinting.
- [browser_class](https://whiskerjs.com/signals/browser-class/): The component that reports the class.
- [Live demo](https://whiskerjs.com/demo/): See what your own browser reports.


---

# Brave

> Brave randomises some signals per site and per session; WhiskerJS recognises Brave and does not collect those seven components at all.

Source: https://whiskerjs.com/browsers/brave/ (last updated 2026-10-26)

> **In plain words:**
>
> Brave is built on the same engine as Chrome, but it deliberately blurs some measurements: it adds small random changes that differ per website and per browsing session, which Brave calls “farbling”. Reading those measurements would only make the id change for no reason, so WhiskerJS recognises Brave and skips seven of them. Everything else is read as in Chrome.

## At a glance

- Browser class: `brave` (`navigator.brave.isBrave` is a function).
- Excluded components: 7, with ruleId `brave_farbling` (all seven are in the visitorId).
- Chromium APIs: present, as in Chrome.
- Lab sample: none.

## How Brave is recognised

The first step of the class test asks whether `navigator.brave` exists and has an `isBrave` function. Nothing is called or awaited; the presence of the function is enough. This comes first because Brave’s user agent string looks like Chrome’s, so without it Brave would be classed `chromium` and the farbled values would be read.

## What works

- **Chromium-only components**: [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) and [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) report the brands and versions Brave gives; [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) from `performance.memory`. [`device_memory`](https://whiskerjs.com/signals/device-memory/) and [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) are Chromium APIs too, but Brave’s protections may change or turn off such values, so treat them as variable.
- **Graphics not in the table**: [`webgl_params`](https://whiskerjs.com/signals/webgl-params/), [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/), [`webgl_vendor`](https://whiskerjs.com/signals/webgl-vendor/) and [`webgpu`](https://whiskerjs.com/signals/webgpu/) are read.
- [`font_preferences`](https://whiskerjs.com/signals/font-preferences/), Math, codecs, locale, screen, color depth, CPU architecture, touch support, storage presence, permission states and the display preference queries.
- [`content_blockers`](https://whiskerjs.com/signals/content-blockers/): Brave blocks ads by default, so its cosmetic filtering may hide some of the eight bait elements; the component lists which. It is outside both ids, because blockers are switched per site.

## What is unavailable or blocked

- [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) is `unavailable` / `skipped` on desktop and read on Android (Android user agent).
- [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) and [`private_click`](https://whiskerjs.com/signals/private-click/) report the plain value `none`.
- [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) is not excluded; with canvas farbling it can report `altered`, which is itself a useful diagnostic.

## What WhiskerJS excludes and why

| Component | Why it is left out |
| --- | --- |
| [`audio`](https://whiskerjs.com/signals/audio/) | audio output is farbled; WhiskerJS has no double render for audio |
| [`canvas`](https://whiskerjs.com/signals/canvas/) | canvas readback is farbled |
| [`fonts`](https://whiskerjs.com/signals/fonts/) | Brave randomises the visible font set |
| [`fonts_canvas`](https://whiskerjs.com/signals/fonts-canvas/) | the same font set, probed through the canvas (added to the table at signalsVersion 3) |
| [`hardware_concurrency`](https://whiskerjs.com/signals/hardware-concurrency/) | the CPU thread count is farbled |
| [`plugins`](https://whiskerjs.com/signals/plugins/) | the plugin list is farbled |
| [`webgl_image`](https://whiskerjs.com/signals/webgl-image/) | WebGL readback is farbled |

All seven report `excluded` with ruleId `brave_farbling`. In the visitorId and structuredId they count as “missing”, the same in every run. The rows reflect Brave’s public documentation of farbling, as noted in `src/exclusions.ts`. If Brave changes what it farbles, the table changes and `signalsVersion` goes up.

## Integrity flags to expect

- [`engine_mismatch`](https://whiskerjs.com/docs/integrity/#engine_mismatch) expects V8 behaviour for the `brave` class (a 33-character `eval` source, `productSub` `20030107`), which Brave has.
- [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering), [`prototype_lie`](https://whiskerjs.com/docs/integrity/#prototype_lie) and [`navigator_own_property`](https://whiskerjs.com/docs/integrity/#navigator_own_property) are designed to spot scripts that override functions. Whether Brave’s built-in protections trip any of them has not been measured; treat these flags on Brave traffic with the same care as for privacy extensions.
- [`automation_webdriver`](https://whiskerjs.com/docs/integrity/#automation_webdriver) under automation, as in Chrome.

## Early lab observations

There is no lab data for Brave yet. The early, small sample at signalsVersion 1 covered Mac Chrome, Mac Safari, iPhone Chrome and iPhone Safari only, and none of those had exclusions.

## Testing it yourself

Open the [live demo](https://whiskerjs.com/demo/) in Brave: `browser_class` should say `brave` and the seven components above show `excluded`. Change the Shields setting for the demo site and run again to see `content_blockers` and `canvas_readback` move. The [lab mode](https://whiskerjs.com/demo/#lab) copies one line per run. Nothing is sent anywhere.

## Support table for Brave

Expected status of every component in this browser at signalsVersion 5, from [the support matrix](https://whiskerjs.com/browsers/support-matrix/) (updated 2026-10-26). Basis "code" means expected from the library code and documentation, not yet measured; "lab" means seen in the early lab sample.

| Component | Status | Basis | Note |
| --- | --- | --- | --- |
| [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) | none | code | No ApplePaySession: reports the plain value none. |
| [`audio`](https://whiskerjs.com/signals/audio/) | excluded | code | Exclusion table: brave_farbling (Brave adds per-site, per-session noise). |
| [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) | varies | code | Read on Android (Android user agent), skipped on desktop. |
| [`browser_class`](https://whiskerjs.com/signals/browser-class/) | ok | code | Class brave (navigator.brave.isBrave is a function). |
| [`canvas`](https://whiskerjs.com/signals/canvas/) | excluded | code | Exclusion table: brave_farbling (Brave adds per-site, per-session noise). |
| [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) | varies | code | Not excluded; Brave's canvas farbling can make it report altered. |
| [`color_depth`](https://whiskerjs.com/signals/color-depth/) | ok | code |   |
| [`color_gamut`](https://whiskerjs.com/signals/color-gamut/) | ok | code |   |
| [`content_blockers`](https://whiskerjs.com/signals/content-blockers/) | ok | code | Brave's built-in blocking may hide some baits; reports the hidden bait names or none. |
| [`cpu_architecture`](https://whiskerjs.com/signals/cpu-architecture/) | ok | code |   |
| [`device_memory`](https://whiskerjs.com/signals/device-memory/) | varies | code | Chromium API; Brave's fingerprinting protections may change the value. |
| [`dynamic_range`](https://whiskerjs.com/signals/dynamic-range/) | ok | code |   |
| [`font_preferences`](https://whiskerjs.com/signals/font-preferences/) | ok | code |   |
| [`fonts`](https://whiskerjs.com/signals/fonts/) | excluded | code | Exclusion table: brave_farbling (Brave adds per-site, per-session noise). |
| [`fonts_canvas`](https://whiskerjs.com/signals/fonts-canvas/) | excluded | code | Exclusion table: brave_farbling (Brave adds per-site, per-session noise). |
| [`forced_colors`](https://whiskerjs.com/signals/forced-colors/) | ok | code |   |
| [`hardware_concurrency`](https://whiskerjs.com/signals/hardware-concurrency/) | excluded | code | Exclusion table: brave_farbling (Brave adds per-site, per-session noise). |
| [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) | ok | code |   |
| [`intl_locale`](https://whiskerjs.com/signals/intl-locale/) | ok | code |   |
| [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) | varies | code | Chromium API; Brave may turn it off. |
| [`languages`](https://whiskerjs.com/signals/languages/) | ok | code |   |
| [`math`](https://whiskerjs.com/signals/math/) | ok | code |   |
| [`media_codecs`](https://whiskerjs.com/signals/media-codecs/) | ok | code |   |
| [`pdf_viewer`](https://whiskerjs.com/signals/pdf-viewer/) | ok | code |   |
| [`permissions`](https://whiskerjs.com/signals/permissions/) | ok | code |   |
| [`pixel_ratio`](https://whiskerjs.com/signals/pixel-ratio/) | ok | code |   |
| [`platform`](https://whiskerjs.com/signals/platform/) | ok | code |   |
| [`plugins`](https://whiskerjs.com/signals/plugins/) | excluded | code | Exclusion table: brave_farbling (Brave adds per-site, per-session noise). |
| [`prefers_contrast`](https://whiskerjs.com/signals/prefers-contrast/) | ok | code |   |
| [`private_click`](https://whiskerjs.com/signals/private-click/) | none | code | No attributionSourceId on anchors: reports the plain value none. |
| [`reduced_motion`](https://whiskerjs.com/signals/reduced-motion/) | ok | code |   |
| [`screen_frame`](https://whiskerjs.com/signals/screen-frame/) | ok | code |   |
| [`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/) | ok | code |   |
| [`speech_voices`](https://whiskerjs.com/signals/speech-voices/) | ok | code | Digest of the voice list, or none; some browsers fill the list late. |
| [`storage`](https://whiskerjs.com/signals/storage/) | ok | code |   |
| [`time_zone`](https://whiskerjs.com/signals/time-zone/) | ok | code |   |
| [`touch_support`](https://whiskerjs.com/signals/touch-support/) | ok | code |   |
| [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) | ok | code | Chromium API; the brand list is whatever Brave reports. |
| [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) | ok | code | Chromium API; not in either id. |
| [`vendor`](https://whiskerjs.com/signals/vendor/) | ok | code |   |
| [`vendor_flavors`](https://whiskerjs.com/signals/vendor-flavors/) | ok | code |   |
| [`webgl_image`](https://whiskerjs.com/signals/webgl-image/) | excluded | code | Exclusion table: brave_farbling (Brave adds per-site, per-session noise). |
| [`webgl_params`](https://whiskerjs.com/signals/webgl-params/) | ok | code | Where WebGL 1 is available; unavailable / no_context without it. |
| [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/) | ok | code |   |
| [`webgl_vendor`](https://whiskerjs.com/signals/webgl-vendor/) | ok | code |   |
| [`webgpu`](https://whiskerjs.com/signals/webgpu/) | varies | code | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |

## Questions and answers

### Does WhiskerJS try to get around Brave's farbling?

No. Components Brave randomises on purpose are not collected; they report excluded with ruleId brave_farbling. Working around a privacy feature is out of scope for the library.

### How does WhiskerJS recognise Brave?

By navigator.brave.isBrave being a function. Brave's user agent looks like Chrome's, so the user agent alone would not tell it apart.

### Is the id stable in Brave?

The excluded components count as missing in every run, so they do not change the id. Other components can still change, and Brave may alter more values than the seven in the table. No stability figure has been measured.

## Related pages

- [Farbling](https://whiskerjs.com/glossary/#farbling): Brave's per-site, per-session noise.
- [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): The other browser class with exclusions.
- [The exclusion table](https://whiskerjs.com/docs/how-it-works/#the-exclusion-table): Every row and its ruleId.
- [content_blockers](https://whiskerjs.com/signals/content-blockers/): Brave blocks ads by default.
- [Chrome (desktop)](https://whiskerjs.com/browsers/chrome-desktop/): The same engine, without farbling.


---

# Chrome on Android

> Chrome on Android offers the Chromium APIs WhiskerJS reads, plus the audio output latency, which the library reads only on Android and Safari.

Source: https://whiskerjs.com/browsers/chrome-android/ (last updated 2026-10-26)

> **In plain words:**
>
> Chrome on Android runs the same engine as desktop Chrome, so WhiskerJS reads almost the same set of signals, including the Chromium-only ones such as the device memory and Client Hints. On a phone, Client Hints usually say more about the device (it is mobile, and often which model). WhiskerJS also reads the audio output latency here, which it skips on desktop Chrome. Nothing is excluded on purpose.

## At a glance

- Browser class: `chromium` (the user agent has a `Chrome/<number>` token).
- Excluded components: none.
- Read here but skipped on desktop Chrome: `audio_latency` (the user agent says Android).
- Likely different from desktop: `touch_support`, `ua_client_hints` (mobile, model, form factors), `plugins`, `keyboard_layout`.
- Lab sample: none for Android yet.

## What works

- **Chromium-only components**: [`device_memory`](https://whiskerjs.com/signals/device-memory/), [`heap_limit`](https://whiskerjs.com/signals/heap-limit/), [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) and [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) read the same APIs as on desktop. In `ua_client_hints`, `mobile=1`, the `model` and the `form` factors come from the browser’s own answer to `getHighEntropyValues()`, so they often tell phone models apart better than the user agent string.
- **[`audio_latency`](https://whiskerjs.com/signals/audio-latency/)**: WhiskerJS creates an `AudioContext`, reads `baseLatency`, and closes the context at once. Nothing is played. It is outside both ids because it follows the audio output device (headphones, speaker, Bluetooth).
- **[`touch_support`](https://whiskerjs.com/signals/touch-support/)**: `navigator.maxTouchPoints`, whether a `TouchEvent` can be created, and whether `ontouchstart` exists; a phone typically gives something like `points=5,event=1,start=1`.
- **[`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/)**: the larger side first, so rotating the phone does not change it.
- Graphics, audio rendering, fonts, font preferences, Math, codecs, locale and the display preference queries are read as on any current browser.

## What is unavailable or blocked

- [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) uses `navigator.keyboard.getLayoutMap()`, an API meant for physical keyboards; expect it to be `unavailable` on Android. It is outside the ids either way.
- [`plugins`](https://whiskerjs.com/signals/plugins/): mobile builds often list no plugins, and then the component reports the plain value `none`.
- [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) and [`private_click`](https://whiskerjs.com/signals/private-click/) report the plain value `none`.
- [`webgpu`](https://whiskerjs.com/signals/webgpu/): availability depends on the Chrome version, the Android version and the GPU; it is `unavailable` (`no_api` or `no_context`) where there is no adapter.
- `ua_client_hints` and `ua_versions` report `he=blocked` when a Permissions Policy refuses the detailed hints.

## What WhiskerJS excludes and why

Nothing. The `chromium` row of the exclusion table is empty. If the browser or an extension adds noise to canvas or WebGL readback, the [double render](https://whiskerjs.com/glossary/#double-render) turns `canvas` or `webgl_image` into `noisy` (`render_mismatch`) instead of letting the noise change the id on every run.

## Integrity flags to expect

- [`headless_markers`](https://whiskerjs.com/docs/integrity/#headless_markers) checks for a missing `window.chrome` only when the user agent is desktop Chrome: user agents with `Mobile` or `Android` are skipped by that part of the check, so normal Android Chrome does not raise it that way. A 0x0 outer window still raises it.
- [`automation_webdriver`](https://whiskerjs.com/docs/integrity/#automation_webdriver) when the browser is controlled through WebDriver or a similar protocol, for example in device test farms.
- [`software_renderer`](https://whiskerjs.com/docs/integrity/#software_renderer) in emulators that render WebGL in software.
- [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering) and related lie checks if something overrides browser functions.

None of them is a verdict; see [Integrity checks](https://whiskerjs.com/docs/integrity/#using-the-flags).

## Early lab observations

There is no lab data for Chrome on Android yet. The early, small sample at signalsVersion 1 covered four pairs only: Mac Chrome, Mac Safari, iPhone Chrome and iPhone Safari. The table below is filled from the code, not from measurements on Android.

## Testing it yourself

Open the [live demo](https://whiskerjs.com/demo/) on the phone, run it a few times, rotate the phone, switch between headphones and the speaker, and watch which components move: `screen_resolution` should stay the same and `audio_latency` may change, which is why it is outside the ids. The [lab mode](https://whiskerjs.com/demo/#lab) copies one line per run for your own records. Nothing is sent anywhere.

## Support table for Chrome on Android

Expected status of every component in this browser at signalsVersion 5, from [the support matrix](https://whiskerjs.com/browsers/support-matrix/) (updated 2026-10-26). Basis "code" means expected from the library code and documentation, not yet measured; "lab" means seen in the early lab sample.

| Component | Status | Basis | Note |
| --- | --- | --- | --- |
| [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) | none | code | No ApplePaySession: reports the plain value none. |
| [`audio`](https://whiskerjs.com/signals/audio/) | ok | code |   |
| [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) | ok | code | Read when the user agent says Android. |
| [`browser_class`](https://whiskerjs.com/signals/browser-class/) | ok | code | Class chromium. |
| [`canvas`](https://whiskerjs.com/signals/canvas/) | ok | code | noisy / render_mismatch if an extension or setting adds noise to readback. |
| [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) | ok | code |   |
| [`color_depth`](https://whiskerjs.com/signals/color-depth/) | ok | code |   |
| [`color_gamut`](https://whiskerjs.com/signals/color-gamut/) | ok | code |   |
| [`content_blockers`](https://whiskerjs.com/signals/content-blockers/) | ok | code | none, or the bait names a content blocker hid. |
| [`cpu_architecture`](https://whiskerjs.com/signals/cpu-architecture/) | ok | code |   |
| [`device_memory`](https://whiskerjs.com/signals/device-memory/) | ok | code |   |
| [`dynamic_range`](https://whiskerjs.com/signals/dynamic-range/) | ok | code |   |
| [`font_preferences`](https://whiskerjs.com/signals/font-preferences/) | ok | code |   |
| [`fonts`](https://whiskerjs.com/signals/fonts/) | ok | code |   |
| [`fonts_canvas`](https://whiskerjs.com/signals/fonts-canvas/) | ok | code |   |
| [`forced_colors`](https://whiskerjs.com/signals/forced-colors/) | ok | code |   |
| [`hardware_concurrency`](https://whiskerjs.com/signals/hardware-concurrency/) | ok | code | Some browsers cap or round the value. |
| [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) | ok | code |   |
| [`intl_locale`](https://whiskerjs.com/signals/intl-locale/) | ok | code |   |
| [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) | varies | code | Chromium API meant for physical keyboards; on Android expect unavailable. |
| [`languages`](https://whiskerjs.com/signals/languages/) | ok | code |   |
| [`math`](https://whiskerjs.com/signals/math/) | ok | code |   |
| [`media_codecs`](https://whiskerjs.com/signals/media-codecs/) | ok | code |   |
| [`pdf_viewer`](https://whiskerjs.com/signals/pdf-viewer/) | ok | code |   |
| [`permissions`](https://whiskerjs.com/signals/permissions/) | ok | code |   |
| [`pixel_ratio`](https://whiskerjs.com/signals/pixel-ratio/) | ok | code |   |
| [`platform`](https://whiskerjs.com/signals/platform/) | ok | code |   |
| [`plugins`](https://whiskerjs.com/signals/plugins/) | varies | code | Mobile builds often list no plugins and then report the plain value none. |
| [`prefers_contrast`](https://whiskerjs.com/signals/prefers-contrast/) | ok | code |   |
| [`private_click`](https://whiskerjs.com/signals/private-click/) | none | code | No attributionSourceId on anchors: reports the plain value none. |
| [`reduced_motion`](https://whiskerjs.com/signals/reduced-motion/) | ok | code |   |
| [`screen_frame`](https://whiskerjs.com/signals/screen-frame/) | ok | code |   |
| [`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/) | ok | code |   |
| [`speech_voices`](https://whiskerjs.com/signals/speech-voices/) | ok | code | Digest of the voice list, or none; some browsers fill the list late. |
| [`storage`](https://whiskerjs.com/signals/storage/) | ok | code |   |
| [`time_zone`](https://whiskerjs.com/signals/time-zone/) | ok | code |   |
| [`touch_support`](https://whiskerjs.com/signals/touch-support/) | ok | code |   |
| [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) | ok | code | he=blocked when a Permissions Policy refuses the detailed hints. |
| [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) | ok | code |   |
| [`vendor`](https://whiskerjs.com/signals/vendor/) | ok | code |   |
| [`vendor_flavors`](https://whiskerjs.com/signals/vendor-flavors/) | ok | code |   |
| [`webgl_image`](https://whiskerjs.com/signals/webgl-image/) | ok | code | noisy / render_mismatch if an extension or setting adds noise to readback. |
| [`webgl_params`](https://whiskerjs.com/signals/webgl-params/) | ok | code | Where WebGL 1 is available; unavailable / no_context without it. |
| [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/) | ok | code |   |
| [`webgl_vendor`](https://whiskerjs.com/signals/webgl-vendor/) | ok | code |   |
| [`webgpu`](https://whiskerjs.com/signals/webgpu/) | varies | code | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |

## Questions and answers

### Does rotating the phone change the id?

No. screen_resolution reports the larger side first, so portrait and landscape give the same value. pixel_ratio and screen_frame are outside the ids anyway.

### Why is audio_latency read on Android but not on desktop Chrome?

Desktop Chrome prints a console warning when a page creates an AudioContext without a user gesture, and WhiskerJS writes nothing to the console. The library reads the latency only for Safari and for user agents that say Android.

### Is there lab data for Android?

Not yet. The early lab sample covered Mac Chrome, Mac Safari, iPhone Chrome and iPhone Safari only.

## Related pages

- [Chrome (desktop)](https://whiskerjs.com/browsers/chrome-desktop/): The same engine on computers.
- [Samsung Internet](https://whiskerjs.com/browsers/samsung-internet/): Another Chromium browser on Android.
- [touch_support](https://whiskerjs.com/signals/touch-support/): Touch points and touch events.
- [audio_latency](https://whiskerjs.com/signals/audio-latency/): Read only on Android and in Safari.
- [Browser support matrix](https://whiskerjs.com/browsers/support-matrix/): All browsers side by side.


---

# Chrome (desktop)

> Desktop Chrome offers every API WhiskerJS reads, and the library excludes nothing there.

Source: https://whiskerjs.com/browsers/chrome-desktop/ (last updated 2026-10-26)

> **In plain words:**
>
> Desktop Chrome is the browser where WhiskerJS can read the most: it offers every API the library uses, including a few that only Chromium-based browsers have, such as the device memory and Client Hints. WhiskerJS removes nothing on purpose here. The main things to know are that one small audio signal is skipped to keep the console clean, and that automated or headless Chrome tends to raise integrity flags.

## At a glance

- Browser class: `chromium` (the user agent has a `Chrome/<number>` token).
- Excluded components: none.
- Chromium-only components that are `ok` here: `device_memory`, `heap_limit`, `ua_client_hints`, `ua_versions`, `keyboard_layout`.
- Skipped on purpose: `audio_latency`.
- Lab sample: Mac Chrome kept one id across 4 runs at signalsVersion 1.

## What works

Nearly everything. The graphics group reads a 2D canvas scene twice, a WebGL triangle twice, 21 WebGL parameters with shader precisions and extensions, and the unmasked renderer and vendor through `WEBGL_debug_renderer_info`. Where Chrome has WebGPU enabled, [`webgpu`](https://whiskerjs.com/signals/webgpu/) hashes the adapter’s info, features and seven limits; whether `navigator.gpu` exists depends on the Chrome version, the operating system and the GPU, so treat it as variable.

The Chromium-only components work here:

- [`device_memory`](https://whiskerjs.com/signals/device-memory/) from `navigator.deviceMemory` (coarse buckets such as `8`);
- [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) from `performance.memory.jsHeapSizeLimit`;
- [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/): brands without versions (GREASE removed), mobile, platform, and from one `getHighEntropyValues()` call the architecture, bitness, wow64, model and form factors;
- [`ua_versions`](https://whiskerjs.com/signals/ua-versions/): full brand versions and the platform version, kept out of both ids because they change with every update;
- [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) from `navigator.keyboard.getLayoutMap()`, outside the ids.

Fonts, font preferences, audio, Math, codecs, locale, the five display preference queries, storage presence and permission states are all read as on any current browser.

## What is unavailable or blocked

- [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) is `unavailable` with ruleId `skipped`. Desktop Chrome prints an autoplay warning when a page creates an `AudioContext` without a user gesture, and WhiskerJS writes nothing to the console.
- [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) and [`private_click`](https://whiskerjs.com/signals/private-click/) report the plain value `none`: these are Safari features.
- `ua_client_hints` and `ua_versions` end with `he=blocked` instead of the detailed hints when a Permissions Policy refuses them, for example in an embedded frame. That marker is stable, so it does not make the id jump.
- `keyboard_layout` is `blocked` in cross-origin iframes, where Chrome refuses the call.
- [`webgpu`](https://whiskerjs.com/signals/webgpu/) is `unavailable` with `no_api` where `navigator.gpu` is missing, or `no_context` when no adapter is returned (seen in a headless container run).

## What WhiskerJS excludes and why

Nothing. The exclusion table has an empty row for the `chromium` class, because stock Chrome does not randomise the signals WhiskerJS reads. If an extension adds noise to canvas or WebGL readback, the [double render](https://whiskerjs.com/glossary/#double-render) catches it and the component becomes `noisy` with ruleId `render_mismatch`, and [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) reports `altered`.

## Integrity flags to expect

From the [integrity checks](https://whiskerjs.com/docs/integrity/) and their documented false positives:

- [`automation_webdriver`](https://whiskerjs.com/docs/integrity/#automation_webdriver): Selenium, Playwright and Puppeteer set `navigator.webdriver` by default, and so do your own end-to-end tests.
- [`headless_user_agent`](https://whiskerjs.com/docs/integrity/#headless_user_agent): the user agent contains `HeadlessChrome`.
- [`headless_markers`](https://whiskerjs.com/docs/integrity/#headless_markers): an outer window of 0x0, or a desktop Chrome user agent without `window.chrome`. Some embedded Chromium views raise it too.
- [`software_renderer`](https://whiskerjs.com/docs/integrity/#software_renderer): the WebGL renderer names SwiftShader or similar. Real users with hardware acceleration switched off, or on remote desktops, raise it as well.
- [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering), [`prototype_lie`](https://whiskerjs.com/docs/integrity/#prototype_lie) and [`navigator_own_property`](https://whiskerjs.com/docs/integrity/#navigator_own_property): expect them from privacy and anti-fingerprinting extensions.
- [`permissions_inconsistent`](https://whiskerjs.com/docs/integrity/#permissions_inconsistent): notifications `denied` while the permissions query says `prompt`, a known headless Chrome trait.

For illustration only: a headless Chromium run in a test container (not the lab sample) was classed `other`, had a SwiftShader WebGL renderer and raised `automation_webdriver`, `headless_user_agent`, `permissions_inconsistent` and `software_renderer`. Any single flag is weak evidence; your server weighs them.

## Early lab observations

An early, small sample at signalsVersion 1, not a benchmark: on a Mac, Chrome kept **one id across 4 runs**, and that id differed from the ids of the other three device and browser pairs in the sample. `device_memory` was `ok`. The sample used the first collector (30 components), not the current 46, and involved no other library.

## Testing it yourself

Open the [live demo](https://whiskerjs.com/demo/) in Chrome, run it a few times, and come back after a browser update to see which structuredId group moves. The [lab mode](https://whiskerjs.com/demo/#lab) copies one tab-separated line per run, so you can collect runs from several machines and compare them. Nothing is sent anywhere.

## Support table for Chrome (desktop)

Expected status of every component in this browser at signalsVersion 5, from [the support matrix](https://whiskerjs.com/browsers/support-matrix/) (updated 2026-10-26). Basis "code" means expected from the library code and documentation, not yet measured; "lab" means seen in the early lab sample.

| Component | Status | Basis | Note |
| --- | --- | --- | --- |
| [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) | none | code | No ApplePaySession: reports the plain value none. |
| [`audio`](https://whiskerjs.com/signals/audio/) | ok | code |   |
| [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) | unavailable | code | Skipped (unavailable / skipped): creating an AudioContext here would print a console warning. |
| [`browser_class`](https://whiskerjs.com/signals/browser-class/) | ok | code | Class chromium. |
| [`canvas`](https://whiskerjs.com/signals/canvas/) | ok | code | noisy / render_mismatch if an extension or setting adds noise to readback. |
| [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) | ok | code | exact, or altered when an extension adds noise. |
| [`color_depth`](https://whiskerjs.com/signals/color-depth/) | ok | code |   |
| [`color_gamut`](https://whiskerjs.com/signals/color-gamut/) | ok | code |   |
| [`content_blockers`](https://whiskerjs.com/signals/content-blockers/) | ok | code | none, or the bait names a content blocker hid. |
| [`cpu_architecture`](https://whiskerjs.com/signals/cpu-architecture/) | ok | code |   |
| [`device_memory`](https://whiskerjs.com/signals/device-memory/) | ok | lab | Seen ok on Mac Chrome in the lab sample. |
| [`dynamic_range`](https://whiskerjs.com/signals/dynamic-range/) | ok | code |   |
| [`font_preferences`](https://whiskerjs.com/signals/font-preferences/) | ok | code |   |
| [`fonts`](https://whiskerjs.com/signals/fonts/) | ok | code |   |
| [`fonts_canvas`](https://whiskerjs.com/signals/fonts-canvas/) | ok | code |   |
| [`forced_colors`](https://whiskerjs.com/signals/forced-colors/) | ok | code |   |
| [`hardware_concurrency`](https://whiskerjs.com/signals/hardware-concurrency/) | ok | code | Some browsers cap or round the value. |
| [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) | ok | code |   |
| [`intl_locale`](https://whiskerjs.com/signals/intl-locale/) | ok | code |   |
| [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) | ok | code | navigator.keyboard.getLayoutMap() is a Chromium desktop API; blocked in cross-origin iframes. |
| [`languages`](https://whiskerjs.com/signals/languages/) | ok | code |   |
| [`math`](https://whiskerjs.com/signals/math/) | ok | code |   |
| [`media_codecs`](https://whiskerjs.com/signals/media-codecs/) | ok | code |   |
| [`pdf_viewer`](https://whiskerjs.com/signals/pdf-viewer/) | ok | code |   |
| [`permissions`](https://whiskerjs.com/signals/permissions/) | ok | code |   |
| [`pixel_ratio`](https://whiskerjs.com/signals/pixel-ratio/) | ok | code |   |
| [`platform`](https://whiskerjs.com/signals/platform/) | ok | code |   |
| [`plugins`](https://whiskerjs.com/signals/plugins/) | ok | code |   |
| [`prefers_contrast`](https://whiskerjs.com/signals/prefers-contrast/) | ok | code |   |
| [`private_click`](https://whiskerjs.com/signals/private-click/) | none | code | No attributionSourceId on anchors: reports the plain value none. |
| [`reduced_motion`](https://whiskerjs.com/signals/reduced-motion/) | ok | code |   |
| [`screen_frame`](https://whiskerjs.com/signals/screen-frame/) | ok | code |   |
| [`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/) | ok | code |   |
| [`speech_voices`](https://whiskerjs.com/signals/speech-voices/) | ok | code | Digest of the voice list, or none; some browsers fill the list late. |
| [`storage`](https://whiskerjs.com/signals/storage/) | ok | code |   |
| [`time_zone`](https://whiskerjs.com/signals/time-zone/) | ok | code |   |
| [`touch_support`](https://whiskerjs.com/signals/touch-support/) | ok | code |   |
| [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) | ok | code | he=blocked when a Permissions Policy refuses the detailed hints. |
| [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) | ok | code |   |
| [`vendor`](https://whiskerjs.com/signals/vendor/) | ok | code |   |
| [`vendor_flavors`](https://whiskerjs.com/signals/vendor-flavors/) | ok | code |   |
| [`webgl_image`](https://whiskerjs.com/signals/webgl-image/) | ok | code | noisy / render_mismatch if an extension or setting adds noise to readback. |
| [`webgl_params`](https://whiskerjs.com/signals/webgl-params/) | ok | code | Where WebGL 1 is available; unavailable / no_context without it. |
| [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/) | ok | code |   |
| [`webgl_vendor`](https://whiskerjs.com/signals/webgl-vendor/) | ok | code |   |
| [`webgpu`](https://whiskerjs.com/signals/webgpu/) | varies | code | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |

## Questions and answers

### Is anything excluded in Chrome?

No. The exclusion table has no row for the chromium class, so all 46 components are collected. Some can still be noisy if an extension adds noise to canvas or WebGL readback.

### Why is audio_latency unavailable in Chrome?

Creating an AudioContext outside a user gesture makes desktop Chrome print an autoplay warning in the console, and WhiskerJS never writes to the console. So it reports unavailable with ruleId skipped. Nothing is wrong with the browser.

### Why does headless Chrome show browser_class other?

A headless Chromium whose user agent says HeadlessChrome has no Chrome/ token that the class test matches, and it may lack window.chrome. In a container test run it was classed other and raised headless_user_agent.

## Related pages

- [Microsoft Edge](https://whiskerjs.com/browsers/edge/): Another Chromium browser, with the same behaviour.
- [Chrome on Android](https://whiskerjs.com/browsers/chrome-android/): The same engine on phones.
- [ua_client_hints](https://whiskerjs.com/signals/ua-client-hints/): Client Hints, a Chromium API.
- [Bot and headless detection](https://whiskerjs.com/use-cases/bot-detection/): How the flags can feed your server's rules.
- [Browser support matrix](https://whiskerjs.com/browsers/support-matrix/): All browsers side by side.


---

# Microsoft Edge

> Edge is a Chromium browser, so WhiskerJS treats it like Chrome: every Chromium API is read and nothing is excluded.

Source: https://whiskerjs.com/browsers/edge/ (last updated 2026-10-26)

> **In plain words:**
>
> Microsoft Edge on Windows, macOS and Linux is built on Chromium, the same open-source engine as Chrome. To WhiskerJS it is a Chromium browser: it reads the same signals as in Chrome and leaves nothing out. Edge differs from Chrome mainly in the brand names it reports and in details of its own build, which show up in a few components.

## At a glance

- Browser class: `chromium` (the user agent has a `Chrome/<number>` token).
- Excluded components: none.
- Chromium-only components that are `ok`: `device_memory`, `heap_limit`, `ua_client_hints`, `ua_versions`, `keyboard_layout`.
- Skipped on purpose on desktop: `audio_latency`.
- Lab sample: none.

## What works

All of the [Chrome desktop](https://whiskerjs.com/browsers/chrome-desktop/) list applies:

- the graphics group (canvas and WebGL with the double render, WebGL parameters, the unmasked renderer and vendor, and WebGPU where Edge offers it);
- [`device_memory`](https://whiskerjs.com/signals/device-memory/), [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) and [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/);
- [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/): the brands are whatever Edge reports, without versions and with the GREASE brand removed; [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) adds the full versions outside the ids;
- fonts, font preferences, offline audio, Math, codecs, locale, storage presence, permission states and the display preference queries.

WhiskerJS has no Edge-specific code. It reads the same APIs in the same way; any difference from Chrome comes from what Edge itself returns.

## What is unavailable or blocked

- [`audio_latency`](https://whiskerjs.com/signals/audio-latency/): `unavailable` / `skipped` on desktop, to avoid a console autoplay warning.
- [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) and [`private_click`](https://whiskerjs.com/signals/private-click/): the plain value `none`.
- `ua_client_hints` and `ua_versions` end with `he=blocked` when a Permissions Policy refuses the detailed hints.
- `keyboard_layout` is `blocked` in cross-origin iframes.
- [`webgpu`](https://whiskerjs.com/signals/webgpu/): depends on the Edge version, the operating system and the GPU.

## What WhiskerJS excludes and why

Nothing. The `chromium` row of the exclusion table is empty. If an extension or setting adds noise to canvas or WebGL readback, the [double render](https://whiskerjs.com/glossary/#double-render) reports `noisy` with ruleId `render_mismatch` for that run.

## Edge and Chrome on the same device

Both are class `chromium`, so `browser_class` is the same. Expect differences in:

- [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/): the brand list;
- [`vendor_flavors`](https://whiskerjs.com/signals/vendor-flavors/), [`plugins`](https://whiskerjs.com/signals/plugins/) and [`media_codecs`](https://whiskerjs.com/signals/media-codecs/), where the builds differ;
- [`fonts`](https://whiskerjs.com/signals/fonts/) and graphics, usually not, because they follow the operating system and GPU.

The structuredId shows this directly: the `browser` group differs while `gpu`, `fonts` and `device` often match. See [Comparing two results](https://whiskerjs.com/docs/identifiers/#comparing-two-results).

## Integrity flags to expect

The same as in Chrome: [`automation_webdriver`](https://whiskerjs.com/docs/integrity/#automation_webdriver) under WebDriver control, [`headless_user_agent`](https://whiskerjs.com/docs/integrity/#headless_user_agent) and [`headless_markers`](https://whiskerjs.com/docs/integrity/#headless_markers) for headless builds, [`software_renderer`](https://whiskerjs.com/docs/integrity/#software_renderer) with hardware acceleration off or on remote desktops, and the lie checks ([`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering), [`prototype_lie`](https://whiskerjs.com/docs/integrity/#prototype_lie)) with extensions that override functions.

## Early lab observations

There is no lab data for Edge yet. The early, small sample at signalsVersion 1 covered Mac Chrome, Mac Safari, iPhone Chrome and iPhone Safari only.

## Testing it yourself

Open the [live demo](https://whiskerjs.com/demo/) in Edge and in Chrome on the same machine and compare the structuredId groups. The [lab mode](https://whiskerjs.com/demo/#lab) copies one line per run. Nothing is sent anywhere.

## Support table for Microsoft Edge

Expected status of every component in this browser at signalsVersion 5, from [the support matrix](https://whiskerjs.com/browsers/support-matrix/) (updated 2026-10-26). Basis "code" means expected from the library code and documentation, not yet measured; "lab" means seen in the early lab sample.

| Component | Status | Basis | Note |
| --- | --- | --- | --- |
| [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) | none | code | No ApplePaySession: reports the plain value none. |
| [`audio`](https://whiskerjs.com/signals/audio/) | ok | code |   |
| [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) | unavailable | code | Skipped (unavailable / skipped): creating an AudioContext here would print a console warning. |
| [`browser_class`](https://whiskerjs.com/signals/browser-class/) | ok | code | Class chromium. |
| [`canvas`](https://whiskerjs.com/signals/canvas/) | ok | code | noisy / render_mismatch if an extension or setting adds noise to readback. |
| [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) | ok | code |   |
| [`color_depth`](https://whiskerjs.com/signals/color-depth/) | ok | code |   |
| [`color_gamut`](https://whiskerjs.com/signals/color-gamut/) | ok | code |   |
| [`content_blockers`](https://whiskerjs.com/signals/content-blockers/) | ok | code | none, or the bait names a content blocker hid. |
| [`cpu_architecture`](https://whiskerjs.com/signals/cpu-architecture/) | ok | code |   |
| [`device_memory`](https://whiskerjs.com/signals/device-memory/) | ok | code |   |
| [`dynamic_range`](https://whiskerjs.com/signals/dynamic-range/) | ok | code |   |
| [`font_preferences`](https://whiskerjs.com/signals/font-preferences/) | ok | code |   |
| [`fonts`](https://whiskerjs.com/signals/fonts/) | ok | code |   |
| [`fonts_canvas`](https://whiskerjs.com/signals/fonts-canvas/) | ok | code |   |
| [`forced_colors`](https://whiskerjs.com/signals/forced-colors/) | ok | code |   |
| [`hardware_concurrency`](https://whiskerjs.com/signals/hardware-concurrency/) | ok | code | Some browsers cap or round the value. |
| [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) | ok | code |   |
| [`intl_locale`](https://whiskerjs.com/signals/intl-locale/) | ok | code |   |
| [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) | ok | code | navigator.keyboard.getLayoutMap() is a Chromium desktop API; blocked in cross-origin iframes. |
| [`languages`](https://whiskerjs.com/signals/languages/) | ok | code |   |
| [`math`](https://whiskerjs.com/signals/math/) | ok | code |   |
| [`media_codecs`](https://whiskerjs.com/signals/media-codecs/) | ok | code |   |
| [`pdf_viewer`](https://whiskerjs.com/signals/pdf-viewer/) | ok | code |   |
| [`permissions`](https://whiskerjs.com/signals/permissions/) | ok | code |   |
| [`pixel_ratio`](https://whiskerjs.com/signals/pixel-ratio/) | ok | code |   |
| [`platform`](https://whiskerjs.com/signals/platform/) | ok | code |   |
| [`plugins`](https://whiskerjs.com/signals/plugins/) | ok | code |   |
| [`prefers_contrast`](https://whiskerjs.com/signals/prefers-contrast/) | ok | code |   |
| [`private_click`](https://whiskerjs.com/signals/private-click/) | none | code | No attributionSourceId on anchors: reports the plain value none. |
| [`reduced_motion`](https://whiskerjs.com/signals/reduced-motion/) | ok | code |   |
| [`screen_frame`](https://whiskerjs.com/signals/screen-frame/) | ok | code |   |
| [`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/) | ok | code |   |
| [`speech_voices`](https://whiskerjs.com/signals/speech-voices/) | ok | code | Digest of the voice list, or none; some browsers fill the list late. |
| [`storage`](https://whiskerjs.com/signals/storage/) | ok | code |   |
| [`time_zone`](https://whiskerjs.com/signals/time-zone/) | ok | code |   |
| [`touch_support`](https://whiskerjs.com/signals/touch-support/) | ok | code |   |
| [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) | ok | code | he=blocked when a Permissions Policy refuses the detailed hints. |
| [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) | ok | code |   |
| [`vendor`](https://whiskerjs.com/signals/vendor/) | ok | code |   |
| [`vendor_flavors`](https://whiskerjs.com/signals/vendor-flavors/) | ok | code |   |
| [`webgl_image`](https://whiskerjs.com/signals/webgl-image/) | ok | code | noisy / render_mismatch if an extension or setting adds noise to readback. |
| [`webgl_params`](https://whiskerjs.com/signals/webgl-params/) | ok | code | Where WebGL 1 is available; unavailable / no_context without it. |
| [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/) | ok | code |   |
| [`webgl_vendor`](https://whiskerjs.com/signals/webgl-vendor/) | ok | code |   |
| [`webgpu`](https://whiskerjs.com/signals/webgpu/) | varies | code | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |

## Questions and answers

### Does WhiskerJS tell Edge and Chrome apart?

It does not label them separately: both are class chromium. Components such as ua_client_hints carry the brand names each browser reports, so Edge and Chrome on the same device usually differ there, and that difference reaches the browser group of the structuredId.

### Is anything excluded in Edge?

No. The chromium row of the exclusion table is empty.

### What about Edge on iPhone?

Edge on iOS runs on WebKit like every iOS browser and is classed safari. See the Safari and every iOS browser page.

## Related pages

- [Chrome (desktop)](https://whiskerjs.com/browsers/chrome-desktop/): The same engine and behaviour.
- [Safari and every iOS browser](https://whiskerjs.com/browsers/safari-ios/): Edge on iPhone and iPad.
- [ua_client_hints](https://whiskerjs.com/signals/ua-client-hints/): Brand names without versions.
- [browser_class](https://whiskerjs.com/signals/browser-class/): How the class is chosen.
- [Browser support matrix](https://whiskerjs.com/browsers/support-matrix/): All browsers side by side.


---

# Firefox resistFingerprinting and Tor Browser

> When Firefox reports fixed values on purpose, WhiskerJS leaves nine components out instead of reading normalised values, and it only does so when every trait is present.

Source: https://whiskerjs.com/browsers/firefox-rfp-and-tor/ (last updated 2026-10-26)

> **In plain words:**
>
> Firefox has a setting called resistFingerprinting, and Tor Browser uses it too. It makes the browser report the same, deliberately ordinary values as many other users: the time zone, the screen size and several graphics details. Reading those values would add nothing useful, so when WhiskerJS sees all the signs of this mode it simply does not collect nine of its measurements. It is careful to switch only when every sign is there, so an ordinary Firefox is not affected.

## At a glance

- Browser class: `firefox_rfp`, a special case of Firefox.
- Excluded components: 9, with ruleId `firefox_rfp` (7 of them in the visitorId).
- Also unavailable by design, as in any Firefox: `device_memory`, `heap_limit`, `ua_client_hints`, `ua_versions`, `keyboard_layout`.
- Lab sample: none.

## The exact test

A Firefox (a `Firefox/<number>` user agent token or `mozInnerScreenX`) is classed `firefox_rfp` only when **all** of these hold, in this order, as written in `src/browser-class.ts`:

1. The Intl time zone is `UTC`, `Etc/UTC` or `Atlantic/Reykjavik` (newer releases report the last).
2. `navigator.webdriver` is not `true`.
3. `screen.width` is a positive number equal to `innerWidth`, and `screen.height` equals `innerHeight` (the screen is the content area).
4. `screen.availWidth` and `availHeight` equal the screen size (no space kept for a taskbar).
5. `devicePixelRatio` is exactly 1.
6. `screenX` and `screenY` are 0 (or absent).

Otherwise it is plain `firefox`. Each trait alone is common in stock Firefox, and stock Firefox under automation matches several of them (Playwright runs it in UTC with the screen equal to the viewport), so the test errs towards `firefox`. A missed resistFingerprinting browser only leaves normalised values in the result; a false positive would drop nine components from a normal browser.

### The signalsVersion 5 fix

Before signalsVersion 5, stock Firefox under automation was wrongly classed `firefox_rfp` and lost nine components. The class now needs every trait at once, accepts `Atlantic/Reykjavik` as an RFP time zone, and never applies when `navigator.webdriver` is true. The id effect is limited to Firefox browsers that were wrongly classed before. See [What’s new](https://whiskerjs.com/whats-new/).

## What works

Everything not in the exclusion row: offline audio, fonts and font preferences, WebGL parameters, Math, codecs, plugins, languages and Intl locale, color depth, touch support, storage presence, permission states and the display preference queries. Several of these will also be normalised by resistFingerprinting (for example the language), so expect them to be alike across users; WhiskerJS reports what the browser says.

## What is unavailable or blocked

The Chromium-only components are `unavailable` / `no_api` as in any Firefox. [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) is skipped on desktop. [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) is not excluded, but resistFingerprinting changes canvas readback, so `altered` is likely; that is useful information in itself.

## What WhiskerJS excludes and why

| Component | In visitorId | What resistFingerprinting does to it |
| --- | --- | --- |
| [`canvas`](https://whiskerjs.com/signals/canvas/) | yes | blocks or alters canvas readback |
| [`hardware_concurrency`](https://whiskerjs.com/signals/hardware-concurrency/) | yes | reports a fixed core count |
| [`pixel_ratio`](https://whiskerjs.com/signals/pixel-ratio/) | no | reports 1 |
| [`screen_frame`](https://whiskerjs.com/signals/screen-frame/) | no | available area equal to the screen |
| [`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/) | yes | the content-area size as the screen |
| [`time_zone`](https://whiskerjs.com/signals/time-zone/) | yes | UTC (newer releases Atlantic/Reykjavik) |
| [`webgl_image`](https://whiskerjs.com/signals/webgl-image/) | yes | blocks or alters readback |
| [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/) | yes | placeholder strings |
| [`webgl_vendor`](https://whiskerjs.com/signals/webgl-vendor/) | yes | placeholder strings |

These report `excluded` with ruleId `firefox_rfp`. In the ids they count as “missing”, the same in every run, so they do not make the id unstable.

## Tor Browser

Tor Browser is built on Firefox and uses resistFingerprinting, so it normally meets the test above and is classed `firefox_rfp`. The Tor Project describes further measures, such as rounding window sizes and shipping a limited set of fonts, all aimed at making users look the same. WhiskerJS does not try to get around any of it. In practice, many Tor Browser users of the same version will look alike, and sharing a visitorId is expected. For fraud and abuse work, the fact that a visitor uses Tor is usually better taken from your server’s own view (for example the network address) than from the fingerprint.

## Integrity flags to expect

- [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering) and [`prototype_lie`](https://whiskerjs.com/docs/integrity/#prototype_lie) only if add-ons override functions; resistFingerprinting itself changes values inside the browser.
- [`engine_mismatch`](https://whiskerjs.com/docs/integrity/#engine_mismatch) expects Gecko behaviour for this class, as for Firefox.
- Under automation `navigator.webdriver` is true, so the browser is classed `firefox` instead and [`automation_webdriver`](https://whiskerjs.com/docs/integrity/#automation_webdriver) fires.

## Early lab observations

There is no lab data for resistFingerprinting or Tor Browser yet; the early, small sample at signalsVersion 1 covered Mac and iPhone Chrome and Safari only.

## Testing it yourself

In Firefox, set `privacy.resistFingerprinting` to `true` in `about:config`, maximise or resize as your setup needs, and open the [live demo](https://whiskerjs.com/demo/). If `browser_class` says `firefox_rfp`, the nine components above show `excluded`. If it says `firefox`, one of the traits did not hold; that is the safe outcome. The [lab mode](https://whiskerjs.com/demo/#lab) copies one line per run.

## Support table for Firefox resistFingerprinting and Tor Browser

Expected status of every component in this browser at signalsVersion 5, from [the support matrix](https://whiskerjs.com/browsers/support-matrix/) (updated 2026-10-26). Basis "code" means expected from the library code and documentation, not yet measured; "lab" means seen in the early lab sample.

| Component | Status | Basis | Note |
| --- | --- | --- | --- |
| [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) | none | code | No ApplePaySession: reports the plain value none. |
| [`audio`](https://whiskerjs.com/signals/audio/) | ok | code |   |
| [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) | varies | code | Skipped on desktop; read only with an Android user agent. |
| [`browser_class`](https://whiskerjs.com/signals/browser-class/) | ok | code | Class firefox_rfp only when every resistFingerprinting trait holds; otherwise firefox. |
| [`canvas`](https://whiskerjs.com/signals/canvas/) | excluded | code | Exclusion table: firefox_rfp (fixed or normalised values). |
| [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) | varies | code | resistFingerprinting changes canvas readback, so altered is likely. |
| [`color_depth`](https://whiskerjs.com/signals/color-depth/) | ok | code |   |
| [`color_gamut`](https://whiskerjs.com/signals/color-gamut/) | ok | code |   |
| [`content_blockers`](https://whiskerjs.com/signals/content-blockers/) | ok | code | none, or the bait names a content blocker hid. |
| [`cpu_architecture`](https://whiskerjs.com/signals/cpu-architecture/) | ok | code |   |
| [`device_memory`](https://whiskerjs.com/signals/device-memory/) | unavailable | code | navigator.deviceMemory is a Chromium API. Reports unavailable / no_api. |
| [`dynamic_range`](https://whiskerjs.com/signals/dynamic-range/) | ok | code |   |
| [`font_preferences`](https://whiskerjs.com/signals/font-preferences/) | ok | code |   |
| [`fonts`](https://whiskerjs.com/signals/fonts/) | ok | code | Tor Browser limits fonts to a bundled set, so values are alike across its users. |
| [`fonts_canvas`](https://whiskerjs.com/signals/fonts-canvas/) | ok | code | Tor Browser limits fonts to a bundled set, so values are alike across its users. |
| [`forced_colors`](https://whiskerjs.com/signals/forced-colors/) | ok | code |   |
| [`hardware_concurrency`](https://whiskerjs.com/signals/hardware-concurrency/) | excluded | code | Exclusion table: firefox_rfp (fixed or normalised values). |
| [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) | unavailable | code | performance.memory is a Chromium API. Reports unavailable / no_api. |
| [`intl_locale`](https://whiskerjs.com/signals/intl-locale/) | ok | code |   |
| [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) | unavailable | code | No navigator.keyboard here: unavailable / no_api. |
| [`languages`](https://whiskerjs.com/signals/languages/) | ok | code | resistFingerprinting can normalise the reported language. |
| [`math`](https://whiskerjs.com/signals/math/) | ok | code |   |
| [`media_codecs`](https://whiskerjs.com/signals/media-codecs/) | ok | code |   |
| [`pdf_viewer`](https://whiskerjs.com/signals/pdf-viewer/) | ok | code |   |
| [`permissions`](https://whiskerjs.com/signals/permissions/) | ok | code |   |
| [`pixel_ratio`](https://whiskerjs.com/signals/pixel-ratio/) | excluded | code | Exclusion table: firefox_rfp (fixed or normalised values). |
| [`platform`](https://whiskerjs.com/signals/platform/) | ok | code |   |
| [`plugins`](https://whiskerjs.com/signals/plugins/) | ok | code |   |
| [`prefers_contrast`](https://whiskerjs.com/signals/prefers-contrast/) | ok | code |   |
| [`private_click`](https://whiskerjs.com/signals/private-click/) | none | code | No attributionSourceId on anchors: reports the plain value none. |
| [`reduced_motion`](https://whiskerjs.com/signals/reduced-motion/) | ok | code |   |
| [`screen_frame`](https://whiskerjs.com/signals/screen-frame/) | excluded | code | Exclusion table: firefox_rfp (fixed or normalised values). |
| [`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/) | excluded | code | Exclusion table: firefox_rfp (fixed or normalised values). |
| [`speech_voices`](https://whiskerjs.com/signals/speech-voices/) | varies | code | Digest of the voice list, or none when the list is empty. |
| [`storage`](https://whiskerjs.com/signals/storage/) | ok | code |   |
| [`time_zone`](https://whiskerjs.com/signals/time-zone/) | excluded | code | Exclusion table: firefox_rfp (fixed or normalised values). |
| [`touch_support`](https://whiskerjs.com/signals/touch-support/) | ok | code |   |
| [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) | unavailable | code | navigator.userAgentData (Client Hints) is a Chromium API. Reports unavailable / no_api. |
| [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) | unavailable | code | navigator.userAgentData (Client Hints) is a Chromium API. Reports unavailable / no_api. |
| [`vendor`](https://whiskerjs.com/signals/vendor/) | ok | code |   |
| [`vendor_flavors`](https://whiskerjs.com/signals/vendor-flavors/) | ok | code |   |
| [`webgl_image`](https://whiskerjs.com/signals/webgl-image/) | excluded | code | Exclusion table: firefox_rfp (fixed or normalised values). |
| [`webgl_params`](https://whiskerjs.com/signals/webgl-params/) | ok | code | Where WebGL 1 is available; unavailable / no_context without it. |
| [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/) | excluded | code | Exclusion table: firefox_rfp (fixed or normalised values). |
| [`webgl_vendor`](https://whiskerjs.com/signals/webgl-vendor/) | excluded | code | Exclusion table: firefox_rfp (fixed or normalised values). |
| [`webgpu`](https://whiskerjs.com/signals/webgpu/) | varies | code | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |

## Questions and answers

### How does WhiskerJS know resistFingerprinting is on?

It does not read the setting. It classes Firefox as firefox_rfp when every trait the setting produces holds at once: an RFP time zone (UTC, Etc/UTC or Atlantic/Reykjavik), a screen equal to the content area, no taskbar space, a pixel ratio of 1, a window at 0,0, and navigator.webdriver not true.

### Will Tor Browser users get the same visitorId?

Many may. Tor Browser is designed to make its users look alike, and WhiskerJS respects that: the normalised components are left out, and the rest tend to be similar across users of the same Tor Browser version. Treat a shared id here as expected.

### Can a stock Firefox be wrongly classed firefox_rfp?

The test is built to avoid it, and since signalsVersion 5 it never applies when navigator.webdriver is true. A wrong class would drop nine components; a missed one only leaves normalised values in, so the test errs towards plain firefox.

## Related pages

- [Firefox](https://whiskerjs.com/browsers/firefox/): Stock Firefox, with nothing excluded.
- [resistFingerprinting](https://whiskerjs.com/glossary/#resistfingerprinting): The setting in a few sentences.
- [The exclusion table](https://whiskerjs.com/docs/how-it-works/#the-exclusion-table): Every row and its ruleId.
- [What's new](https://whiskerjs.com/whats-new/): The signalsVersion 5 false-positive fix.
- [Brave](https://whiskerjs.com/browsers/brave/): The other browser with exclusions.


---

# Firefox

> Stock Firefox is read without exclusions; a few Chromium-only APIs are missing, and WebGL strings come from the plain renderer enums.

Source: https://whiskerjs.com/browsers/firefox/ (last updated 2026-10-26)

> **In plain words:**
>
> In a normal Firefox, WhiskerJS reads almost everything and leaves nothing out on purpose. A few measurements only exist in Chrome-like browsers, so they come back as “unavailable”. Firefox has a stricter privacy mode that makes it report fixed values; WhiskerJS only treats a Firefox as being in that mode when every sign of it is present, so an ordinary Firefox is not mistaken for it.

## At a glance

- Browser class: `firefox` (a `Firefox/<number>` token in the user agent, or `mozInnerScreenX` on the window).
- Excluded components: none.
- Unavailable by design: `device_memory`, `heap_limit`, `ua_client_hints`, `ua_versions`, `keyboard_layout`.
- Skipped on purpose on desktop: `audio_latency`.
- Lab sample: none for Firefox yet.

## What works

- **Graphics**: [`canvas`](https://whiskerjs.com/signals/canvas/) and [`webgl_image`](https://whiskerjs.com/signals/webgl-image/) with the double render, [`webgl_params`](https://whiskerjs.com/signals/webgl-params/), and [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/) and [`webgl_vendor`](https://whiskerjs.com/signals/webgl-vendor/). In Firefox, WhiskerJS does not request `WEBGL_debug_renderer_info`, because Firefox prints a deprecation warning when it is requested; `gl.RENDERER` and `gl.VENDOR` already carry the unmasked strings there.
- **[`vendor`](https://whiskerjs.com/signals/vendor/)**: Firefox reports an empty `navigator.vendor`, which WhiskerJS reports as the plain value `empty`.
- Offline audio, fonts (both methods), font preferences, Math, codecs, plugins (typically a fixed PDF list), locale, storage presence, permission states and the display preference queries.
- [`webgpu`](https://whiskerjs.com/signals/webgpu/) where the Firefox version and platform offer `navigator.gpu`; otherwise `unavailable` / `no_api`.

## What is unavailable or blocked

| Component | Status | Why |
| --- | --- | --- |
| [`device_memory`](https://whiskerjs.com/signals/device-memory/) | `unavailable` / `no_api` | no `navigator.deviceMemory` |
| [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) | `unavailable` / `no_api` | no `performance.memory` |
| [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/), [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) | `unavailable` / `no_api` | no `navigator.userAgentData` |
| [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) | `unavailable` / `no_api` | no `navigator.keyboard` |
| [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) | `unavailable` / `skipped` | on desktop, creating an `AudioContext` without a user gesture prints a console warning |

Firefox for Android has an Android user agent, so `audio_latency` is read there. [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) and [`private_click`](https://whiskerjs.com/signals/private-click/) report the plain value `none`.

## What WhiskerJS excludes and why

Nothing in stock Firefox. The `firefox` row of the exclusion table is empty. Only when Firefox runs with `privacy.resistFingerprinting` does the `firefox_rfp` row apply, and the test for it is deliberately strict. Each trait alone (a UTC time zone, a screen the size of the window, a pixel ratio of 1) is common in stock Firefox, so all of them must hold at once, and a browser that reports `navigator.webdriver` as `true` is never classed `firefox_rfp`.

That strictness is the fix of signalsVersion 5: before it, stock Firefox under automation such as Playwright (UTC, screen equal to the viewport) was wrongly classed `firefox_rfp` and lost nine components. A Firefox run under Playwright in a test container, at signalsVersion 5, was classed `firefox` and raised only `automation_webdriver`. See [What’s new](https://whiskerjs.com/whats-new/) and [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/).

## Integrity flags to expect

- [`engine_mismatch`](https://whiskerjs.com/docs/integrity/#engine_mismatch) checks that a Firefox class behaves like Gecko: a 37-character `eval` source and `navigator.productSub` `20100101`. A user agent claiming Firefox in another engine raises it; so can user-agent switcher extensions.
- [`automation_webdriver`](https://whiskerjs.com/docs/integrity/#automation_webdriver) under Selenium, Playwright or similar.
- [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering), [`prototype_lie`](https://whiskerjs.com/docs/integrity/#prototype_lie) and [`navigator_own_property`](https://whiskerjs.com/docs/integrity/#navigator_own_property) with privacy or anti-fingerprinting add-ons.
- [`software_renderer`](https://whiskerjs.com/docs/integrity/#software_renderer) where WebGL runs in software, for example llvmpipe on some Linux setups.

## Early lab observations

There is no lab data for Firefox yet. The early, small sample at signalsVersion 1 covered Mac Chrome, Mac Safari, iPhone Chrome and iPhone Safari only. The table below comes from the code.

## Testing it yourself

Open the [live demo](https://whiskerjs.com/demo/) in Firefox and check `browser_class`: it should say `firefox`. Run it again after a Firefox update and see which structuredId group moved. The [lab mode](https://whiskerjs.com/demo/#lab) copies one line per run. Nothing is sent anywhere.

## Support table for Firefox

Expected status of every component in this browser at signalsVersion 5, from [the support matrix](https://whiskerjs.com/browsers/support-matrix/) (updated 2026-10-26). Basis "code" means expected from the library code and documentation, not yet measured; "lab" means seen in the early lab sample.

| Component | Status | Basis | Note |
| --- | --- | --- | --- |
| [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) | none | code | No ApplePaySession: reports the plain value none. |
| [`audio`](https://whiskerjs.com/signals/audio/) | ok | code |   |
| [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) | varies | code | Skipped on desktop; Firefox for Android has an Android user agent, so it is read there. |
| [`browser_class`](https://whiskerjs.com/signals/browser-class/) | ok | code | Class firefox. |
| [`canvas`](https://whiskerjs.com/signals/canvas/) | ok | code | noisy / render_mismatch if an extension or setting adds noise to readback. |
| [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) | ok | code |   |
| [`color_depth`](https://whiskerjs.com/signals/color-depth/) | ok | code |   |
| [`color_gamut`](https://whiskerjs.com/signals/color-gamut/) | ok | code |   |
| [`content_blockers`](https://whiskerjs.com/signals/content-blockers/) | ok | code | none, or the bait names a content blocker hid. |
| [`cpu_architecture`](https://whiskerjs.com/signals/cpu-architecture/) | ok | code |   |
| [`device_memory`](https://whiskerjs.com/signals/device-memory/) | unavailable | code | navigator.deviceMemory is a Chromium API. Reports unavailable / no_api. |
| [`dynamic_range`](https://whiskerjs.com/signals/dynamic-range/) | ok | code |   |
| [`font_preferences`](https://whiskerjs.com/signals/font-preferences/) | ok | code |   |
| [`fonts`](https://whiskerjs.com/signals/fonts/) | ok | code |   |
| [`fonts_canvas`](https://whiskerjs.com/signals/fonts-canvas/) | ok | code |   |
| [`forced_colors`](https://whiskerjs.com/signals/forced-colors/) | ok | code |   |
| [`hardware_concurrency`](https://whiskerjs.com/signals/hardware-concurrency/) | ok | code | Some browsers cap or round the value. |
| [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) | unavailable | code | performance.memory is a Chromium API. Reports unavailable / no_api. |
| [`intl_locale`](https://whiskerjs.com/signals/intl-locale/) | ok | code |   |
| [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) | unavailable | code | No navigator.keyboard here: unavailable / no_api. |
| [`languages`](https://whiskerjs.com/signals/languages/) | ok | code |   |
| [`math`](https://whiskerjs.com/signals/math/) | ok | code |   |
| [`media_codecs`](https://whiskerjs.com/signals/media-codecs/) | ok | code |   |
| [`pdf_viewer`](https://whiskerjs.com/signals/pdf-viewer/) | ok | code |   |
| [`permissions`](https://whiskerjs.com/signals/permissions/) | ok | code |   |
| [`pixel_ratio`](https://whiskerjs.com/signals/pixel-ratio/) | ok | code |   |
| [`platform`](https://whiskerjs.com/signals/platform/) | ok | code |   |
| [`plugins`](https://whiskerjs.com/signals/plugins/) | ok | code |   |
| [`prefers_contrast`](https://whiskerjs.com/signals/prefers-contrast/) | ok | code |   |
| [`private_click`](https://whiskerjs.com/signals/private-click/) | none | code | No attributionSourceId on anchors: reports the plain value none. |
| [`reduced_motion`](https://whiskerjs.com/signals/reduced-motion/) | ok | code |   |
| [`screen_frame`](https://whiskerjs.com/signals/screen-frame/) | ok | code |   |
| [`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/) | ok | code |   |
| [`speech_voices`](https://whiskerjs.com/signals/speech-voices/) | ok | code | Digest of the voice list, or none; some browsers fill the list late. |
| [`storage`](https://whiskerjs.com/signals/storage/) | ok | code |   |
| [`time_zone`](https://whiskerjs.com/signals/time-zone/) | ok | code |   |
| [`touch_support`](https://whiskerjs.com/signals/touch-support/) | ok | code |   |
| [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) | unavailable | code | navigator.userAgentData (Client Hints) is a Chromium API. Reports unavailable / no_api. |
| [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) | unavailable | code | navigator.userAgentData (Client Hints) is a Chromium API. Reports unavailable / no_api. |
| [`vendor`](https://whiskerjs.com/signals/vendor/) | ok | code |   |
| [`vendor_flavors`](https://whiskerjs.com/signals/vendor-flavors/) | ok | code |   |
| [`webgl_image`](https://whiskerjs.com/signals/webgl-image/) | ok | code | noisy / render_mismatch if an extension or setting adds noise to readback. |
| [`webgl_params`](https://whiskerjs.com/signals/webgl-params/) | ok | code | Where WebGL 1 is available; unavailable / no_context without it. |
| [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/) | ok | code | Read from gl.RENDERER; WEBGL_debug_renderer_info is not requested in Firefox. |
| [`webgl_vendor`](https://whiskerjs.com/signals/webgl-vendor/) | ok | code | Read from gl.VENDOR; WEBGL_debug_renderer_info is not requested in Firefox. |
| [`webgpu`](https://whiskerjs.com/signals/webgpu/) | varies | code | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |

## Questions and answers

### Why does WhiskerJS not request WEBGL_debug_renderer_info in Firefox?

Firefox prints a deprecation warning in the console when that extension is requested, and its plain gl.RENDERER and gl.VENDOR values already carry the unmasked strings. WhiskerJS writes nothing to the console, so it reads the plain values.

### My Firefox runs in UTC. Will it be treated as resistFingerprinting?

Not on that alone. The firefox_rfp class needs every trait at once: an RFP time zone, a screen equal to the content area, no taskbar space, pixel ratio 1, a window at 0,0, and navigator.webdriver not true.

### Is there lab data for Firefox?

No. The early lab sample covered Mac Chrome, Mac Safari, iPhone Chrome and iPhone Safari only.

## Related pages

- [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/): When Firefox normalises values on purpose.
- [webgl_renderer](https://whiskerjs.com/signals/webgl-renderer/): The GPU name from WebGL.
- [vendor](https://whiskerjs.com/signals/vendor/): Reported as empty in Firefox.
- [engine_mismatch](https://whiskerjs.com/docs/integrity/#engine_mismatch): Checks that a Firefox class behaves like Gecko.
- [Browser support matrix](https://whiskerjs.com/browsers/support-matrix/): All browsers side by side.


---

# Safari and every iOS browser

> On iPhone and iPad every browser runs Apple's WebKit, so WhiskerJS treats them all as the safari class and tells them apart with a few app-specific globals.

Source: https://whiskerjs.com/browsers/safari-ios/ (last updated 2026-10-26)

> **In plain words:**
>
> On an iPhone or iPad, every browser (Safari, Chrome, Firefox, Edge and others) is built on Apple’s WebKit engine. To WhiskerJS they all look like Safari, so they share Safari’s strengths and gaps: no device memory or Client Hints, but Apple-specific signals such as Apple Pay. The apps differ in small ways, for example in a few hidden variables they add to the page, and WhiskerJS reports those so your server can tell the apps apart.

## At a glance

- Browser class: `safari`, for Safari and for Chrome, Firefox and Edge on iOS.
- Excluded components: none.
- Unavailable by design: `device_memory`, `heap_limit`, `ua_client_hints`, `ua_versions`, `keyboard_layout`.
- Read here: `audio_latency` (class `safari`), `touch_support` with touch points.
- Telling apps apart: `vendor_flavors`.
- Lab sample: iPhone Chrome (3 runs) and iPhone Safari (3 runs) each kept one id at signalsVersion 1.

## Why every iOS browser is classed safari

The class test in `src/browser-class.ts` runs in a fixed order, and on iOS each step falls through to `safari`:

1. **Not `brave`**: unless `navigator.brave.isBrave` is a function.
2. **Not `firefox`**: Firefox on iOS uses `FxiOS/` in its user agent, not a `Firefox/<number>` token, and WebKit has no `mozInnerScreenX`.
3. **Not `chromium`**: Chrome on iOS uses `CriOS/` and Edge on iOS `EdgiOS/`, not a `Chrome/<number>` token, and the vendor is not `Google Inc.`.
4. **`safari`**: `navigator.vendor` is `Apple Computer, Inc.` in every WebKit browser.

This is the right result for the exclusion table and for the engine check: the code really runs on WebKit. The integrity check [`engine_mismatch`](https://whiskerjs.com/docs/integrity/#engine_mismatch) expects WebKit behaviour (a 37-character `eval` source and `productSub` `20030107`), which these browsers have. And [`headless_markers`](https://whiskerjs.com/docs/integrity/#headless_markers) does not apply its “desktop Chrome without `window.chrome`” test to user agents with `CriOS`, `Mobile` or `Android`.

## Telling iOS browsers apart

[`vendor_flavors`](https://whiskerjs.com/signals/vendor-flavors/) reports which of ten browser-specific globals exist on the page. Three of them are linked to iOS apps: `__crWeb` and `__gCrWeb` (associated with Chrome on iOS) and `__firefox__` (associated with Firefox on iOS). Whether an app defines them depends on the app and its version, so treat the value as a hint that differs between apps, not as a guarantee. WhiskerJS checks no Edge-specific global. The component is part of the `browser` group of the visitorId, which is one reason Safari and Chrome on the same iPhone can have different ids.

## What works

- [`audio_latency`](https://whiskerjs.com/signals/audio-latency/): read because the class is `safari`; the `AudioContext` is closed at once and nothing is played.
- [`touch_support`](https://whiskerjs.com/signals/touch-support/): touch points and touch events; [`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/) with the larger side first, so rotation does not change it.
- [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) and [`private_click`](https://whiskerjs.com/signals/private-click/) in Safari; in other iOS apps they depend on what the app’s WebKit exposes, and they report the plain value `none` when the API is missing.
- Canvas, WebGL, offline audio, fonts, font preferences, Math, codecs, locale and display preferences.

## What is unavailable or blocked

| Component | Status | Why |
| --- | --- | --- |
| [`device_memory`](https://whiskerjs.com/signals/device-memory/) | `unavailable` / `no_api` | WebKit has no `navigator.deviceMemory` |
| [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) | `unavailable` / `no_api` | no `performance.memory` |
| [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/), [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) | `unavailable` / `no_api` | no `navigator.userAgentData`, even in Chrome on iOS |
| [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) | `unavailable` / `no_api` | no `navigator.keyboard` |

[`plugins`](https://whiskerjs.com/signals/plugins/) often lists nothing on mobile and then reports `none`; [`pdf_viewer`](https://whiskerjs.com/signals/pdf-viewer/) is `unavailable` where `navigator.pdfViewerEnabled` does not exist. [`webgpu`](https://whiskerjs.com/signals/webgpu/) depends on the iOS version.

## What WhiskerJS excludes and why

Nothing; the `safari` row of the exclusion table is empty. As on the Mac, Apple describes fingerprinting protections that can add noise to readback in some modes; the [double render](https://whiskerjs.com/glossary/#double-render) turns `canvas` and `webgl_image` into `noisy` when two identical drawings differ.

## Integrity flags to expect

- [`iframe_mismatch`](https://whiskerjs.com/docs/integrity/#iframe_mismatch) under WebKit automation, a documented false positive.
- [`automation_webdriver`](https://whiskerjs.com/docs/integrity/#automation_webdriver) in device test farms driven through WebDriver.
- [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering) and related lie checks when privacy extensions or other scripts on the page override functions.

## Early lab observations

An early, small sample at signalsVersion 1, not a benchmark:

| Device and browser | Runs | Ids seen |
| --- | --- | --- |
| iPhone, Chrome | 3 | 1 |
| iPhone, Safari | 3 | 1 |

Each kept one id across its runs, and the two ids differed from each other and from the two Mac ids in the sample. `device_memory` was `unavailable` on both, including Chrome on iPhone, because Chrome there runs on WebKit. The sample used 30 components, not the current 46.

## Testing it yourself

Open the [live demo](https://whiskerjs.com/demo/) in two iOS browsers on the same device and compare the structuredId groups: the `browser` group is where they are most likely to differ. The [lab mode](https://whiskerjs.com/demo/#lab) copies one line per run. Nothing is sent anywhere.

## Support table for Safari and every iOS browser

Expected status of every component in this browser at signalsVersion 5, from [the support matrix](https://whiskerjs.com/browsers/support-matrix/) (updated 2026-10-26). Basis "code" means expected from the library code and documentation, not yet measured; "lab" means seen in the early lab sample.

| Component | Status | Basis | Note |
| --- | --- | --- | --- |
| [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) | varies | code | Safari has ApplePaySession; in other iOS browsers it depends on the app. none where it is missing. |
| [`audio`](https://whiskerjs.com/signals/audio/) | ok | code | No double render for audio: noise added to audio reads would change the digest each run. |
| [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) | ok | code | Read for browser class safari; the context is closed at once. |
| [`browser_class`](https://whiskerjs.com/signals/browser-class/) | ok | code | Class safari, for every iOS browser (Apple vendor, no Chrome/ token). |
| [`canvas`](https://whiskerjs.com/signals/canvas/) | varies | code | Apple describes fingerprinting protections that can add noise to readback in some modes (for example private browsing); WhiskerJS reports noisy / render_mismatch when the double render differs. |
| [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) | varies | code | exact, or altered where readback noise is applied. |
| [`color_depth`](https://whiskerjs.com/signals/color-depth/) | ok | code |   |
| [`color_gamut`](https://whiskerjs.com/signals/color-gamut/) | ok | code |   |
| [`content_blockers`](https://whiskerjs.com/signals/content-blockers/) | ok | code | none, or the bait names a content blocker hid. |
| [`cpu_architecture`](https://whiskerjs.com/signals/cpu-architecture/) | ok | code |   |
| [`device_memory`](https://whiskerjs.com/signals/device-memory/) | unavailable | lab | Seen unavailable on iPhone Safari and iPhone Chrome in the lab sample; no iOS browser offers it. |
| [`dynamic_range`](https://whiskerjs.com/signals/dynamic-range/) | ok | code |   |
| [`font_preferences`](https://whiskerjs.com/signals/font-preferences/) | ok | code |   |
| [`fonts`](https://whiskerjs.com/signals/fonts/) | ok | code |   |
| [`fonts_canvas`](https://whiskerjs.com/signals/fonts-canvas/) | ok | code |   |
| [`forced_colors`](https://whiskerjs.com/signals/forced-colors/) | ok | code |   |
| [`hardware_concurrency`](https://whiskerjs.com/signals/hardware-concurrency/) | ok | code | Some browsers cap or round the value. |
| [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) | unavailable | code | performance.memory is a Chromium API. Reports unavailable / no_api. |
| [`intl_locale`](https://whiskerjs.com/signals/intl-locale/) | ok | code |   |
| [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) | unavailable | code | No navigator.keyboard here: unavailable / no_api. |
| [`languages`](https://whiskerjs.com/signals/languages/) | ok | code |   |
| [`math`](https://whiskerjs.com/signals/math/) | ok | code |   |
| [`media_codecs`](https://whiskerjs.com/signals/media-codecs/) | ok | code |   |
| [`pdf_viewer`](https://whiskerjs.com/signals/pdf-viewer/) | varies | code | unavailable where navigator.pdfViewerEnabled does not exist. |
| [`permissions`](https://whiskerjs.com/signals/permissions/) | ok | code |   |
| [`pixel_ratio`](https://whiskerjs.com/signals/pixel-ratio/) | ok | code |   |
| [`platform`](https://whiskerjs.com/signals/platform/) | ok | code |   |
| [`plugins`](https://whiskerjs.com/signals/plugins/) | varies | code | Mobile builds often list no plugins and then report the plain value none. |
| [`prefers_contrast`](https://whiskerjs.com/signals/prefers-contrast/) | ok | code |   |
| [`private_click`](https://whiskerjs.com/signals/private-click/) | varies | code | Depends on whether the app's WebKit exposes Private Click Measurement; none otherwise. |
| [`reduced_motion`](https://whiskerjs.com/signals/reduced-motion/) | ok | code |   |
| [`screen_frame`](https://whiskerjs.com/signals/screen-frame/) | ok | code |   |
| [`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/) | ok | code |   |
| [`speech_voices`](https://whiskerjs.com/signals/speech-voices/) | ok | code | Digest of the voice list, or none; some browsers fill the list late. |
| [`storage`](https://whiskerjs.com/signals/storage/) | ok | code |   |
| [`time_zone`](https://whiskerjs.com/signals/time-zone/) | ok | code |   |
| [`touch_support`](https://whiskerjs.com/signals/touch-support/) | ok | code |   |
| [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) | unavailable | code | navigator.userAgentData (Client Hints) is a Chromium API. Reports unavailable / no_api. |
| [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) | unavailable | code | navigator.userAgentData (Client Hints) is a Chromium API. Reports unavailable / no_api. |
| [`vendor`](https://whiskerjs.com/signals/vendor/) | ok | code |   |
| [`vendor_flavors`](https://whiskerjs.com/signals/vendor-flavors/) | ok | code |   |
| [`webgl_image`](https://whiskerjs.com/signals/webgl-image/) | varies | code | Apple describes fingerprinting protections that can add noise to readback in some modes (for example private browsing); WhiskerJS reports noisy / render_mismatch when the double render differs. |
| [`webgl_params`](https://whiskerjs.com/signals/webgl-params/) | ok | code | Where WebGL 1 is available; unavailable / no_context without it. |
| [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/) | ok | code | Often a generic string such as Apple GPU. |
| [`webgl_vendor`](https://whiskerjs.com/signals/webgl-vendor/) | ok | code |   |
| [`webgpu`](https://whiskerjs.com/signals/webgpu/) | varies | code | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |

## Questions and answers

### Why does Chrome on my iPhone show browser_class safari?

On iOS every browser uses WebKit. Chrome on iOS reports the Apple vendor string and its user agent carries CriOS instead of a Chrome/ token, so the class test matches safari. That is expected, not a bug.

### Do Safari and Chrome on the same iPhone get the same id?

Not necessarily. In the early lab sample, iPhone Chrome and iPhone Safari each kept their own id, and the ids differed. vendor_flavors is one component that can differ between iOS browsers.

### Why is device_memory unavailable on every iPhone browser?

No iOS browser offers navigator.deviceMemory, because WebKit does not. The lab sample showed it unavailable on iPhone Safari and iPhone Chrome.

## Related pages

- [Safari on macOS](https://whiskerjs.com/browsers/safari-macos/): The same engine on the Mac.
- [vendor_flavors](https://whiskerjs.com/signals/vendor-flavors/): The browser-specific globals WhiskerJS checks.
- [browser_class](https://whiskerjs.com/signals/browser-class/): How the class is chosen.
- [device_memory](https://whiskerjs.com/signals/device-memory/): A Chromium-only API.
- [Browser support matrix](https://whiskerjs.com/browsers/support-matrix/): All browsers side by side.


---

# Safari on macOS

> Safari offers some signals no other browser has and lacks the Chromium-only ones; WhiskerJS excludes nothing here and catches canvas noise with a double render.

Source: https://whiskerjs.com/browsers/safari-macos/ (last updated 2026-10-26)

> **In plain words:**
>
> Safari on the Mac uses Apple’s WebKit engine. It lacks a few measurements that only Chromium-based browsers offer, such as the device memory and Client Hints, so those come back as “unavailable”. In return it has a few of its own, such as Apple Pay support and Private Click Measurement, and WhiskerJS reads the audio output latency here. Nothing is left out on purpose. If Safari adds noise to drawings, WhiskerJS notices and marks those signals as noisy.

## At a glance

- Browser class: `safari` (the vendor is `Apple Computer, Inc.`).
- Excluded components: none.
- Unavailable by design: `device_memory`, `heap_limit`, `ua_client_hints`, `ua_versions`, `keyboard_layout`.
- Read only here and on iOS (and, for latency, Android): `apple_pay` with a version, `private_click`, `audio_latency`.
- Lab sample: Mac Safari kept one id across 2 runs at signalsVersion 1.

## What works

- **Safari-specific components**: [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) reports `version=<n>;can_pay=<1 or 0>`, found by asking `supportsVersion()` from 20 down; `can_pay` is `blocked` where `canMakePayments()` throws (insecure or cross-origin contexts). [`private_click`](https://whiskerjs.com/signals/private-click/) reads `attributionSourceId` from a new, unattached `<a>` element. [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) reads `AudioContext.baseLatency` and closes the context at once.
- **Graphics**: canvas and WebGL are read as elsewhere. The [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/) string is often generic (for example `Apple GPU`), which tells less than on other browsers.
- Fonts, font preferences, offline audio, Math, codecs, plugins, locale, storage presence and the display preference queries.

## What is unavailable or blocked

These report `unavailable` with ruleId `no_api` because Safari does not offer the API:

| Component | Missing API |
| --- | --- |
| [`device_memory`](https://whiskerjs.com/signals/device-memory/) | `navigator.deviceMemory` |
| [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) | `performance.memory` |
| [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) | `navigator.userAgentData` |
| [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) | `navigator.userAgentData` |
| [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) | `navigator.keyboard` |

Because a non-ok status counts the same in every run, these do not make the id unstable: they are simply “missing” every time. [`webgpu`](https://whiskerjs.com/signals/webgpu/) depends on the Safari and macOS version; it is `unavailable` where `navigator.gpu` is missing.

## What WhiskerJS excludes and why

Nothing. The `safari` row of the exclusion table is empty. Apple describes fingerprinting protections in Safari that can add noise to readback in some modes, for example private browsing. WhiskerJS does not work around that: [`canvas`](https://whiskerjs.com/signals/canvas/) and [`webgl_image`](https://whiskerjs.com/signals/webgl-image/) are each drawn twice, and when the two differ the component is `noisy` with ruleId `render_mismatch`. [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) then reports `altered`. The [`audio`](https://whiskerjs.com/signals/audio/) component has no double render, so noise added to audio samples would change its digest from run to run.

## Integrity flags to expect

- [`iframe_mismatch`](https://whiskerjs.com/docs/integrity/#iframe_mismatch) has been seen under WebKit automation (for example Playwright’s WebKit build), where the automation layer makes the page and a new frame disagree. A WebKit run in a test container raised it together with `automation_webdriver`. Check which value differs before acting on it.
- [`engine_mismatch`](https://whiskerjs.com/docs/integrity/#engine_mismatch) checks that a `safari` class behaves like WebKit: the printed source of `eval` must be 37 characters and `navigator.productSub` `20030107`. A user-agent switcher can raise it.
- [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering) and [`prototype_lie`](https://whiskerjs.com/docs/integrity/#prototype_lie) with extensions that change browser functions.

## Early lab observations

An early, small sample at signalsVersion 1, not a benchmark: on a Mac, Safari kept **one id across 2 runs**, different from the ids of the other three pairs. `device_memory` was `unavailable`, by design. The sample used the first collector (30 components), not the current 46.

## Testing it yourself

Run the [live demo](https://whiskerjs.com/demo/) in a normal Safari window and then in a private window, and compare the canvas and WebGL statuses. If they turn `noisy` in one mode, you see why the visitorId can differ between the two. The [lab mode](https://whiskerjs.com/demo/#lab) copies one line per run. Nothing is sent anywhere.

## Support table for Safari on macOS

Expected status of every component in this browser at signalsVersion 5, from [the support matrix](https://whiskerjs.com/browsers/support-matrix/) (updated 2026-10-26). Basis "code" means expected from the library code and documentation, not yet measured; "lab" means seen in the early lab sample.

| Component | Status | Basis | Note |
| --- | --- | --- | --- |
| [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) | ok | code | version=<n>;can_pay=<1, 0 or blocked>; can_pay is blocked in insecure or cross-origin contexts. |
| [`audio`](https://whiskerjs.com/signals/audio/) | ok | code | No double render for audio: noise added to audio reads would change the digest each run. |
| [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) | ok | code | Read for browser class safari; the context is closed at once. |
| [`browser_class`](https://whiskerjs.com/signals/browser-class/) | ok | code | Class safari. |
| [`canvas`](https://whiskerjs.com/signals/canvas/) | varies | code | Apple describes fingerprinting protections that can add noise to readback in some modes (for example private browsing); WhiskerJS reports noisy / render_mismatch when the double render differs. |
| [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) | varies | code | exact, or altered where readback noise is applied. |
| [`color_depth`](https://whiskerjs.com/signals/color-depth/) | ok | code |   |
| [`color_gamut`](https://whiskerjs.com/signals/color-gamut/) | ok | code |   |
| [`content_blockers`](https://whiskerjs.com/signals/content-blockers/) | ok | code | none, or the bait names a content blocker hid. |
| [`cpu_architecture`](https://whiskerjs.com/signals/cpu-architecture/) | ok | code |   |
| [`device_memory`](https://whiskerjs.com/signals/device-memory/) | unavailable | lab | Seen unavailable on Mac Safari in the lab sample; Safari does not offer navigator.deviceMemory. |
| [`dynamic_range`](https://whiskerjs.com/signals/dynamic-range/) | ok | code |   |
| [`font_preferences`](https://whiskerjs.com/signals/font-preferences/) | ok | code |   |
| [`fonts`](https://whiskerjs.com/signals/fonts/) | ok | code |   |
| [`fonts_canvas`](https://whiskerjs.com/signals/fonts-canvas/) | ok | code |   |
| [`forced_colors`](https://whiskerjs.com/signals/forced-colors/) | ok | code |   |
| [`hardware_concurrency`](https://whiskerjs.com/signals/hardware-concurrency/) | ok | code | Some browsers cap or round the value. |
| [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) | unavailable | code | performance.memory is a Chromium API. Reports unavailable / no_api. |
| [`intl_locale`](https://whiskerjs.com/signals/intl-locale/) | ok | code |   |
| [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) | unavailable | code | No navigator.keyboard here: unavailable / no_api. |
| [`languages`](https://whiskerjs.com/signals/languages/) | ok | code |   |
| [`math`](https://whiskerjs.com/signals/math/) | ok | code |   |
| [`media_codecs`](https://whiskerjs.com/signals/media-codecs/) | ok | code |   |
| [`pdf_viewer`](https://whiskerjs.com/signals/pdf-viewer/) | ok | code |   |
| [`permissions`](https://whiskerjs.com/signals/permissions/) | ok | code |   |
| [`pixel_ratio`](https://whiskerjs.com/signals/pixel-ratio/) | ok | code |   |
| [`platform`](https://whiskerjs.com/signals/platform/) | ok | code |   |
| [`plugins`](https://whiskerjs.com/signals/plugins/) | ok | code |   |
| [`prefers_contrast`](https://whiskerjs.com/signals/prefers-contrast/) | ok | code |   |
| [`private_click`](https://whiskerjs.com/signals/private-click/) | ok | code | Safari Private Click Measurement exposes attributionSourceId. |
| [`reduced_motion`](https://whiskerjs.com/signals/reduced-motion/) | ok | code |   |
| [`screen_frame`](https://whiskerjs.com/signals/screen-frame/) | ok | code |   |
| [`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/) | ok | code |   |
| [`speech_voices`](https://whiskerjs.com/signals/speech-voices/) | ok | code | Digest of the voice list, or none; some browsers fill the list late. |
| [`storage`](https://whiskerjs.com/signals/storage/) | ok | code |   |
| [`time_zone`](https://whiskerjs.com/signals/time-zone/) | ok | code |   |
| [`touch_support`](https://whiskerjs.com/signals/touch-support/) | ok | code |   |
| [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) | unavailable | code | navigator.userAgentData (Client Hints) is a Chromium API. Reports unavailable / no_api. |
| [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) | unavailable | code | navigator.userAgentData (Client Hints) is a Chromium API. Reports unavailable / no_api. |
| [`vendor`](https://whiskerjs.com/signals/vendor/) | ok | code |   |
| [`vendor_flavors`](https://whiskerjs.com/signals/vendor-flavors/) | ok | code |   |
| [`webgl_image`](https://whiskerjs.com/signals/webgl-image/) | varies | code | Apple describes fingerprinting protections that can add noise to readback in some modes (for example private browsing); WhiskerJS reports noisy / render_mismatch when the double render differs. |
| [`webgl_params`](https://whiskerjs.com/signals/webgl-params/) | ok | code | Where WebGL 1 is available; unavailable / no_context without it. |
| [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/) | ok | code | Often a generic string such as Apple GPU. |
| [`webgl_vendor`](https://whiskerjs.com/signals/webgl-vendor/) | ok | code |   |
| [`webgpu`](https://whiskerjs.com/signals/webgpu/) | varies | code | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |

## Questions and answers

### Why is device_memory unavailable in Safari?

Safari does not offer navigator.deviceMemory; only Chromium-based browsers do. WhiskerJS reports it as unavailable with ruleId no_api, by design. The early lab sample showed exactly this on Mac Safari.

### Does Safari's private browsing change the id?

It can. Apple describes fingerprinting protections that can add noise to readback in some modes. When the two canvas or WebGL renders differ, WhiskerJS reports the component as noisy, and a component that is ok in one run and noisy in another changes the visitorId.

### Does WhiskerJS show an Apple Pay sheet?

No. It only checks whether ApplePaySession exists, the highest supported version and canMakePayments(). No payment sheet is shown and no request is made.

## Related pages

- [Safari and every iOS browser](https://whiskerjs.com/browsers/safari-ios/): The same engine on iPhone and iPad.
- [apple_pay](https://whiskerjs.com/signals/apple-pay/): Apple Pay presence and version.
- [private_click](https://whiskerjs.com/signals/private-click/): Private Click Measurement.
- [Canvas noise](https://whiskerjs.com/glossary/#canvas-noise): What the double render catches.
- [Browser support matrix](https://whiskerjs.com/browsers/support-matrix/): All browsers side by side.


---

# Samsung Internet

> Samsung Internet is a Chromium browser for Android; WhiskerJS treats it like Chrome on Android and checks one Samsung-related global.

Source: https://whiskerjs.com/browsers/samsung-internet/ (last updated 2026-10-26)

> **In plain words:**
>
> Samsung Internet is the browser that comes with many Samsung phones and tablets. It is built on Chromium, so WhiskerJS reads it like Chrome on Android: the Chromium-only signals work, nothing is left out on purpose, and the audio output latency is read because it is Android. WhiskerJS also checks for one global variable associated with Samsung’s browser.

## At a glance

- Browser class: `chromium` (the user agent has a `Chrome/<number>` token).
- Excluded components: none.
- Read on Android: `audio_latency`.
- Samsung-related check: `vendor_flavors` includes `samsungAr` when that global exists.
- Lab sample: none.

## What works

- **Chromium-only components**: [`device_memory`](https://whiskerjs.com/signals/device-memory/), [`heap_limit`](https://whiskerjs.com/signals/heap-limit/), [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) and [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) read the same APIs as in Chrome; on a phone `ua_client_hints` usually carries `mobile=1` and the model and form factors the browser reports.
- **[`audio_latency`](https://whiskerjs.com/signals/audio-latency/)**: read because the user agent says Android; the `AudioContext` is closed at once and nothing is played.
- **[`vendor_flavors`](https://whiskerjs.com/signals/vendor-flavors/)**: lists which of ten browser-specific globals exist. One of them is `samsungAr`. Whether a given Samsung Internet version defines it is up to the browser, so treat its presence as a hint, not a rule. The component is in the `browser` group of the visitorId.
- **[`touch_support`](https://whiskerjs.com/signals/touch-support/)** and **[`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/)** (larger side first, so rotation does not change it).
- Graphics, offline audio, fonts, font preferences, Math, codecs, locale and display preferences.

## What is unavailable or blocked

- [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) uses an API meant for physical keyboards; expect `unavailable` on Android. It is outside the ids.
- [`plugins`](https://whiskerjs.com/signals/plugins/): mobile builds often list none, and then report the plain value `none`.
- [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) and [`private_click`](https://whiskerjs.com/signals/private-click/): the plain value `none`.
- [`webgpu`](https://whiskerjs.com/signals/webgpu/): depends on the browser version, Android version and GPU.
- `ua_client_hints` and `ua_versions` report `he=blocked` when a Permissions Policy refuses the detailed hints.

## What WhiskerJS excludes and why

Nothing. The `chromium` row of the exclusion table is empty. If the browser, a setting or an extension adds noise to canvas or WebGL readback, the [double render](https://whiskerjs.com/glossary/#double-render) marks `canvas` or `webgl_image` as `noisy` (`render_mismatch`) for that run.

## Samsung Internet and Chrome on the same phone

Both are class `chromium`. Expect the `browser` group of the structuredId to differ (brands in `ua_client_hints`, globals in `vendor_flavors`, possibly codecs), while `gpu`, `device` and `fonts` often match because they follow the phone itself. See [Comparing two results](https://whiskerjs.com/docs/identifiers/#comparing-two-results).

## Integrity flags to expect

- [`headless_markers`](https://whiskerjs.com/docs/integrity/#headless_markers) does not apply its “desktop Chrome without `window.chrome`” test to user agents with `Mobile` or `Android`; a 0x0 outer window still raises it.
- [`automation_webdriver`](https://whiskerjs.com/docs/integrity/#automation_webdriver) under WebDriver control, for example in device test farms.
- [`software_renderer`](https://whiskerjs.com/docs/integrity/#software_renderer) in emulators that render WebGL in software.
- The lie checks if a script overrides browser functions.

## Early lab observations

There is no lab data for Samsung Internet yet. The early, small sample at signalsVersion 1 covered Mac Chrome, Mac Safari, iPhone Chrome and iPhone Safari only.

## Testing it yourself

Open the [live demo](https://whiskerjs.com/demo/) in Samsung Internet and in Chrome on the same phone and compare the structuredId groups. The [lab mode](https://whiskerjs.com/demo/#lab) copies one line per run. Nothing is sent anywhere.

## Support table for Samsung Internet

Expected status of every component in this browser at signalsVersion 5, from [the support matrix](https://whiskerjs.com/browsers/support-matrix/) (updated 2026-10-26). Basis "code" means expected from the library code and documentation, not yet measured; "lab" means seen in the early lab sample.

| Component | Status | Basis | Note |
| --- | --- | --- | --- |
| [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) | none | code | No ApplePaySession: reports the plain value none. |
| [`audio`](https://whiskerjs.com/signals/audio/) | ok | code |   |
| [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) | ok | code | Read when the user agent says Android. |
| [`browser_class`](https://whiskerjs.com/signals/browser-class/) | ok | code | Class chromium. |
| [`canvas`](https://whiskerjs.com/signals/canvas/) | ok | code | noisy / render_mismatch if an extension or setting adds noise to readback. |
| [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) | ok | code |   |
| [`color_depth`](https://whiskerjs.com/signals/color-depth/) | ok | code |   |
| [`color_gamut`](https://whiskerjs.com/signals/color-gamut/) | ok | code |   |
| [`content_blockers`](https://whiskerjs.com/signals/content-blockers/) | ok | code | none, or the bait names a content blocker hid. |
| [`cpu_architecture`](https://whiskerjs.com/signals/cpu-architecture/) | ok | code |   |
| [`device_memory`](https://whiskerjs.com/signals/device-memory/) | ok | code |   |
| [`dynamic_range`](https://whiskerjs.com/signals/dynamic-range/) | ok | code |   |
| [`font_preferences`](https://whiskerjs.com/signals/font-preferences/) | ok | code |   |
| [`fonts`](https://whiskerjs.com/signals/fonts/) | ok | code |   |
| [`fonts_canvas`](https://whiskerjs.com/signals/fonts-canvas/) | ok | code |   |
| [`forced_colors`](https://whiskerjs.com/signals/forced-colors/) | ok | code |   |
| [`hardware_concurrency`](https://whiskerjs.com/signals/hardware-concurrency/) | ok | code | Some browsers cap or round the value. |
| [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) | ok | code |   |
| [`intl_locale`](https://whiskerjs.com/signals/intl-locale/) | ok | code |   |
| [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) | varies | code | Chromium API meant for physical keyboards; on Android expect unavailable. |
| [`languages`](https://whiskerjs.com/signals/languages/) | ok | code |   |
| [`math`](https://whiskerjs.com/signals/math/) | ok | code |   |
| [`media_codecs`](https://whiskerjs.com/signals/media-codecs/) | ok | code |   |
| [`pdf_viewer`](https://whiskerjs.com/signals/pdf-viewer/) | ok | code |   |
| [`permissions`](https://whiskerjs.com/signals/permissions/) | ok | code |   |
| [`pixel_ratio`](https://whiskerjs.com/signals/pixel-ratio/) | ok | code |   |
| [`platform`](https://whiskerjs.com/signals/platform/) | ok | code |   |
| [`plugins`](https://whiskerjs.com/signals/plugins/) | varies | code | Mobile builds often list no plugins and then report the plain value none. |
| [`prefers_contrast`](https://whiskerjs.com/signals/prefers-contrast/) | ok | code |   |
| [`private_click`](https://whiskerjs.com/signals/private-click/) | none | code | No attributionSourceId on anchors: reports the plain value none. |
| [`reduced_motion`](https://whiskerjs.com/signals/reduced-motion/) | ok | code |   |
| [`screen_frame`](https://whiskerjs.com/signals/screen-frame/) | ok | code |   |
| [`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/) | ok | code |   |
| [`speech_voices`](https://whiskerjs.com/signals/speech-voices/) | ok | code | Digest of the voice list, or none; some browsers fill the list late. |
| [`storage`](https://whiskerjs.com/signals/storage/) | ok | code |   |
| [`time_zone`](https://whiskerjs.com/signals/time-zone/) | ok | code |   |
| [`touch_support`](https://whiskerjs.com/signals/touch-support/) | ok | code |   |
| [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) | ok | code | he=blocked when a Permissions Policy refuses the detailed hints. |
| [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) | ok | code |   |
| [`vendor`](https://whiskerjs.com/signals/vendor/) | ok | code |   |
| [`vendor_flavors`](https://whiskerjs.com/signals/vendor-flavors/) | ok | code |   |
| [`webgl_image`](https://whiskerjs.com/signals/webgl-image/) | ok | code | noisy / render_mismatch if an extension or setting adds noise to readback. |
| [`webgl_params`](https://whiskerjs.com/signals/webgl-params/) | ok | code | Where WebGL 1 is available; unavailable / no_context without it. |
| [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/) | ok | code |   |
| [`webgl_vendor`](https://whiskerjs.com/signals/webgl-vendor/) | ok | code |   |
| [`webgpu`](https://whiskerjs.com/signals/webgpu/) | varies | code | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |

## Questions and answers

### Does WhiskerJS have Samsung-specific code?

Only one thing: vendor_flavors checks whether a global named samsungAr exists, as one of ten browser-specific globals. Everything else is the same code as for any Chromium browser.

### Is anything excluded in Samsung Internet?

No. It is classed chromium, whose exclusion row is empty.

### Is there lab data for Samsung Internet?

No. The early lab sample covered Mac Chrome, Mac Safari, iPhone Chrome and iPhone Safari only.

## Related pages

- [Chrome on Android](https://whiskerjs.com/browsers/chrome-android/): The closest relative.
- [vendor_flavors](https://whiskerjs.com/signals/vendor-flavors/): The ten browser-specific globals.
- [audio_latency](https://whiskerjs.com/signals/audio-latency/): Read on Android user agents.
- [touch_support](https://whiskerjs.com/signals/touch-support/): Touch points and touch events.
- [Browser support matrix](https://whiskerjs.com/browsers/support-matrix/): All browsers side by side.


---

# Browser support matrix

> The expected status of every component in nine browser families at signalsVersion 5, rendered from one data file.

Source: https://whiskerjs.com/browsers/support-matrix/ (last updated 2026-10-26)

> **In plain words:**
>
> Not every browser offers every measurement. Some lack the API, some randomise it on purpose, and some only offer it in certain modes. This table shows, for each of the 46 WhiskerJS signals, what to expect in nine browser families. It is filled from the library’s code and documentation plus one small early lab sample, so treat it as expectations, not measurements.

## How to read it

- **ok**: the value is read. **none**: read, but here the plain value is `none` (for example no Apple Pay outside Safari). **unavailable**: the browser does not offer the API, or WhiskerJS skips it here on purpose. **excluded**: the [exclusion table](https://whiskerjs.com/docs/how-it-works/#the-exclusion-table) removes it for this browser class. **varies**: depends on version, settings, a private window, an extension or the device.
- Cells marked **lab** were seen in the early lab sample (signalsVersion 1, four device and browser pairs, not a benchmark). Every other cell is expected behaviour from the code and documentation, not yet measured.
- In any browser a component can also be `noisy`, `blocked` or `timed_out` on a given run; see [Statuses and reason codes](https://whiskerjs.com/docs/how-it-works/#statuses-and-reason-codes).

## Where the data comes from

The page is rendered from one file in the site repository, `data/support-matrix.json`. It holds the browser list, one row per component and one cell per browser (status, basis and a short note). It will be refreshed from aggregated diagnostics once those exist; updating that file updates this page and the table at the end of every [browser page](https://whiskerjs.com/browsers/), with no code change.

## The matrix

46 components by 9 browser families, signalsVersion 5, updated 2026-10-26. Scroll sideways on a small screen. Notes for individual cells follow the table.

| Component | Group | [Chrome (desktop)](https://whiskerjs.com/browsers/chrome-desktop/) | [Chrome on Android](https://whiskerjs.com/browsers/chrome-android/) | [Safari on macOS](https://whiskerjs.com/browsers/safari-macos/) | [Safari and every iOS browser](https://whiskerjs.com/browsers/safari-ios/) | [Firefox](https://whiskerjs.com/browsers/firefox/) | [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/) | [Brave](https://whiskerjs.com/browsers/brave/) | [Microsoft Edge](https://whiskerjs.com/browsers/edge/) | [Samsung Internet](https://whiskerjs.com/browsers/samsung-internet/) |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [`apple_pay`](https://whiskerjs.com/signals/apple-pay/) | browser | none * | none * | ok * | varies * | none * | none * | none * | none * | none * |
| [`audio`](https://whiskerjs.com/signals/audio/) | audio | ok | ok | ok * | ok * | ok | ok | excluded * | ok | ok |
| [`audio_latency`](https://whiskerjs.com/signals/audio-latency/) | outside the ids | unavailable * | ok * | ok * | ok * | varies * | varies * | varies * | unavailable * | ok * |
| [`browser_class`](https://whiskerjs.com/signals/browser-class/) | browser | ok * | ok * | ok * | ok * | ok * | ok * | ok * | ok * | ok * |
| [`canvas`](https://whiskerjs.com/signals/canvas/) | gpu | ok * | ok * | varies * | varies * | ok * | excluded * | excluded * | ok * | ok * |
| [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) | outside the ids | ok * | ok | varies * | varies * | ok | varies * | varies * | ok | ok |
| [`color_depth`](https://whiskerjs.com/signals/color-depth/) | device | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`color_gamut`](https://whiskerjs.com/signals/color-gamut/) | prefs | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`content_blockers`](https://whiskerjs.com/signals/content-blockers/) | outside the ids | ok * | ok * | ok * | ok * | ok * | ok * | ok * | ok * | ok * |
| [`cpu_architecture`](https://whiskerjs.com/signals/cpu-architecture/) | device | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`device_memory`](https://whiskerjs.com/signals/device-memory/) | device | ok (lab) * | ok | unavailable (lab) * | unavailable (lab) * | unavailable * | unavailable * | varies * | ok | ok |
| [`dynamic_range`](https://whiskerjs.com/signals/dynamic-range/) | prefs | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`font_preferences`](https://whiskerjs.com/signals/font-preferences/) | fonts | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`fonts`](https://whiskerjs.com/signals/fonts/) | fonts | ok | ok | ok | ok | ok | ok * | excluded * | ok | ok |
| [`fonts_canvas`](https://whiskerjs.com/signals/fonts-canvas/) | fonts | ok | ok | ok | ok | ok | ok * | excluded * | ok | ok |
| [`forced_colors`](https://whiskerjs.com/signals/forced-colors/) | prefs | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`hardware_concurrency`](https://whiskerjs.com/signals/hardware-concurrency/) | device | ok * | ok * | ok * | ok * | ok * | excluded * | excluded * | ok * | ok * |
| [`heap_limit`](https://whiskerjs.com/signals/heap-limit/) | device | ok | ok | unavailable * | unavailable * | unavailable * | unavailable * | ok | ok | ok |
| [`intl_locale`](https://whiskerjs.com/signals/intl-locale/) | locale | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`keyboard_layout`](https://whiskerjs.com/signals/keyboard-layout/) | outside the ids | ok * | varies * | unavailable * | unavailable * | unavailable * | unavailable * | varies * | ok * | varies * |
| [`languages`](https://whiskerjs.com/signals/languages/) | locale | ok | ok | ok | ok | ok | ok * | ok | ok | ok |
| [`math`](https://whiskerjs.com/signals/math/) | browser | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`media_codecs`](https://whiskerjs.com/signals/media-codecs/) | browser | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`pdf_viewer`](https://whiskerjs.com/signals/pdf-viewer/) | browser | ok | ok | ok | varies * | ok | ok | ok | ok | ok |
| [`permissions`](https://whiskerjs.com/signals/permissions/) | outside the ids | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`pixel_ratio`](https://whiskerjs.com/signals/pixel-ratio/) | outside the ids | ok | ok | ok | ok | ok | excluded * | ok | ok | ok |
| [`platform`](https://whiskerjs.com/signals/platform/) | browser | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`plugins`](https://whiskerjs.com/signals/plugins/) | browser | ok | varies * | ok | varies * | ok | ok | excluded * | ok | varies * |
| [`prefers_contrast`](https://whiskerjs.com/signals/prefers-contrast/) | prefs | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`private_click`](https://whiskerjs.com/signals/private-click/) | browser | none * | none * | ok * | varies * | none * | none * | none * | none * | none * |
| [`reduced_motion`](https://whiskerjs.com/signals/reduced-motion/) | prefs | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`screen_frame`](https://whiskerjs.com/signals/screen-frame/) | outside the ids | ok | ok | ok | ok | ok | excluded * | ok | ok | ok |
| [`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/) | device | ok | ok | ok | ok | ok | excluded * | ok | ok | ok |
| [`speech_voices`](https://whiskerjs.com/signals/speech-voices/) | outside the ids | ok * | ok * | ok * | ok * | ok * | varies * | ok * | ok * | ok * |
| [`storage`](https://whiskerjs.com/signals/storage/) | browser | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`time_zone`](https://whiskerjs.com/signals/time-zone/) | locale | ok | ok | ok | ok | ok | excluded * | ok | ok | ok |
| [`touch_support`](https://whiskerjs.com/signals/touch-support/) | device | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) | browser | ok * | ok * | unavailable * | unavailable * | unavailable * | unavailable * | ok * | ok * | ok * |
| [`ua_versions`](https://whiskerjs.com/signals/ua-versions/) | outside the ids | ok | ok | unavailable * | unavailable * | unavailable * | unavailable * | ok * | ok | ok |
| [`vendor`](https://whiskerjs.com/signals/vendor/) | browser | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`vendor_flavors`](https://whiskerjs.com/signals/vendor-flavors/) | browser | ok | ok | ok | ok | ok | ok | ok | ok | ok |
| [`webgl_image`](https://whiskerjs.com/signals/webgl-image/) | gpu | ok * | ok * | varies * | varies * | ok * | excluded * | excluded * | ok * | ok * |
| [`webgl_params`](https://whiskerjs.com/signals/webgl-params/) | gpu | ok * | ok * | ok * | ok * | ok * | ok * | ok * | ok * | ok * |
| [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/) | gpu | ok | ok | ok * | ok * | ok * | excluded * | ok | ok | ok |
| [`webgl_vendor`](https://whiskerjs.com/signals/webgl-vendor/) | gpu | ok | ok | ok | ok | ok * | excluded * | ok | ok | ok |
| [`webgpu`](https://whiskerjs.com/signals/webgpu/) | gpu | varies * | varies * | varies * | varies * | varies * | varies * | varies * | varies * | varies * |

Filled on 2026-10-26 from the WhiskerJS code and documentation at signalsVersion 5 (expected behaviour) and from the early lab sample at signalsVersion 1 (four device-browser pairs). It is not a measurement. It will be refreshed from aggregated diagnostics once those exist; this file is the only place to change.

## Notes on individual cells

Every cell marked with * above, by component.

| Component | Browser | Status | Note |
| --- | --- | --- | --- |
| `apple_pay` | Chrome (desktop) | none | No ApplePaySession: reports the plain value none. |
| `apple_pay` | Chrome on Android | none | No ApplePaySession: reports the plain value none. |
| `apple_pay` | Safari on macOS | ok | version=<n>;can_pay=<1, 0 or blocked>; can_pay is blocked in insecure or cross-origin contexts. |
| `apple_pay` | Safari and every iOS browser | varies | Safari has ApplePaySession; in other iOS browsers it depends on the app. none where it is missing. |
| `apple_pay` | Firefox | none | No ApplePaySession: reports the plain value none. |
| `apple_pay` | Firefox resistFingerprinting and Tor Browser | none | No ApplePaySession: reports the plain value none. |
| `apple_pay` | Brave | none | No ApplePaySession: reports the plain value none. |
| `apple_pay` | Microsoft Edge | none | No ApplePaySession: reports the plain value none. |
| `apple_pay` | Samsung Internet | none | No ApplePaySession: reports the plain value none. |
| `audio` | Safari on macOS | ok | No double render for audio: noise added to audio reads would change the digest each run. |
| `audio` | Safari and every iOS browser | ok | No double render for audio: noise added to audio reads would change the digest each run. |
| `audio` | Brave | excluded | Exclusion table: brave_farbling (Brave adds per-site, per-session noise). |
| `audio_latency` | Chrome (desktop) | unavailable | Skipped (unavailable / skipped): creating an AudioContext here would print a console warning. |
| `audio_latency` | Chrome on Android | ok | Read when the user agent says Android. |
| `audio_latency` | Safari on macOS | ok | Read for browser class safari; the context is closed at once. |
| `audio_latency` | Safari and every iOS browser | ok | Read for browser class safari; the context is closed at once. |
| `audio_latency` | Firefox | varies | Skipped on desktop; Firefox for Android has an Android user agent, so it is read there. |
| `audio_latency` | Firefox resistFingerprinting and Tor Browser | varies | Skipped on desktop; read only with an Android user agent. |
| `audio_latency` | Brave | varies | Read on Android (Android user agent), skipped on desktop. |
| `audio_latency` | Microsoft Edge | unavailable | Skipped (unavailable / skipped): creating an AudioContext here would print a console warning. |
| `audio_latency` | Samsung Internet | ok | Read when the user agent says Android. |
| `browser_class` | Chrome (desktop) | ok | Class chromium. |
| `browser_class` | Chrome on Android | ok | Class chromium. |
| `browser_class` | Safari on macOS | ok | Class safari. |
| `browser_class` | Safari and every iOS browser | ok | Class safari, for every iOS browser (Apple vendor, no Chrome/ token). |
| `browser_class` | Firefox | ok | Class firefox. |
| `browser_class` | Firefox resistFingerprinting and Tor Browser | ok | Class firefox_rfp only when every resistFingerprinting trait holds; otherwise firefox. |
| `browser_class` | Brave | ok | Class brave (navigator.brave.isBrave is a function). |
| `browser_class` | Microsoft Edge | ok | Class chromium. |
| `browser_class` | Samsung Internet | ok | Class chromium. |
| `canvas` | Chrome (desktop) | ok | noisy / render_mismatch if an extension or setting adds noise to readback. |
| `canvas` | Chrome on Android | ok | noisy / render_mismatch if an extension or setting adds noise to readback. |
| `canvas` | Safari on macOS | varies | Apple describes fingerprinting protections that can add noise to readback in some modes (for example private browsing); WhiskerJS reports noisy / render_mismatch when the double render differs. |
| `canvas` | Safari and every iOS browser | varies | Apple describes fingerprinting protections that can add noise to readback in some modes (for example private browsing); WhiskerJS reports noisy / render_mismatch when the double render differs. |
| `canvas` | Firefox | ok | noisy / render_mismatch if an extension or setting adds noise to readback. |
| `canvas` | Firefox resistFingerprinting and Tor Browser | excluded | Exclusion table: firefox_rfp (fixed or normalised values). |
| `canvas` | Brave | excluded | Exclusion table: brave_farbling (Brave adds per-site, per-session noise). |
| `canvas` | Microsoft Edge | ok | noisy / render_mismatch if an extension or setting adds noise to readback. |
| `canvas` | Samsung Internet | ok | noisy / render_mismatch if an extension or setting adds noise to readback. |
| `canvas_readback` | Chrome (desktop) | ok | exact, or altered when an extension adds noise. |
| `canvas_readback` | Safari on macOS | varies | exact, or altered where readback noise is applied. |
| `canvas_readback` | Safari and every iOS browser | varies | exact, or altered where readback noise is applied. |
| `canvas_readback` | Firefox resistFingerprinting and Tor Browser | varies | resistFingerprinting changes canvas readback, so altered is likely. |
| `canvas_readback` | Brave | varies | Not excluded; Brave's canvas farbling can make it report altered. |
| `content_blockers` | Chrome (desktop) | ok | none, or the bait names a content blocker hid. |
| `content_blockers` | Chrome on Android | ok | none, or the bait names a content blocker hid. |
| `content_blockers` | Safari on macOS | ok | none, or the bait names a content blocker hid. |
| `content_blockers` | Safari and every iOS browser | ok | none, or the bait names a content blocker hid. |
| `content_blockers` | Firefox | ok | none, or the bait names a content blocker hid. |
| `content_blockers` | Firefox resistFingerprinting and Tor Browser | ok | none, or the bait names a content blocker hid. |
| `content_blockers` | Brave | ok | Brave's built-in blocking may hide some baits; reports the hidden bait names or none. |
| `content_blockers` | Microsoft Edge | ok | none, or the bait names a content blocker hid. |
| `content_blockers` | Samsung Internet | ok | none, or the bait names a content blocker hid. |
| `device_memory` | Chrome (desktop) | ok (lab) | Seen ok on Mac Chrome in the lab sample. |
| `device_memory` | Safari on macOS | unavailable (lab) | Seen unavailable on Mac Safari in the lab sample; Safari does not offer navigator.deviceMemory. |
| `device_memory` | Safari and every iOS browser | unavailable (lab) | Seen unavailable on iPhone Safari and iPhone Chrome in the lab sample; no iOS browser offers it. |
| `device_memory` | Firefox | unavailable | navigator.deviceMemory is a Chromium API. Reports unavailable / no_api. |
| `device_memory` | Firefox resistFingerprinting and Tor Browser | unavailable | navigator.deviceMemory is a Chromium API. Reports unavailable / no_api. |
| `device_memory` | Brave | varies | Chromium API; Brave's fingerprinting protections may change the value. |
| `fonts` | Firefox resistFingerprinting and Tor Browser | ok | Tor Browser limits fonts to a bundled set, so values are alike across its users. |
| `fonts` | Brave | excluded | Exclusion table: brave_farbling (Brave adds per-site, per-session noise). |
| `fonts_canvas` | Firefox resistFingerprinting and Tor Browser | ok | Tor Browser limits fonts to a bundled set, so values are alike across its users. |
| `fonts_canvas` | Brave | excluded | Exclusion table: brave_farbling (Brave adds per-site, per-session noise). |
| `hardware_concurrency` | Chrome (desktop) | ok | Some browsers cap or round the value. |
| `hardware_concurrency` | Chrome on Android | ok | Some browsers cap or round the value. |
| `hardware_concurrency` | Safari on macOS | ok | Some browsers cap or round the value. |
| `hardware_concurrency` | Safari and every iOS browser | ok | Some browsers cap or round the value. |
| `hardware_concurrency` | Firefox | ok | Some browsers cap or round the value. |
| `hardware_concurrency` | Firefox resistFingerprinting and Tor Browser | excluded | Exclusion table: firefox_rfp (fixed or normalised values). |
| `hardware_concurrency` | Brave | excluded | Exclusion table: brave_farbling (Brave adds per-site, per-session noise). |
| `hardware_concurrency` | Microsoft Edge | ok | Some browsers cap or round the value. |
| `hardware_concurrency` | Samsung Internet | ok | Some browsers cap or round the value. |
| `heap_limit` | Safari on macOS | unavailable | performance.memory is a Chromium API. Reports unavailable / no_api. |
| `heap_limit` | Safari and every iOS browser | unavailable | performance.memory is a Chromium API. Reports unavailable / no_api. |
| `heap_limit` | Firefox | unavailable | performance.memory is a Chromium API. Reports unavailable / no_api. |
| `heap_limit` | Firefox resistFingerprinting and Tor Browser | unavailable | performance.memory is a Chromium API. Reports unavailable / no_api. |
| `keyboard_layout` | Chrome (desktop) | ok | navigator.keyboard.getLayoutMap() is a Chromium desktop API; blocked in cross-origin iframes. |
| `keyboard_layout` | Chrome on Android | varies | Chromium API meant for physical keyboards; on Android expect unavailable. |
| `keyboard_layout` | Safari on macOS | unavailable | No navigator.keyboard here: unavailable / no_api. |
| `keyboard_layout` | Safari and every iOS browser | unavailable | No navigator.keyboard here: unavailable / no_api. |
| `keyboard_layout` | Firefox | unavailable | No navigator.keyboard here: unavailable / no_api. |
| `keyboard_layout` | Firefox resistFingerprinting and Tor Browser | unavailable | No navigator.keyboard here: unavailable / no_api. |
| `keyboard_layout` | Brave | varies | Chromium API; Brave may turn it off. |
| `keyboard_layout` | Microsoft Edge | ok | navigator.keyboard.getLayoutMap() is a Chromium desktop API; blocked in cross-origin iframes. |
| `keyboard_layout` | Samsung Internet | varies | Chromium API meant for physical keyboards; on Android expect unavailable. |
| `languages` | Firefox resistFingerprinting and Tor Browser | ok | resistFingerprinting can normalise the reported language. |
| `pdf_viewer` | Safari and every iOS browser | varies | unavailable where navigator.pdfViewerEnabled does not exist. |
| `pixel_ratio` | Firefox resistFingerprinting and Tor Browser | excluded | Exclusion table: firefox_rfp (fixed or normalised values). |
| `plugins` | Chrome on Android | varies | Mobile builds often list no plugins and then report the plain value none. |
| `plugins` | Safari and every iOS browser | varies | Mobile builds often list no plugins and then report the plain value none. |
| `plugins` | Brave | excluded | Exclusion table: brave_farbling (Brave adds per-site, per-session noise). |
| `plugins` | Samsung Internet | varies | Mobile builds often list no plugins and then report the plain value none. |
| `private_click` | Chrome (desktop) | none | No attributionSourceId on anchors: reports the plain value none. |
| `private_click` | Chrome on Android | none | No attributionSourceId on anchors: reports the plain value none. |
| `private_click` | Safari on macOS | ok | Safari Private Click Measurement exposes attributionSourceId. |
| `private_click` | Safari and every iOS browser | varies | Depends on whether the app's WebKit exposes Private Click Measurement; none otherwise. |
| `private_click` | Firefox | none | No attributionSourceId on anchors: reports the plain value none. |
| `private_click` | Firefox resistFingerprinting and Tor Browser | none | No attributionSourceId on anchors: reports the plain value none. |
| `private_click` | Brave | none | No attributionSourceId on anchors: reports the plain value none. |
| `private_click` | Microsoft Edge | none | No attributionSourceId on anchors: reports the plain value none. |
| `private_click` | Samsung Internet | none | No attributionSourceId on anchors: reports the plain value none. |
| `screen_frame` | Firefox resistFingerprinting and Tor Browser | excluded | Exclusion table: firefox_rfp (fixed or normalised values). |
| `screen_resolution` | Firefox resistFingerprinting and Tor Browser | excluded | Exclusion table: firefox_rfp (fixed or normalised values). |
| `speech_voices` | Chrome (desktop) | ok | Digest of the voice list, or none; some browsers fill the list late. |
| `speech_voices` | Chrome on Android | ok | Digest of the voice list, or none; some browsers fill the list late. |
| `speech_voices` | Safari on macOS | ok | Digest of the voice list, or none; some browsers fill the list late. |
| `speech_voices` | Safari and every iOS browser | ok | Digest of the voice list, or none; some browsers fill the list late. |
| `speech_voices` | Firefox | ok | Digest of the voice list, or none; some browsers fill the list late. |
| `speech_voices` | Firefox resistFingerprinting and Tor Browser | varies | Digest of the voice list, or none when the list is empty. |
| `speech_voices` | Brave | ok | Digest of the voice list, or none; some browsers fill the list late. |
| `speech_voices` | Microsoft Edge | ok | Digest of the voice list, or none; some browsers fill the list late. |
| `speech_voices` | Samsung Internet | ok | Digest of the voice list, or none; some browsers fill the list late. |
| `time_zone` | Firefox resistFingerprinting and Tor Browser | excluded | Exclusion table: firefox_rfp (fixed or normalised values). |
| `ua_client_hints` | Chrome (desktop) | ok | he=blocked when a Permissions Policy refuses the detailed hints. |
| `ua_client_hints` | Chrome on Android | ok | he=blocked when a Permissions Policy refuses the detailed hints. |
| `ua_client_hints` | Safari on macOS | unavailable | navigator.userAgentData (Client Hints) is a Chromium API. Reports unavailable / no_api. |
| `ua_client_hints` | Safari and every iOS browser | unavailable | navigator.userAgentData (Client Hints) is a Chromium API. Reports unavailable / no_api. |
| `ua_client_hints` | Firefox | unavailable | navigator.userAgentData (Client Hints) is a Chromium API. Reports unavailable / no_api. |
| `ua_client_hints` | Firefox resistFingerprinting and Tor Browser | unavailable | navigator.userAgentData (Client Hints) is a Chromium API. Reports unavailable / no_api. |
| `ua_client_hints` | Brave | ok | Chromium API; the brand list is whatever Brave reports. |
| `ua_client_hints` | Microsoft Edge | ok | he=blocked when a Permissions Policy refuses the detailed hints. |
| `ua_client_hints` | Samsung Internet | ok | he=blocked when a Permissions Policy refuses the detailed hints. |
| `ua_versions` | Safari on macOS | unavailable | navigator.userAgentData (Client Hints) is a Chromium API. Reports unavailable / no_api. |
| `ua_versions` | Safari and every iOS browser | unavailable | navigator.userAgentData (Client Hints) is a Chromium API. Reports unavailable / no_api. |
| `ua_versions` | Firefox | unavailable | navigator.userAgentData (Client Hints) is a Chromium API. Reports unavailable / no_api. |
| `ua_versions` | Firefox resistFingerprinting and Tor Browser | unavailable | navigator.userAgentData (Client Hints) is a Chromium API. Reports unavailable / no_api. |
| `ua_versions` | Brave | ok | Chromium API; not in either id. |
| `webgl_image` | Chrome (desktop) | ok | noisy / render_mismatch if an extension or setting adds noise to readback. |
| `webgl_image` | Chrome on Android | ok | noisy / render_mismatch if an extension or setting adds noise to readback. |
| `webgl_image` | Safari on macOS | varies | Apple describes fingerprinting protections that can add noise to readback in some modes (for example private browsing); WhiskerJS reports noisy / render_mismatch when the double render differs. |
| `webgl_image` | Safari and every iOS browser | varies | Apple describes fingerprinting protections that can add noise to readback in some modes (for example private browsing); WhiskerJS reports noisy / render_mismatch when the double render differs. |
| `webgl_image` | Firefox | ok | noisy / render_mismatch if an extension or setting adds noise to readback. |
| `webgl_image` | Firefox resistFingerprinting and Tor Browser | excluded | Exclusion table: firefox_rfp (fixed or normalised values). |
| `webgl_image` | Brave | excluded | Exclusion table: brave_farbling (Brave adds per-site, per-session noise). |
| `webgl_image` | Microsoft Edge | ok | noisy / render_mismatch if an extension or setting adds noise to readback. |
| `webgl_image` | Samsung Internet | ok | noisy / render_mismatch if an extension or setting adds noise to readback. |
| `webgl_params` | Chrome (desktop) | ok | Where WebGL 1 is available; unavailable / no_context without it. |
| `webgl_params` | Chrome on Android | ok | Where WebGL 1 is available; unavailable / no_context without it. |
| `webgl_params` | Safari on macOS | ok | Where WebGL 1 is available; unavailable / no_context without it. |
| `webgl_params` | Safari and every iOS browser | ok | Where WebGL 1 is available; unavailable / no_context without it. |
| `webgl_params` | Firefox | ok | Where WebGL 1 is available; unavailable / no_context without it. |
| `webgl_params` | Firefox resistFingerprinting and Tor Browser | ok | Where WebGL 1 is available; unavailable / no_context without it. |
| `webgl_params` | Brave | ok | Where WebGL 1 is available; unavailable / no_context without it. |
| `webgl_params` | Microsoft Edge | ok | Where WebGL 1 is available; unavailable / no_context without it. |
| `webgl_params` | Samsung Internet | ok | Where WebGL 1 is available; unavailable / no_context without it. |
| `webgl_renderer` | Safari on macOS | ok | Often a generic string such as Apple GPU. |
| `webgl_renderer` | Safari and every iOS browser | ok | Often a generic string such as Apple GPU. |
| `webgl_renderer` | Firefox | ok | Read from gl.RENDERER; WEBGL_debug_renderer_info is not requested in Firefox. |
| `webgl_renderer` | Firefox resistFingerprinting and Tor Browser | excluded | Exclusion table: firefox_rfp (fixed or normalised values). |
| `webgl_vendor` | Firefox | ok | Read from gl.VENDOR; WEBGL_debug_renderer_info is not requested in Firefox. |
| `webgl_vendor` | Firefox resistFingerprinting and Tor Browser | excluded | Exclusion table: firefox_rfp (fixed or normalised values). |
| `webgpu` | Chrome (desktop) | varies | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |
| `webgpu` | Chrome on Android | varies | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |
| `webgpu` | Safari on macOS | varies | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |
| `webgpu` | Safari and every iOS browser | varies | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |
| `webgpu` | Firefox | varies | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |
| `webgpu` | Firefox resistFingerprinting and Tor Browser | varies | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |
| `webgpu` | Brave | varies | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |
| `webgpu` | Microsoft Edge | varies | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |
| `webgpu` | Samsung Internet | varies | Depends on browser version, operating system and GPU; needs a secure context. unavailable / no_api without navigator.gpu, no_context without an adapter. |

## Questions and answers

### Is this matrix measured?

Not yet. Almost every cell is expected behaviour read from the library code and documentation. Only the cells marked lab come from the early lab sample at signalsVersion 1, which covered four device and browser pairs. The matrix will be refreshed from aggregated diagnostics.

### Why do all iOS browsers share one column?

On iOS every browser uses Apple's WebKit engine and reports the Apple vendor, so WhiskerJS classes Chrome, Firefox and Edge on iOS as safari, the same as Safari itself.

### What does varies mean?

The status depends on the browser version, a setting, a private window, an extension or the device. The note on that row says what it depends on.

## Related pages

- [Browsers](https://whiskerjs.com/browsers/): One page per browser family, with what works and what is excluded.
- [The exclusion table](https://whiskerjs.com/docs/how-it-works/#the-exclusion-table): Why Brave and Firefox resistFingerprinting skip some components.
- [Signals](https://whiskerjs.com/signals/): Every component on its own page.
- [Live demo](https://whiskerjs.com/demo/): See the real statuses in your own browser.


---

# Use cases

> Where device signals help, which parts of the WhiskerJS result matter for each problem, and what your server still has to decide.

Source: https://whiskerjs.com/use-cases/ (last updated 2026-10-26)

> **In plain words:**
>
> Fraud and abuse often come down to one question: is this the same device we saw before, or a device that is trying hard to look like someone else? WhiskerJS measures the browser and device and hands you the result. It never says “fraud” or “not fraud”. These pages show, problem by problem, which parts of that result are worth looking at and what your own server has to do with them.

## The parts of a result you will use

Every use case below draws on the same four parts of one `collect()` result:

| Part | What it gives you | Read more |
| --- | --- | --- |
| `visitorId` | one 128-bit hash over the 37 stable components: an exact-match key for a browser setup | [Identifiers](https://whiskerjs.com/docs/identifiers/#visitorid) |
| `structuredId` | seven short hashes, one per signal group, so you can see which part of a device changed | [Comparing two results](https://whiskerjs.com/docs/identifiers/#comparing-two-results) |
| `integrityFlags` | names of checks that saw signs of automation or changed browser functions | [Integrity checks](https://whiskerjs.com/docs/integrity/#the-flags) |
| `binding` | your server’s nonce and timestamp, bound to the result with a digest, so an old result cannot be replayed | [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding) |

The 46 `components` are there too, each with a status and, when not `ok`, a reason code. They let you explain a decision later and compare devices signal by signal. See [Signals](https://whiskerjs.com/signals/).

## The problems

- [Fraud prevention](https://whiskerjs.com/use-cases/fraud-prevention/): Device signals as one input among many in a fraud decision.
- [Account takeover](https://whiskerjs.com/use-cases/account-takeover/): A known account, an unknown device: spotting the change at login.
- [Multi-accounting](https://whiskerjs.com/use-cases/multi-accounting/): Many accounts from one browser setup, and setups that only look different.
- [Bonus and promotion abuse](https://whiskerjs.com/use-cases/bonus-abuse/): Repeat claims of offers meant once per person.
- [Bot and headless detection](https://whiskerjs.com/use-cases/bot-detection/): Integrity flags as hints, with their known false positives.
- [Payment fraud](https://whiskerjs.com/use-cases/payment-fraud/): Device context at checkout, beside your payment provider's checks.

## What is the same in every case

- **Signals, not verdicts.** WhiskerJS has no scoring code. A rule or model on your server weighs the result together with account history, request headers, the IP address and velocity.
- **A browser setup, not a person.** Two identical devices with identical settings can share a visitorId, and one person with two browsers has two. Treat an id as evidence about a device, never as proof of who is behind it.
- **Anything from the client can be faked.** The integrity checks catch careless tools and the binding stops replay, but a determined attacker can send a hand-made result. Never let the result alone grant access or money. See [What never to trust from the client](https://whiskerjs.com/docs/integration/#what-never-to-trust-from-the-client).
- **Versions matter.** Compare ids only within the same `signalsVersion` and `idVersion`. Store both with every id.
- **Privacy still applies.** Device signals can be personal data. Read [Privacy and compliance](https://whiskerjs.com/privacy/) before you deploy.

## No accuracy figures yet

None of these pages gives detection rates, false-positive rates or uniqueness figures for WhiskerJS, because none has been measured. A head-to-head measurement against other libraries has not run yet. The only observations so far are an early, small sample at signalsVersion 1 (four device and browser pairs, each kept one id across a few runs), which is not a benchmark. Measure on your own traffic before you rely on any rule.

## Questions and answers

### Does WhiskerJS stop fraud on its own?

No. WhiskerJS is a collector: it returns signals, two identifiers and integrity flags. Your server combines them with what it already knows (accounts, history, request data) and makes the decision.

### Which use case should I start with?

Start where a device signal adds something you do not already have, usually at login or sign-up. Store the result per event first, look at your own traffic, then add rules.

### Are there accuracy figures for these use cases?

Not yet. No head-to-head measurement of WhiskerJS has run, so these pages describe what each part of the result means, not how well it performs.

## Related pages

- [Integration](https://whiskerjs.com/docs/integration/): Sending results to your server, storing ids, recommended checks.
- [Integrity checks](https://whiskerjs.com/docs/integrity/): Every flag, what it means and its false positives.
- [Identifiers](https://whiskerjs.com/docs/identifiers/): visitorId, structuredId and how to compare two results.
- [Guides](https://whiskerjs.com/guides/): Add WhiskerJS to a page and verify the binding on your server.


---

# Account takeover

> A correct password from an unfamiliar device: how device signals help your server notice it, and what to do next.

Source: https://whiskerjs.com/use-cases/account-takeover/ (last updated 2026-10-26)

> **In plain words:**
>
> In an account takeover someone else signs in with a real user’s password. The password is right, so the login looks normal. What often differs is the device. WhiskerJS lets your server see whether the device at this login looks like one the account has used before, and which part of it is new. Your server then decides whether to ask for more proof.

## The problem

Stolen or reused passwords let an attacker sign in as the user. Common patterns are credential stuffing (trying leaked username and password pairs at scale, usually with automation) and targeted takeovers (one account, a careful attacker, often a real browser). In both, the server sees a valid password. The useful question becomes: does this device fit the account?

## What WhiskerJS contributes

At the login submit, collect once and send the result with the login request:

```ts
import { load } from 'whiskerjs';

const agent = await load();

form.addEventListener('submit', async (event) => {
  event.preventDefault();
  const binding = await (await fetch('/api/whisker-nonce')).json();
  const device = await agent.collect({ timeoutMs: 3000, binding });
  await fetch('/api/login', {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ email: form.email.value, password: form.password.value, device }),
  });
});
```

Your server then has, next to the password check, a `visitorId` to look up in the account’s history, a `structuredId` to compare with the devices it knows, and the `integrityFlags` of this login.

## Signals and flags that matter

- **Known device or not**: an exact `visitorId` match with a device this account used before (same `idVersion` and `signalsVersion`).
- **Locale against network**: [`time_zone`](https://whiskerjs.com/signals/time-zone/) and [`languages`](https://whiskerjs.com/signals/languages/) against the IP address region and `Accept-Language`. A change can also mean the user is travelling.
- **Platform against headers**: [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/) and [`platform`](https://whiskerjs.com/signals/platform/) against the User-Agent header.
- **Automation**: [`automation_webdriver`](https://whiskerjs.com/docs/integrity/#automation_webdriver), [`automation_globals`](https://whiskerjs.com/docs/integrity/#automation_globals), [`headless_markers`](https://whiskerjs.com/docs/integrity/#headless_markers) and [`headless_user_agent`](https://whiskerjs.com/docs/integrity/#headless_user_agent) are typical of stuffing tools. Monitoring robots and your own tests set them too.
- **Spoofing**: [`iframe_mismatch`](https://whiskerjs.com/docs/integrity/#iframe_mismatch), [`navigator_own_property`](https://whiskerjs.com/docs/integrity/#navigator_own_property) and [`prototype_lie`](https://whiskerjs.com/docs/integrity/#prototype_lie) suggest values were overridden. Privacy extensions can cause the same.

## Using structuredId similarity

A user’s own device changes over time. A browser update moves the `browser` group; a GPU driver update moves `gpu`; a trip moves `locale`. An unknown device usually differs in most groups. Comparing group by group lets your rule tell these apart:

```ts
import { ID_GROUP_ORDER } from 'whiskerjs';

/** Groups that differ between two structuredIds, or null when not comparable. */
function changedGroups(a: string, b: string): string[] | null {
  const pa = a.split('_');
  const pb = b.split('_');
  if (pa[0] !== pb[0]) return null;
  return ID_GROUP_ORDER.filter((_, i) => pa[i + 1] !== pb[i + 1]);
}

// changedGroups(knownDevice, thisLogin)
// ['browser']                         -> reads like an update of a known device
// ['gpu', 'fonts', 'device', 'locale'] -> reads like a different device
```

These readings are hints from [Identifiers](https://whiskerjs.com/docs/identifiers/#comparing-two-results), not rules. How many changed groups you accept, and which ones, is a choice to tune on your own logins.

## Anti-replay

A takeover tool could replay a result recorded from the victim’s real browser. The binding prevents that: a nonce your server issued for this login, used once, recent, and a digest that still matches. A replayed result carries an old or unknown nonce. See [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding). Bind the nonce to the login form or session it was issued for, so one visitor’s nonce cannot be used by another.

## What must happen on your server

1. Check the password as usual. Device signals never replace it.
2. Verify the result’s shape and the binding.
3. Look the `visitorId` up in the account’s device history; if not found, compare the `structuredId` with known devices.
4. Combine with IP reputation, request headers, the time since the last login and the failed attempts on this account and from this network.
5. Choose a proportionate response: allow, ask for a second factor, notify the user, or block. A new device alone is a reason to ask for more, rarely a reason to block.
6. After a successful step-up, store the new device for the account, with both version numbers. When you ship a new WhiskerJS version, expect new ids and re-link them through a session you already trust.

## Limits

- A careful attacker in a real, clean browser can produce a perfectly ordinary result; the device check then only says “new device”.
- Users change devices, reinstall, use private windows or privacy browsers. Expect new ids from real users.
- Identical devices (a company fleet) can share an id, so a known id is not proof of a known person.
- No accuracy figures exist yet; measure your own false step-up rate before tightening rules.

## Questions and answers

### Should a new visitorId force a password reset?

Usually not on its own. A browser update or a new font can change the id. Compare the structuredId groups and your other signals first, then choose a proportionate step such as a second factor.

### What if the user signs in from a privacy browser?

Under Brave and Firefox resistFingerprinting some components are excluded, so devices look more alike. That is expected; rely more on the account's history and your second factor there.

### Can an attacker copy a victim's device result?

They can copy or build a result if they control a browser, which is why the binding stops replay of old results and why the device result should never be the only check.

## Related pages

- [Fraud prevention](https://whiskerjs.com/use-cases/fraud-prevention/): The general pattern behind every use case.
- [Bot and headless detection](https://whiskerjs.com/use-cases/bot-detection/): Credential-stuffing tools and the flags they leave.
- [What changes the id](https://whiskerjs.com/docs/identifiers/#what-changes-the-id): Updates, fonts, settings and private windows.
- [Verify the binding in Node](https://whiskerjs.com/guides/verify-node/): Server-side check of nonce, timestamp and digest.


---

# Bonus and promotion abuse

> Offers meant once per person, claimed again and again: how device signals help, and why the decision stays with you.

Source: https://whiskerjs.com/use-cases/bonus-abuse/ (last updated 2026-10-26)

> **In plain words:**
>
> Welcome bonuses, free trials, first-order coupons and referral rewards are meant to be claimed once. Some people claim them many times with new accounts. WhiskerJS describes the device each claim comes from, so your server can notice when many “new” customers share one browser setup. Whether that means refusing, holding or reviewing the reward is your decision.

## The problem

Promotion abuse is multi-accounting with a direct cost: every extra account earns the reward again. Typical forms are repeat sign-up bonuses, free trials restarted with new emails, single-use coupons used many times, and referral rewards where the referrer and the “friend” are the same person. Email addresses, phone numbers and IP addresses are easy to rotate; a whole device setup is harder.

## What WhiskerJS contributes

Collect at the moment the reward is decided, usually sign-up and the first qualifying action (first deposit, first order, trial start). Each result gives a `visitorId` to count claims per device, a `structuredId` to catch setups that changed only a little, and `integrityFlags` that may point at tooling.

## Signals and flags that matter

- The stable groups that people rarely change between accounts: `gpu`, `fonts` and `device`. See [Signals](https://whiskerjs.com/signals/).
- [`browser_class`](https://whiskerjs.com/signals/browser-class/) and the `browser` group, which change when someone switches browser on the same machine while the other groups stay.
- Signs of fingerprint-varying tools: `noisy` canvas or WebGL components, [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) `altered`, [`prototype_lie`](https://whiskerjs.com/docs/integrity/#prototype_lie), [`iframe_mismatch`](https://whiskerjs.com/docs/integrity/#iframe_mismatch). Privacy extensions can cause the same results, so these are reasons to look closer, not proof.
- Automation flags on sign-up: [`automation_webdriver`](https://whiskerjs.com/docs/integrity/#automation_webdriver) and [`automation_globals`](https://whiskerjs.com/docs/integrity/#automation_globals) point at scripted account creation.

## Using structuredId similarity

Someone who opens a private window, changes the language or tries a second browser changes some groups and leaves others. A claim rule can look at the strongest groups:

```ts
import { ID_GROUP_ORDER } from 'whiskerjs';

interface PriorClaim { account: string; structuredId: string }

/** Earlier claims whose structuredId shares every listed group with this one. */
function similarClaims(current: string, prior: PriorClaim[], groups = ['gpu', 'fonts', 'device']): PriorClaim[] {
  const cur = current.split('_');
  return prior.filter((p) => {
    const parts = p.structuredId.split('_');
    if (parts[0] !== cur[0]) return false;            // only the same idVersion
    return groups.every((g) => {
      const i = ID_GROUP_ORDER.indexOf(g) + 1;
      return parts[i] === cur[i];
    });
  });
}
```

The group list is an example. Common device models with default settings share many groups, so measure how often legitimate customers match before you use it.

## Anti-replay

A claim script can capture one result and reuse it for every new account. Bind each result to a nonce your server issued for that sign-up or claim, accept it once and only while it is recent. See [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding) and the [Node](https://whiskerjs.com/guides/verify-node/) guide.

## What must happen on your server

1. Decide the reward with your own rules: device links, payment instruments, addresses, timing between sign-up and claim, referral graph.
2. Prefer proportionate outcomes: hold for review, require verification, or limit the reward, rather than refusing on the device link alone. Households, students in shared housing and office machines share devices.
3. Never let the device result alone release money or credit.
4. Keep the stored data to what the rule needs and for as long as the promotion and its review period require.
5. Compare only within the same `idVersion` and `signalsVersion`.

## Limits

- Separate devices defeat device linking. So do enough changes to one device.
- Privacy browsers make devices more alike by design; expect more matches among their users.
- A shared id can be an innocent household. Explain your rule in your terms and in your privacy notice.
- No figures on how many repeat claims WhiskerJS finds have been measured.

## Questions and answers

### Should I refuse a bonus when the device was seen before?

That is a business decision. Many sites hold the reward for review, or ask for extra verification, rather than refuse outright, because households and shared devices are common.

### Do referral rings show up in the device data?

Sometimes: the referrer and the referred accounts may share a visitorId or several structuredId groups. Combine that with payment and timing links before you act.

### Does WhiskerJS know my promotion rules?

No. It knows nothing about accounts or offers. It returns device signals; your server applies the rules.

## Related pages

- [Multi-accounting](https://whiskerjs.com/use-cases/multi-accounting/): Linking accounts by browser setup.
- [Payment fraud](https://whiskerjs.com/use-cases/payment-fraud/): Device context at checkout.
- [Storing ids](https://whiskerjs.com/docs/integration/#storing-ids): What to store per event and how to index it.
- [What a privacy notice should say](https://whiskerjs.com/privacy/privacy-notice/): Telling users about device checks.


---

# Bot and headless detection

> Fourteen read-only checks that hint at automation or tampering: how to read them, and why they are hints, not verdicts.

Source: https://whiskerjs.com/use-cases/bot-detection/ (last updated 2026-10-26)

> **In plain words:**
>
> Bots are programs that use websites like people do: signing up, logging in, buying stock. Many run in a “headless” browser with no screen. WhiskerJS runs fourteen quick checks for traces such tools leave and lists the ones that fired. A fired check is a hint worth weighing; no fired check does not mean a human.

## The problem

Automated traffic ranges from your own monitoring and tests, through scrapers, to credential stuffing and scripted sign-ups. Simple tools leave obvious traces (`navigator.webdriver` set, a `HeadlessChrome` user agent). Better tools hide them and override browser values to look ordinary, which leaves other traces: functions that are no longer native, values that differ between the page and a fresh frame.

## What WhiskerJS contributes

`result.integrityFlags` is a sorted list of the checks that fired. They run after the collectors, read only, and never write to the page; a check that throws simply does not fire. Two of them compare against a fresh, hidden `about:blank` iframe that is removed at once (see [the clean iframe realm](https://whiskerjs.com/docs/how-it-works/#the-clean-iframe-realm)).

## Signals and flags that matter

| Flag | Fires when (short) | Known false positives |
| --- | --- | --- |
| [`automation_webdriver`](https://whiskerjs.com/docs/integrity/#automation_webdriver) | `navigator.webdriver` is true | your own end-to-end tests, accessibility scanners, monitoring robots |
| [`automation_globals`](https://whiskerjs.com/docs/integrity/#automation_globals) | a global or attribute left by a known automation tool | a page script that happens to use one of the names (rare) |
| [`headless_user_agent`](https://whiskerjs.com/docs/integrity/#headless_user_agent) | `HeadlessChrome`, `PhantomJS` or `SlimerJS` in the user agent | none expected; trivial to hide |
| [`headless_markers`](https://whiskerjs.com/docs/integrity/#headless_markers) | outer window size 0x0, or desktop Chrome UA without `window.chrome` | some embedded Chromium views and webviews |
| [`permissions_inconsistent`](https://whiskerjs.com/docs/integrity/#permissions_inconsistent) | notifications denied while the permissions query says prompt | rare; unusual notification settings |
| [`software_renderer`](https://whiskerjs.com/docs/integrity/#software_renderer) | WebGL names a software renderer such as SwiftShader or llvmpipe | real users without GPU acceleration, remote and virtual desktops |
| [`webdriver_writable`](https://whiskerjs.com/docs/integrity/#webdriver_writable) | `navigator.webdriver` was redefined | none expected |
| [`engine_mismatch`](https://whiskerjs.com/docs/integrity/#engine_mismatch) | engine traits do not match the browser class | user-agent switcher extensions |
| [`iframe_mismatch`](https://whiskerjs.com/docs/integrity/#iframe_mismatch) | page and fresh iframe disagree on navigator, screen or time zone values | WebKit automation itself; top-frame-only extensions |
| [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering), [`prototype_lie`](https://whiskerjs.com/docs/integrity/#prototype_lie), [`navigator_own_property`](https://whiskerjs.com/docs/integrity/#navigator_own_property) | built-in functions or navigator values were replaced | privacy and anti-fingerprinting extensions, some polyfills |
| [`plugins_inconsistent`](https://whiskerjs.com/docs/integrity/#plugins_inconsistent), [`impossible_hardware`](https://whiskerjs.com/docs/integrity/#impossible_hardware) | faked plugin list, impossible CPU or memory values | none expected in current browsers |

A real example: Chromium run headless under Playwright in a container returned `automation_webdriver`, `headless_user_agent`, `permissions_inconsistent` and `software_renderer`. Its user agent said `HeadlessChrome` without `window.chrome`, so [`browser_class`](https://whiskerjs.com/signals/browser-class/) was `other`. The same setup with WebKit returned `automation_webdriver` and `iframe_mismatch`, the documented WebKit automation case.

## Reading combinations

- `automation_webdriver` together with `automation_globals` is a strong automation sign, per [Using the flags](https://whiskerjs.com/docs/integrity/#using-the-flags).
- `native_tampering`, `prototype_lie` and `navigator_own_property` together point at value overrides: a spoofing script or a privacy extension. Expect them on privacy-minded users.
- `software_renderer` alone is common on real but unusual machines.
- Any single flag alone is weaker than a combination.

## Using structuredId similarity

Bot farms often run many sessions from the same image. Counting distinct accounts per `visitorId`, or per shared `gpu` and `device` parts of the `structuredId`, can show a fleet of identical headless machines. See the grouping example in [Multi-accounting](https://whiskerjs.com/use-cases/multi-accounting/#using-structuredid-similarity). Legitimate fleets (a call centre, a classroom) look similar, so combine this with rate and behaviour.

## Anti-replay

A bot that cannot run the collector well may try to send a recorded result from a real browser. The binding makes that fail: the nonce is single-use and recent, and the digest covers the whole result. See [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding). It does not stop a bot that runs a real browser and collects fresh.

## What must happen on your server

1. Treat flags as features, not a block list. Weigh them with request rate, IP and network reputation, header consistency and behaviour.
2. Separate your own automation (tests, monitoring) by account, network or a header your server controls, not by trusting the flags.
3. Choose graded responses: slow down, challenge, require login, or block, depending on the evidence and the cost of a mistake.
4. Never treat `integrityFlags: []` as proof of a human.

## Limits

- Flags come from code running on a machine you do not control. An attacker can strip them or send a hand-made result.
- Two published techniques are left out on purpose: Chrome DevTools Protocol detection (it needs console output) and a Web Worker cross-check (it needs a `blob:` script that a page policy may block and report over the network). See [Left out on purpose](https://whiskerjs.com/docs/integrity/#left-out-on-purpose).
- No detection or false-positive rates have been measured for WhiskerJS.

## Questions and answers

### Does WhiskerJS say whether a visitor is a bot?

No. It reports which checks fired. Your server weighs them with other evidence such as request rate, network reputation and behaviour.

### Why do my own end-to-end tests show automation_webdriver?

Selenium, Playwright and Puppeteer set navigator.webdriver by default, so their sessions fire the flag. Exclude your test traffic by other means, such as a test account or network.

### No flags fired. Is the visitor human?

Not necessarily. Flags come from the client, so an attacker can remove them, and careful tools leave none. Absence of flags proves nothing.

### Is there a CDP or Web Worker check?

No. Chrome DevTools Protocol detection needs console output and the Worker check needs a blob: script that a page policy may block and report, so both are left out on purpose.

## Related pages

- [Integrity checks](https://whiskerjs.com/docs/integrity/): Every flag, when it fires, false positives.
- [Headless browser](https://whiskerjs.com/glossary/#headless-browser): Glossary entry.
- [webgl_renderer](https://whiskerjs.com/signals/webgl-renderer/): The GPU string behind software_renderer.
- [Account takeover](https://whiskerjs.com/use-cases/account-takeover/): Credential stuffing is mostly automated.


---

# Fraud prevention

> Device signals as one input to a fraud decision your server makes: what to collect, what to store and how to compare devices.

Source: https://whiskerjs.com/use-cases/fraud-prevention/ (last updated 2026-10-26)

> **In plain words:**
>
> Fraud checks work best when they combine many small pieces of evidence. WhiskerJS adds one kind: a description of the browser and device, plus warnings when something looks automated or tampered with. Your server puts that next to what it already knows (the account, its history, the network) and decides. WhiskerJS never makes that decision for you.

## The problem

Most fraud is repetition: the same person or tool coming back under a new name, a stolen password used from a strange machine, a script trying thousands of logins. Server-side data (IP address, request headers, account history) shows part of it. IP addresses rotate cheaply and headers are easy to set, so a description of the device itself is a useful extra view.

## What WhiskerJS contributes

One call to `collect()` returns:

- **46 components**, each with a status. 37 stable ones form the ids; nine change too easily and are reported only for your rules. See [Signals](https://whiskerjs.com/signals/).
- **visitorId**: an exact-match key for a browser setup.
- **structuredId**: seven parts, one per signal group (`gpu`, `audio`, `fonts`, `device`, `browser`, `locale`, `prefs`), so you can measure how similar two devices are, not only whether they are equal.
- **integrityFlags**: 14 read-only checks for automation and changed browser functions.
- **binding** (optional): your nonce and timestamp, bound to the result with a digest.

It does this without a network request, without storage and without a permission prompt. You send the result yourself with a request you already make, such as the login or checkout post. See [Integration](https://whiskerjs.com/docs/integration/#sending-the-result).

## Signals and flags that matter

For fraud work the most useful pieces are usually:

| Piece | Why it matters |
| --- | --- |
| [`time_zone`](https://whiskerjs.com/signals/time-zone/), [`languages`](https://whiskerjs.com/signals/languages/), [`intl_locale`](https://whiskerjs.com/signals/intl-locale/) | compare with the IP address region and the `Accept-Language` header your server sees |
| [`ua_client_hints`](https://whiskerjs.com/signals/ua-client-hints/), [`platform`](https://whiskerjs.com/signals/platform/) | compare with the User-Agent header: a Windows platform with a Mac user agent is worth a look |
| [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/), [`canvas`](https://whiskerjs.com/signals/canvas/) | graphics differ between real devices; a software renderer is common on servers |
| [`browser_class`](https://whiskerjs.com/signals/browser-class/) | WhiskerJS’s own guess of the browser family, from client values |
| [`automation_webdriver`](https://whiskerjs.com/docs/integrity/#automation_webdriver), [`automation_globals`](https://whiskerjs.com/docs/integrity/#automation_globals) | the browser or the page says it is driven by automation |
| [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering), [`prototype_lie`](https://whiskerjs.com/docs/integrity/#prototype_lie), [`iframe_mismatch`](https://whiskerjs.com/docs/integrity/#iframe_mismatch) | something changed the values fingerprinting reads |

Each flag has documented false positives: privacy extensions trigger `native_tampering` and `prototype_lie`, your own end-to-end tests set `automation_webdriver`, and real users without GPU acceleration trigger `software_renderer`. Treat flags as features for your rules, never as a block list on their own.

## Using structuredId similarity

An exact visitorId match breaks when one stable component changes, for example after a GPU driver update. The structuredId lets you see that only one group moved. A small example built on the comparison shown in [Identifiers](https://whiskerjs.com/docs/identifiers/#comparing-two-results):

```ts
import { ID_GROUP_ORDER } from 'whiskerjs';

/** Example weights only: tune them on your own traffic. */
const WEIGHTS: Record<string, number> = {
  gpu: 3, audio: 1, fonts: 2, device: 2, browser: 2, locale: 1, prefs: 1,
};

/** Share of the total weight in groups that match, or null when not comparable. */
function similarity(a: string, b: string): number | null {
  const pa = a.split('_');
  const pb = b.split('_');
  if (pa[0] !== pb[0]) return null;        // different idVersion
  let same = 0;
  let total = 0;
  ID_GROUP_ORDER.forEach((group, i) => {
    const w = WEIGHTS[group] ?? 1;
    total += w;
    if (pa[i + 1] === pb[i + 1]) same += w;
  });
  return same / total;
}
```

The weights and any threshold you put on the score are yours to choose. WhiskerJS publishes no recommended values, because none has been measured. Store which groups matched, not only the score, so a decision can be explained later.

## Anti-replay

Without a binding, someone could record one clean result and send it with every fraudulent request. Issue a fresh nonce and timestamp from your server, pass them to `collect({ binding })`, and on receipt check that the nonce is yours, unused and recent, and that the digest still matches the result. See [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding) and the server guides for [Node](https://whiskerjs.com/guides/verify-node/), [Go](https://whiskerjs.com/guides/verify-go/), [PHP](https://whiskerjs.com/guides/verify-php/) and [Python](https://whiskerjs.com/guides/verify-python/). The digest is not a signature: it stops replay of old results, not a fresh result built by hand.

## What must happen on your server

1. **Check the shape and versions.** Every component present, statuses valid, versions the ones you ship. See [Recommended server checks](https://whiskerjs.com/docs/integration/#recommended-server-checks).
2. **Verify the binding**, if you use it, before any slow work.
3. **Compare with what you see yourself**: IP region against `time_zone`, `Accept-Language` against `languages`, the User-Agent header against `ua_client_hints`.
4. **Look at history and velocity.** The same visitorId on many accounts, or one account on many visitorIds in a short time, usually says more than any single result.
5. **Decide with rules or a model** you can explain, using the result as one input. Never let the device result alone grant access, approve a payment or release money.
6. **Store per event** the ids, both version numbers, the flags and the components your rules use, with a short retention. See [Storing ids](https://whiskerjs.com/docs/integration/#storing-ids).

## Limits

- Anything produced in the browser can be faked by an attacker who controls it. A clean `integrityFlags: []` proves nothing.
- Privacy browsers are respected, not worked around: under Brave and Firefox resistFingerprinting some components are excluded, so those devices are less distinct. See [Brave](https://whiskerjs.com/browsers/brave/) and [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/).
- Shared and identical devices (a family laptop, a fleet of company machines) can share an id.
- No accuracy, false-positive or uniqueness figures exist for WhiskerJS yet. Measure on your own traffic.

## Questions and answers

### Can WhiskerJS block fraudulent users?

No. It never blocks, scores or decides. It returns signals and flags; your server decides what to do with them, ideally together with account history and request data.

### Should I collect on every page view?

Usually not. Collect at the moments that matter, such as sign-up, login, a change of payout details or checkout. That keeps the page fast and the data limited to its purpose.

### Is a matching visitorId proof that two events came from the same person?

No. It means the same browser setup, as far as these signals can tell. Identical devices with identical settings can share an id, and one person can have several.

## Related pages

- [Account takeover](https://whiskerjs.com/use-cases/account-takeover/): A known account on an unknown device.
- [Multi-accounting](https://whiskerjs.com/use-cases/multi-accounting/): Many accounts from one browser setup.
- [Recommended server checks](https://whiskerjs.com/docs/integration/#recommended-server-checks): Shape, binding, consistency, flags and history.
- [Identifiers](https://whiskerjs.com/docs/identifiers/): visitorId, structuredId and what changes them.
- [Privacy and compliance](https://whiskerjs.com/privacy/): What a site has to do before it collects device signals.


---

# Multi-accounting

> When one person runs many accounts: linking accounts by browser setup, and the honest limits of doing so.

Source: https://whiskerjs.com/use-cases/multi-accounting/ (last updated 2026-10-26)

> **In plain words:**
>
> Some people open many accounts where only one is allowed, to get around limits, bans or votes. Each account looks new to the server. If they all come from the same browser on the same computer, WhiskerJS gives them the same device description, so your server can see that the accounts are linked and decide what that means for your rules.

## The problem

Multi-accounting covers sock-puppet accounts, ban evasion, vote or review manipulation and limits that apply per person. New email addresses and new IP addresses are cheap. A browser setup is more work to change completely, which makes it a useful link between accounts. It is still only a link: many innocent situations share a device.

## What WhiskerJS contributes

- **visitorId** as a key: store it with every sign-up and login, and count distinct accounts per id.
- **structuredId** for near matches: an attacker who changes a few things (a new browser profile, a different language) often leaves several groups unchanged.
- **integrityFlags** for tooling: anti-detect browsers and spoofing scripts change values that the checks compare.

## Signals and flags that matter

- **Groups that are hard to change casually**: `gpu` ([`canvas`](https://whiskerjs.com/signals/canvas/), [`webgl_renderer`](https://whiskerjs.com/signals/webgl-renderer/), [`webgl_image`](https://whiskerjs.com/signals/webgl-image/)), `fonts` ([`fonts`](https://whiskerjs.com/signals/fonts/), [`fonts_canvas`](https://whiskerjs.com/signals/fonts-canvas/)) and `device` ([`screen_resolution`](https://whiskerjs.com/signals/screen-resolution/), [`hardware_concurrency`](https://whiskerjs.com/signals/hardware-concurrency/), [`cpu_architecture`](https://whiskerjs.com/signals/cpu-architecture/)).
- **Groups that change easily**: `locale` and `prefs` follow user settings, so a difference there alone means little.
- **Spoofing signs**: [`iframe_mismatch`](https://whiskerjs.com/docs/integrity/#iframe_mismatch), [`prototype_lie`](https://whiskerjs.com/docs/integrity/#prototype_lie), [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering), [`navigator_own_property`](https://whiskerjs.com/docs/integrity/#navigator_own_property) and [`impossible_hardware`](https://whiskerjs.com/docs/integrity/#impossible_hardware). The first four also fire for privacy extensions; `impossible_hardware` is not expected in current browsers.
- **Noise as a signal**: a `noisy` canvas or WebGL component, or [`canvas_readback`](https://whiskerjs.com/signals/canvas-readback/) reporting `altered`, means something randomises readback. That is normal in some privacy setups and also common in tools built to vary fingerprints.

## Using structuredId similarity

Exact matches find the simple cases. For the rest, count how many groups two accounts share:

```ts
import { ID_GROUP_ORDER } from 'whiskerjs';

/** Groups shared by two structuredIds of the same idVersion. */
function sharedGroups(a: string, b: string): string[] {
  const pa = a.split('_');
  const pb = b.split('_');
  if (pa[0] !== pb[0]) return [];
  return ID_GROUP_ORDER.filter((_, i) => pa[i + 1] === pb[i + 1]);
}

// Example review rule, to tune on your own data:
// flag a pair of accounts for review when they share gpu, fonts and device.
const STRONG = ['gpu', 'fonts', 'device'];
const linked = (a: string, b: string) => STRONG.every((g) => sharedGroups(a, b).includes(g));
```

Comparing every account with every other one does not scale. Index each group part separately (for example a table of `(idVersion, signalsVersion, group, part, account)`) and look up candidates by part. Popular configurations, such as a common laptop model with default settings, will share many groups; weigh a shared part by how common it is on your own traffic.

## Anti-replay

A tool that pastes one good result into every sign-up would create many accounts with one perfect device. The binding makes each result single-use: a fresh nonce per form, checked once, with the digest recomputed on your server. See [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding).

## What must happen on your server

1. Store per sign-up and login: `visitorId`, `structuredId`, `idVersion`, `signalsVersion`, flags, account and time.
2. Count accounts per `visitorId` and per strong group combination, within a time window you choose.
3. Combine with other links: payment instruments, email patterns, IP ranges, behaviour.
4. Send links to review or apply your rule, and record why. Shared devices are legitimate in many households and workplaces; avoid acting on the device link alone.
5. When you upgrade WhiskerJS, ids change. Keep old and new ids side by side for linked sessions rather than comparing across versions.

## Limits

- Identical machines with default settings can collide. A shared id is a lead, not a conclusion.
- Separate devices, separate virtual machines or a determined anti-detect setup can defeat device linking entirely.
- Under Brave farbling and Firefox resistFingerprinting components are excluded, which makes those devices more alike.
- No collision or uniqueness figures have been measured for WhiskerJS. Look at how many accounts share ids on your own traffic before you set a rule.

## Questions and answers

### Does a shared visitorId mean the accounts belong to one person?

No. It means the same browser setup. Families, shared computers, internet cafes and company fleets of identical machines can share an id. Use it as a link to review, not as proof.

### What about users who switch browsers to make a second account?

Different browsers on one device usually differ in the browser group but often share groups such as fonts, device or gpu. Comparing structuredId groups can surface that, as a hint.

### Can I store ids forever to catch old accounts?

Keep retention short and tied to the purpose, and remember ids change with WhiskerJS versions. See the privacy pages for what a site has to consider.

## Related pages

- [Bonus and promotion abuse](https://whiskerjs.com/use-cases/bonus-abuse/): Multi-accounting aimed at offers.
- [Signals](https://whiskerjs.com/signals/): Every component and its group.
- [structuredId](https://whiskerjs.com/docs/identifiers/#structuredid): The seven groups and their order.
- [GDPR and ePrivacy](https://whiskerjs.com/privacy/gdpr-eprivacy/): Consent and lawful basis questions.


---

# Payment fraud

> Device context for card and account payments: what it adds at checkout, and what it does not replace.

Source: https://whiskerjs.com/use-cases/payment-fraud/ (last updated 2026-10-26)

> **In plain words:**
>
> At checkout you already ask whether a payment is likely genuine. Your payment provider runs its own checks, and in some regions the bank asks the customer to confirm. WhiskerJS adds one more view: does the device paying now look like a device this customer used before, and does anything about it look automated or altered? It complements those checks; it does not replace them.

## The problem

Payment fraud includes stolen card details used on a fresh account, a taken-over account spending stored cards or balances, card testing (many small payments to find working cards, usually scripted) and refund or chargeback abuse. Your server sees the order, the account and the network. The device is a further, independent view.

## What WhiskerJS contributes

Collect when the customer submits the payment, bound to a nonce your server issued for this checkout, and send the result with the order:

```ts
const binding = await (await fetch('/api/checkout/nonce', { method: 'POST' })).json();
const device = await agent.collect({ timeoutMs: 3000, binding });
await fetch('/api/checkout', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body: JSON.stringify({ orderId, paymentToken, device }),
});
```

The result is about 4 KB of JSON. If you verify the binding, send it unchanged: the digest covers every field. See [Sending the result](https://whiskerjs.com/docs/integration/#sending-the-result).

## Signals and flags that matter

- **Known device for the account**: an exact `visitorId` match with earlier orders or logins.
- **Many cards, one device**: the same `visitorId` paying with many different cards in a short time is a classic pattern your rules can count.
- **Locale against card and network**: [`time_zone`](https://whiskerjs.com/signals/time-zone/), [`languages`](https://whiskerjs.com/signals/languages/) and [`intl_locale`](https://whiskerjs.com/signals/intl-locale/) compared with the IP region and the billing country. Travellers and expatriates differ honestly, so weigh, do not block.
- **Automation on checkout**: [`automation_webdriver`](https://whiskerjs.com/docs/integrity/#automation_webdriver), [`automation_globals`](https://whiskerjs.com/docs/integrity/#automation_globals), [`headless_user_agent`](https://whiskerjs.com/docs/integrity/#headless_user_agent), [`software_renderer`](https://whiskerjs.com/docs/integrity/#software_renderer) are typical of scripted card testing, and also of your own tests and of some real users (no GPU acceleration).
- **Altered values**: [`iframe_mismatch`](https://whiskerjs.com/docs/integrity/#iframe_mismatch), [`prototype_lie`](https://whiskerjs.com/docs/integrity/#prototype_lie), [`native_tampering`](https://whiskerjs.com/docs/integrity/#native_tampering). Privacy extensions cause these too.

## Using structuredId similarity

A returning customer’s device drifts: a browser update changes the `browser` group, a new monitor the `device` group. Comparing group by group lets a rule treat “one group changed” differently from “almost everything changed”:

```ts
import { ID_GROUP_ORDER } from 'whiskerjs';

/** Number of groups that match the closest known device of this customer. */
function bestMatch(current: string, known: string[]): number {
  const cur = current.split('_');
  let best = 0;
  for (const k of known) {
    const parts = k.split('_');
    if (parts[0] !== cur[0]) continue;               // same idVersion only
    const n = ID_GROUP_ORDER.filter((_, i) => parts[i + 1] === cur[i + 1]).length;
    best = Math.max(best, n);
  }
  return best; // 0 to 7; what counts as "close enough" is yours to tune
}
```

## Anti-replay

A recorded result from a genuine customer’s browser should not approve a fraudster’s payment. With the binding, your server accepts each result once, only with the nonce it issued for this checkout, and only while it is recent. See [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding) and the server guides for [Node](https://whiskerjs.com/guides/verify-node/), [Go](https://whiskerjs.com/guides/verify-go/), [PHP](https://whiskerjs.com/guides/verify-php/) and [Python](https://whiskerjs.com/guides/verify-python/).

## What must happen on your server

1. Verify the result’s shape, versions and binding before using it.
2. Combine the device view with your other evidence: order value and contents, account age and history, address and card details, IP reputation, velocity per device, card and account.
3. Keep your payment provider’s fraud checks and any strong customer authentication that applies to the payment. A device signal is never a substitute for them.
4. Decide proportionately: approve, step up, hold for review or decline. Never let the device result alone approve a payment or release money.
5. Store the ids, versions, flags and the components your rules use with the order, for the retention your purpose and obligations require, and say so in your [privacy notice](https://whiskerjs.com/privacy/privacy-notice/).

## Limits

- A fraudster with a clean, ordinary browser produces an ordinary result. The device view then only says “unknown device”.
- Shared devices and identical machines can link innocent customers.
- Privacy browsers exclude some components by design, so those devices are less distinct.
- No figures for fraud caught or false declines have been measured for WhiskerJS; test on your own orders before you change thresholds.

## Questions and answers

### Does WhiskerJS replace my payment provider's fraud checks?

No. It adds device context to your own decision. Keep your provider's checks and strong customer authentication where it applies.

### Can I send the WhiskerJS result to my payment provider?

Only if your provider accepts such data and your privacy notice covers it. WhiskerJS itself sends nothing anywhere; any sharing is your decision and your request.

### When should I collect at checkout?

When the customer submits the payment, with a fresh nonce for that checkout. Collecting earlier risks a result that is no longer bound to the payment.

## Related pages

- [Fraud prevention](https://whiskerjs.com/use-cases/fraud-prevention/): The general pattern for device signals.
- [Account takeover](https://whiskerjs.com/use-cases/account-takeover/): Payments from a taken-over account.
- [Verify the binding in Python](https://whiskerjs.com/guides/verify-python/): Recompute the digest on your server.
- [CCPA and CPRA](https://whiskerjs.com/privacy/ccpa-cpra/): Device identifiers and notice at collection.


---

# Privacy and compliance

> What the main privacy laws ask of a site that reads device signals, and how WhiskerJS keeps the data small. Informational, not legal advice.

Source: https://whiskerjs.com/privacy/ (last updated 2026-10-26)

> **In plain words:**
>
> A device fingerprint can single out a device, and in many places that makes it personal data even if you never learn the person’s name. Some laws also regulate reading information from someone’s device in the first place. These pages explain, in plain terms, the questions the main laws raise for a site that uses WhiskerJS, and what WhiskerJS does to keep the data small.

> **Informational, not legal advice.** These pages summarise public legal texts and regulator guidance as general information. They do not tell you what applies to your site. Laws change and depend on your facts: take advice from a qualified lawyer or your data protection officer for your own case.

## Two questions every site has to answer

1. **May we read this information from the device at all?** Some rules (in the EU and UK, the ePrivacy rules) cover access to information on a user’s device, not only what happens to it later. They can require consent unless an exemption applies.
2. **May we process the result, and how?** Data protection laws (the GDPR, POPIA, the CCPA as amended by the CPRA, and others) require a purpose, a lawful basis or a legal permission, transparency, security and limited retention.

WhiskerJS cannot answer either question for you. It is a script that your site runs; your site is the one that decides why, when and for how long.

## The guides

- [GDPR and ePrivacy](https://whiskerjs.com/privacy/gdpr-eprivacy/): Device access, consent, legitimate interests and fraud prevention in the EU and UK.
- [POPIA](https://whiskerjs.com/privacy/popia/): South Africa's conditions for lawful processing applied to device signals.
- [CCPA and CPRA](https://whiskerjs.com/privacy/ccpa-cpra/): Device identifiers as personal information in California, notice and opt-outs.
- [Fingerprinting without cookies](https://whiskerjs.com/privacy/fingerprinting-without-cookies/): What changes, and what does not, when nothing is stored on the device.
- [What a privacy notice should say](https://whiskerjs.com/privacy/privacy-notice/): Adaptable text and a checklist of what to fill in.

## How WhiskerJS keeps the data small

These design choices support data minimisation. They do not, on their own, make any use lawful.

| Design choice | What it means for you |
| --- | --- |
| No network code, no telemetry | the result goes only where your own code sends it; no third party receives it from the library |
| No storage, no cookies | WhiskerJS writes nothing to the device; each `collect()` starts from nothing |
| No permission prompts | permission states are only read with `navigator.permissions.query`; no location, camera, microphone, contacts or files |
| Large values only as digests | images, audio samples, font lists and similar leave as the first 128 bits of SHA-256 |
| Privacy browsers respected | components that Brave and Firefox resistFingerprinting randomise or normalise are not collected at all |
| Volatile signals outside the ids | zoom, taskbar, permissions, keyboard layout and versions do not change the ids |
| `collect({ exclude })` | you can drop any component your purpose does not need |
| Collector only | no scoring, profiling or decisions in the library |

Details and how each point is tested: [Privacy (library docs)](https://whiskerjs.com/docs/privacy/).

## What stays with you

- Choosing the purpose (for example security and fraud prevention) and keeping to it.
- Deciding the lawful basis, and whether consent is needed for device access in your jurisdiction.
- Telling users, in your privacy notice and where you collect. See [What a privacy notice should say](https://whiskerjs.com/privacy/privacy-notice/).
- Setting a short retention for stored ids and results, and deleting them on time.
- Securing what you store, and handling access, deletion and objection requests.
- Assessing risk, for example with a data protection impact assessment where the law asks for one.

## Questions and answers

### Is device fingerprinting legal?

It depends on where you operate, why you do it and how. Many laws treat a device fingerprint as personal data and some regulate reading information from a device at all. Take advice for your own case.

### Does WhiskerJS make my site compliant?

No. WhiskerJS is designed to collect little and send nothing, which helps with data minimisation, but the lawful basis, consent, notice and retention are decisions the site makes.

### Where does WhiskerJS itself describe what it collects?

On the Privacy page of the docs, which lists every kind of data collected, what is never collected and how each rule is enforced by the test suite.

## Related pages

- [Privacy (library docs)](https://whiskerjs.com/docs/privacy/): Exactly what WhiskerJS does and never does.
- [Signals](https://whiskerjs.com/signals/): Every component, what it reads and reveals.
- [Use cases](https://whiskerjs.com/use-cases/): The purposes device signals are used for.
- [Storing ids](https://whiskerjs.com/docs/integration/#storing-ids): What to keep per event, and keeping it short.


---

# Fingerprinting under CCPA and CPRA

> California's consumer privacy law and a site that reads device signals for security. Informational, not legal advice.

Source: https://whiskerjs.com/privacy/ccpa-cpra/ (last updated 2026-10-26)

> **In plain words:**
>
> In California, the CCPA (as amended by the CPRA) gives consumers rights over their personal information, and its definitions include device identifiers. A fingerprint that can recognise a consumer’s device can therefore be personal information. Using it to keep your service secure is a recognised purpose, but you still have to tell people at collection, use it in a proportionate way, and honour their rights.

> **Informational, not legal advice.** This page summarises the California Consumer Privacy Act and its regulations in general terms. It does not say whether the law applies to your business or what it requires of you. Take advice from a qualified lawyer for your own case, and check the current regulations of the California Privacy Protection Agency. Other US states have their own privacy laws.

## The law in one paragraph

The California Consumer Privacy Act of 2018 (CCPA, California Civil Code section 1798.100 and following) was amended and expanded by the California Privacy Rights Act (CPRA), approved by California voters as Proposition 24. It applies to “businesses” that meet its thresholds. It is enforced by the California Privacy Protection Agency, which also issues regulations, and by the California Attorney General.

## Is a fingerprint personal information?

The definitions in section 1798.140 are broad:

- **Personal information** includes identifiers such as a “unique personal identifier, online identifier, internet protocol address” and similar, where the information identifies, relates to or could reasonably be linked with a consumer or household.
- **Unique identifier** (or unique personal identifier) means a persistent identifier that can be used to recognise a consumer, a family or a device linked to them over time and across services, and the definition lists device identifiers and “probabilistic identifiers” among its examples.
- **Probabilistic identifier** means identifying a consumer or a consumer’s device to a degree of certainty of more probable than not, based on categories of personal information.

A visitorId, and the device result behind it, fit these descriptions when they are linked or linkable to a consumer. Treat them as personal information.

## Security and integrity as a purpose

The CCPA recognises “helping to ensure security and integrity”, to the extent the use of personal information is reasonably necessary and proportionate, as a business purpose. Security and integrity is defined to include the ability to detect security incidents, to resist malicious, deceptive, fraudulent or illegal actions, and to help prosecute those responsible. Fraud prevention and bot detection with device signals are usually assessed under this purpose.

The law also requires that collection and use be reasonably necessary and proportionate to the purposes for which the information was collected. Collecting only at protected moments, dropping unneeded components and keeping retention short all speak to that.

## What you have to do

| Obligation | What it means for device signals |
| --- | --- |
| Notice at collection (section 1798.100) | at or before collection, tell consumers the categories of personal information collected, the purposes, whether it is sold or shared, and how long it is kept |
| Privacy policy | describe the categories (identifiers, device information), sources, purposes and rights |
| Purpose and proportionality | use the results for the disclosed purpose; do not repurpose them for advertising without the proper notice and rights |
| Selling and sharing (section 1798.120) | if you disclose results to third parties for value, or for cross-context behavioural advertising, consumers have a right to opt out; using them only for your own security is not selling or sharing in itself |
| Consumer requests | be able to find, provide and delete device data linked to a consumer, subject to the law’s exceptions (security and integrity among them) |
| Service providers and contractors | if a vendor stores or analyses results for you, put the contract terms the law requires in place |
| Reasonable security | protect stored ids and results |

Device fingerprints are not listed among “sensitive personal information” in the CCPA, but precise geolocation and account log-in credentials are. WhiskerJS reads no geolocation. If you store device results next to login data, protect the whole record accordingly.

## How WhiskerJS supports proportionality

- The library has no network code: no third party receives data from it, so it creates no disclosure on its own.
- It stores nothing on the device and shows no prompts.
- Large values leave only as truncated SHA-256 digests.
- You can drop components with `collect({ exclude })`.
- It respects privacy browsers instead of working around them.

These choices support necessity and proportionality. They do not answer whether the law applies to you or replace your notices. See [Privacy (library docs)](https://whiskerjs.com/docs/privacy/).

## A checklist for your team

1. Check, with advice, whether the CCPA and other state laws apply to you.
2. Name the purpose (security and integrity, fraud prevention) and the moments you collect.
3. Add device information to your notice at collection and privacy policy, with a retention period.
4. Keep the use proportionate: collect only where needed, drop unneeded components.
5. Do not sell or share results unless your notices and opt-outs cover it.
6. Make device data findable for access and deletion requests.
7. Put service provider terms in place with any vendor that handles results.

## Questions and answers

### Is a device fingerprint personal information under the CCPA?

It can be. The CCPA's definitions cover unique identifiers, including device identifiers and probabilistic identifiers, that can be used to recognise a consumer or a device linked to a consumer.

### Does using device signals for fraud prevention count as selling or sharing?

Not by itself. Selling and sharing are about disclosing personal information to third parties for value or for cross-context behavioural advertising. WhiskerJS sends nothing to anyone; what you do with the result decides the question.

### Does the CCPA apply to my business?

Only to businesses that meet its thresholds and do business in California. Check the current thresholds and your obligations with an adviser.

## Related pages

- [What a privacy notice should say](https://whiskerjs.com/privacy/privacy-notice/): Notice at collection and the privacy policy.
- [GDPR and ePrivacy](https://whiskerjs.com/privacy/gdpr-eprivacy/): The EU rules for comparison.
- [What WhiskerJS never does](https://whiskerjs.com/docs/privacy/#what-it-never-does): No network, no storage, no prompts.
- [Bot and headless detection](https://whiskerjs.com/use-cases/bot-detection/): A security and integrity use.


---

# Fingerprinting without cookies

> How a fingerprint differs from a cookie, why the privacy rules still apply, and who stores what. Informational, not legal advice.

Source: https://whiskerjs.com/privacy/fingerprinting-without-cookies/ (last updated 2026-10-26)

> **In plain words:**
>
> A cookie is a small label a website leaves in your browser so it can read it back later. A fingerprint leaves nothing behind: it measures the browser and device each time and recognises them by how they look. “No cookies” therefore sounds more private than it is. It means nothing is stored on the device, not that the privacy rules stop applying.

> **Informational, not legal advice.** This page explains concepts and points to the legal questions they raise. It does not tell you what applies to your site. Take advice from a qualified lawyer or your data protection officer for your own case.

## Cookies and fingerprints side by side

|   | Cookie | Device fingerprint (WhiskerJS) |
| --- | --- | --- |
| What is on the device | an identifier the site wrote | nothing |
| How the device is recognised | the site reads its own identifier back | the device is measured again and the measurements are compared |
| What the user can do | delete cookies, block third-party cookies, use a private window | change settings or browser, use a privacy browser; nothing to delete |
| How exact it is | an exact identifier until deleted | a description of a browser setup; identical setups can match and updates can change it |
| Where the memory is | in the browser (and on the server) | only on the server, if the site stores the result |

## Why “no cookies” does not mean “no consent rules”

Two sets of rules usually matter, and neither is about cookies as such.

- **Rules on access to the device.** In the EU, Article 5(3) of the ePrivacy Directive covers storing information on a user’s device and gaining access to information already stored there. European regulators read “gaining access” as covering scripts that read device properties, which includes fingerprinting. The UK has an equivalent rule in PECR. Consent is required unless an exemption applies. See [GDPR and ePrivacy](https://whiskerjs.com/privacy/gdpr-eprivacy/).
- **Data protection law.** A fingerprint that singles out a device, especially one linked to an account, is likely personal data or personal information under the GDPR, POPIA and the CCPA. That brings a purpose, a lawful basis or permission, transparency, security and limited retention. See [POPIA](https://whiskerjs.com/privacy/popia/) and [CCPA and CPRA](https://whiskerjs.com/privacy/ccpa-cpra/).

Because users cannot see or delete a fingerprint the way they can a cookie, regulators tend to stress transparency for fingerprinting. Telling users clearly, and limiting the purpose, matters at least as much as for cookies.

## What WhiskerJS stores, and what your site stores

**WhiskerJS stores nothing.** It does not use cookies, localStorage, sessionStorage or IndexedDB. The [`storage`](https://whiskerjs.com/signals/storage/) component only checks whether those APIs exist; it never reads or writes them. `load()` keeps no state between `collect()` calls, so two calls are fully independent. For a moment during a call the page holds some hidden elements (measuring spans, content-blocker baits and one blank iframe); all are removed before `collect()` resolves.

**WhiskerJS sends nothing.** It has no network code. The result exists only in your page until your own code sends it, for example with the login form.

**Your site decides what is remembered.** If your server stores the `visitorId`, the `structuredId` or the components, that storage is yours: you choose what to keep, link it to accounts or not, and decide how long to keep it. That is where the privacy obligations bite.

| Who | Stores | Where | Your control |
| --- | --- | --- | --- |
| WhiskerJS | nothing | none | not applicable |
| The demo page on this site | your run history | your browser’s local storage, on your device only | “Clear my history” on the [demo](https://whiskerjs.com/demo/) |
| Your site | whatever you choose from the result | your server | purpose, retention, deletion, access requests |

## Good practice for a cookieless setup

1. Collect only at the moments that need it (login, sign-up, payment), not on every page.
2. Keep the purpose narrow, such as security and fraud prevention, and say so.
3. Drop components you do not need with `collect({ exclude })`.
4. Store the minimum per event, with `idVersion` and `signalsVersion`, and delete it on a schedule.
5. Do not reuse device results for advertising or analytics.
6. Update your privacy notice. See [What a privacy notice should say](https://whiskerjs.com/privacy/privacy-notice/).

## A note on privacy browsers

Some browsers randomise or normalise exactly the values fingerprinting reads: Brave adds per-site, per-session noise (“farbling”), and Firefox with resistFingerprinting (also Tor Browser) reports fixed values. WhiskerJS does not try to defeat these protections; it excludes the affected components for those browsers. Users who choose these browsers get less distinct ids, by design. See [Brave](https://whiskerjs.com/browsers/brave/) and [Firefox resistFingerprinting and Tor Browser](https://whiskerjs.com/browsers/firefox-rfp-and-tor/).

## Questions and answers

### If WhiskerJS sets no cookies, do I still need a cookie banner?

The question is not about cookies as such. In the EU and UK the rule covers accessing information on the device, which can include reading device properties with a script. Whether you need consent depends on your case; see the GDPR and ePrivacy page.

### Can users clear a fingerprint like they clear cookies?

No, there is nothing on the device to clear. That is why transparency, a narrow purpose and short retention on your server matter more, not less.

### Does WhiskerJS remember a device between visits?

No. It stores nothing and keeps no state between calls. Any memory of a device is in your own server's storage, under your control and your retention rules.

## Related pages

- [GDPR and ePrivacy](https://whiskerjs.com/privacy/gdpr-eprivacy/): Device access and the consent question.
- [What a privacy notice should say](https://whiskerjs.com/privacy/privacy-notice/): Telling users about device checks.
- [Privacy (library docs)](https://whiskerjs.com/docs/privacy/): What WhiskerJS collects and never collects.
- [Identifiers](https://whiskerjs.com/docs/identifiers/): How the visitorId is derived.
- [Visitor id](https://whiskerjs.com/glossary/#visitor-id): Glossary entry.


---

# Fingerprinting under GDPR and ePrivacy

> The two layers of EU rules for a site that reads device signals: access to the device, then processing of the result. Informational, not legal advice.

Source: https://whiskerjs.com/privacy/gdpr-eprivacy/ (last updated 2026-10-26)

> **In plain words:**
>
> In the EU two sets of rules meet. The ePrivacy rules ask whether you may read information from the visitor’s device at all, and often require consent for that. The GDPR asks whether you may use what you read, and how: with a lawful basis, openly, for a clear purpose and not for longer than needed. A fingerprinting script raises both questions. WhiskerJS keeps the data small, but your site still has to answer them.

> **Informational, not legal advice.** This page summarises EU legal texts and published regulator guidance in general terms. It does not say what applies to your site, and national rules and enforcement differ between member states and the UK. Take advice from a qualified lawyer or your data protection officer for your own case.

## Layer one: access to the device (ePrivacy)

Article 5(3) of the ePrivacy Directive (Directive 2002/58/EC, as amended by Directive 2009/136/EC) says, in substance, that storing information on a user’s terminal equipment, or gaining access to information already stored there, is allowed only if the user has given consent after clear and comprehensive information. It has two exemptions:

- access for the sole purpose of carrying out the transmission of a communication; or
- access that is strictly necessary for the provider to deliver an information society service explicitly requested by the user.

The rule is not limited to cookies. The Article 29 Working Party said in its Opinion 9/2014 on device fingerprinting that Article 5(3) applies to fingerprinting, and the European Data Protection Board’s Guidelines 2/2023 on the technical scope of Article 5(3) read “gaining access” broadly, including scripts that run on the device and read its properties. A script like WhiskerJS reads characteristics of the browser and device in the page, so the question whether consent is needed applies to it.

### The exemption question for security and fraud checks

Whether a security or fraud check is “strictly necessary” for a service the user asked for is debated, and the answer depends on the case:

- Arguments for the exemption point to checks that protect the very service the user requested, run only at that moment (for example at login or payment) and are used for nothing else. The Article 29 Working Party’s Opinion 04/2012 on the cookie consent exemption discussed security cookies of this kind for a user-requested service.
- Arguments against point out that fraud detection mainly protects the site, that the exemption is read narrowly, and that a fingerprint is useful for tracking well beyond the request.

National authorities do not all take the same line. In the UK the equivalent rule is regulation 6 of the Privacy and Electronic Communications Regulations (PECR), which has been amended; check the current guidance of the Information Commissioner’s Office. Decide this point with your advisers and document the reasoning.

Practical consequences either way:

- If you rely on the exemption, keep the use narrow: collect only at the protected moment, for security purposes only, and never reuse the result for analytics or advertising.
- If you rely on consent, collect only after consent, and decide what happens for users who refuse (for example a different verification step).

## Layer two: processing the result (GDPR)

### Personal data

Article 4(1) of the GDPR defines personal data as information relating to an identified or identifiable person, and names online identifiers among the ways a person can be identified. Recital 30 mentions online identifiers provided by devices. A visitorId that is stored with account and login data clearly relates to a person; even on its own it is designed to single out a browser setup. Treat ids and results as personal data.

### Lawful basis

Article 6(1) lists the lawful bases. For fraud and security, sites usually consider:

- **Legitimate interests** (Article 6(1)(f)): Recital 47 says that processing strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest, and Recital 49 says the same of processing strictly necessary for network and information security. A balancing test is still needed: your interest, the necessity of the processing, and the user’s reasonable expectations and rights.
- **Consent** (Article 6(1)(a)): if you collected consent for device access, consider whether it also serves as the basis for processing, and what withdrawal means.
- **Legal obligation** (Article 6(1)(c)): where a specific law requires the checks.

Legitimate interests under the GDPR do not answer the ePrivacy access question; the two layers are assessed separately.

### Principles that matter most here

| GDPR rule | What it means for device signals |
| --- | --- |
| Purpose limitation, Article 5(1)(b) | collect for security and fraud prevention; do not reuse for marketing |
| Data minimisation, Article 5(1)(c) | drop components you do not need with `collect({ exclude })` |
| Storage limitation, Article 5(1)(e) | keep stored ids and results for a short, defined period |
| Transparency, Articles 13 and 14 | say what you collect, why, on what basis and for how long |
| Right to object, Article 21 | applies where you rely on legitimate interests |
| Automated decisions, Article 22 | decisions based solely on automated processing with legal or similarly significant effects (such as refusing a payment or closing an account) need safeguards; keep a human route |
| Data protection by design, Article 25 | prefer the least intrusive setup that meets the purpose |
| Impact assessment, Article 35 | consider whether a DPIA is required, for example for systematic monitoring at scale |

## How WhiskerJS supports minimisation

- It has no network code and no telemetry, so no third party receives data from the library.
- It stores nothing on the device: no cookies, no local storage, no IndexedDB.
- It shows no permission prompts and reads no location, camera, microphone, contacts or files.
- Large values leave the browser only as truncated SHA-256 digests.
- It does not work around privacy browsers: components that Brave and Firefox resistFingerprinting randomise or normalise are excluded.
- Volatile signals (zoom, taskbar, permissions, keyboard layout, versions) stay outside the ids.

These points help with Articles 5 and 25. They do not decide the consent question or make any particular use lawful. See [Privacy (library docs)](https://whiskerjs.com/docs/privacy/).

## A checklist for your team

1. Write down the purpose and the moments you collect (sign-up, login, payment).
2. Decide, with advice, whether you rely on consent or an exemption for device access, and record why.
3. Choose and document the GDPR lawful basis; for legitimate interests, write the balancing test.
4. Remove components you do not need with `exclude`.
5. Set and enforce a retention period for stored ids and results.
6. Update your privacy notice. See [What a privacy notice should say](https://whiskerjs.com/privacy/privacy-notice/).
7. Keep a human review route for automated refusals.
8. Consider a DPIA.

## Questions and answers

### Do I need consent to run a fingerprinting script in the EU?

Possibly. ePrivacy Article 5(3) requires consent to access information on a device unless an exemption applies. Whether a security or fraud check is strictly necessary for a service the user asked for depends on the case and on national guidance.

### Is fraud prevention a legitimate interest under the GDPR?

Recital 47 says processing strictly necessary for preventing fraud also constitutes a legitimate interest. You still need a balancing test, and legitimate interests do not settle the separate ePrivacy consent question.

### Is a visitorId personal data if I do not know the user's name?

Often yes. The GDPR covers data that can single out a person directly or indirectly, including online identifiers. Treat ids and results as personal data unless your advisers conclude otherwise.

## Related pages

- [What a privacy notice should say](https://whiskerjs.com/privacy/privacy-notice/): Text to adapt and a checklist.
- [Fingerprinting without cookies](https://whiskerjs.com/privacy/fingerprinting-without-cookies/): Why no cookies does not mean no consent rules.
- [Data minimisation in WhiskerJS](https://whiskerjs.com/docs/privacy/#data-minimisation): What the library leaves out and why.
- [Fraud prevention](https://whiskerjs.com/use-cases/fraud-prevention/): The purpose most sites use device signals for.


---

# Fingerprinting under POPIA

> South Africa's Protection of Personal Information Act and a site that reads device signals for security. Informational, not legal advice.

Source: https://whiskerjs.com/privacy/popia/ (last updated 2026-10-26)

> **In plain words:**
>
> South Africa’s privacy law, POPIA, applies when you process personal information in South Africa or about people there. A device fingerprint linked to an account can be personal information. POPIA does not ban using it for security; it asks you to have a justification, to tell people, to keep it safe, to use it only for the purpose you named and to delete it when you no longer need it.

> **Informational, not legal advice.** This page summarises the Protection of Personal Information Act in general terms. It does not say what applies to your site. Take advice from a qualified South African lawyer or your information officer for your own case, and check the current guidance of the Information Regulator.

## The law in one paragraph

The Protection of Personal Information Act 4 of 2013 (POPIA) regulates the processing of personal information by a “responsible party” (the organisation that decides why and how information is processed). It sets eight conditions for lawful processing, gives data subjects rights, and is enforced by the Information Regulator. It protects natural persons and, unusually, juristic persons such as companies.

## Is a fingerprint personal information?

Section 1 defines personal information broadly, as information relating to an identifiable person, and its examples include “any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person”. A visitorId stored with an account, a login or an order relates to that person. Treat ids and results as personal information unless your advisers conclude otherwise.

POPIA does not contain a separate rule written specifically about reading information from a device, of the kind the EU’s ePrivacy Article 5(3) has. The question under POPIA is whether your processing meets the conditions below. If you also have users in the EU or UK, the ePrivacy question applies there; see [GDPR and ePrivacy](https://whiskerjs.com/privacy/gdpr-eprivacy/).

## The eight conditions applied to device signals

| Condition (sections) | What it asks | Applied to WhiskerJS results |
| --- | --- | --- |
| Accountability (8) | the responsible party ensures the conditions are met | assign an owner for the device checks |
| Processing limitation (9 to 12) | lawful, minimal processing with a justification | collect only at the moments you need; drop components with `exclude`; pick a section 11 justification |
| Purpose specification (13 and 14) | a specific, explicitly defined purpose; records kept no longer than necessary | name the purpose (for example fraud prevention and account security); set a retention period |
| Further processing limitation (15) | further use must be compatible with the original purpose | do not reuse device results for marketing |
| Information quality (16) | information is complete, accurate and updated where necessary | remember ids change with library versions; store `idVersion` and `signalsVersion` |
| Openness (17 and 18) | documentation, and telling the data subject what is collected and why | update your privacy notice before you deploy |
| Security safeguards (19 to 22) | appropriate technical and organisational measures; breach notification | protect stored ids and results like other account data |
| Data subject participation (23 to 25) | access and correction rights | be able to find and explain the device data linked to an account |

### Justification under section 11

Section 11(1) lists the justifications for processing, among them consent, the conclusion or performance of a contract, compliance with a legal obligation, protecting a legitimate interest of the data subject, and pursuing the legitimate interests of the responsible party or a third party. Security and fraud prevention are often assessed under the last of these. Where you rely on a justification other than consent, the data subject may object under section 11(3) in the circumstances the Act describes. Choose and document your justification with advice.

### Telling users: section 18

Section 18 asks the responsible party to take reasonably practicable steps to make the data subject aware of, among other things, the information being collected, the name and address of the responsible party, the purpose, whether supplying it is voluntary or mandatory, and the data subject’s rights. [What a privacy notice should say](https://whiskerjs.com/privacy/privacy-notice/) has a text you can adapt.

### Automated decisions: section 71

Section 71 restricts decisions with legal consequences, or that affect a person to a substantial degree, made solely on the basis of automated processing intended to profile them, subject to exceptions and safeguards. If a device rule can refuse a payment or close an account automatically, check this section with your advisers and keep a way for a person to make representations.

### Cross-border transfers: section 72

If you store results with a provider outside South Africa, section 72 sets conditions for transferring personal information abroad. WhiskerJS itself transfers nothing: the result goes only where your code sends it.

## How WhiskerJS supports the conditions

- No network code and no telemetry: the library sends nothing to anyone, so there is no hidden third-party transfer.
- No storage on the device: no cookies, local storage or IndexedDB.
- No permission prompts, no location, camera, microphone, contacts or files.
- Large values only as truncated SHA-256 digests.
- `collect({ exclude })` for processing limitation.
- Privacy browsers respected rather than worked around.

These choices support minimisation and security. They do not choose your justification or make any use lawful by themselves. See [Privacy (library docs)](https://whiskerjs.com/docs/privacy/).

## A checklist for your team

1. Name the purpose and the moments you collect.
2. Choose and record a section 11 justification.
3. Drop components you do not need.
4. Set a retention period and delete on time.
5. Update your privacy notice to meet section 18.
6. Secure stored ids and results; include them in your breach process.
7. Keep a human route for automated refusals.
8. Check transfers abroad if your storage is outside South Africa.

## Questions and answers

### Is a device fingerprint personal information under POPIA?

It can be. POPIA's definition of personal information includes an online identifier or other particular assignment to a person, and it protects juristic persons as well as natural persons.

### Do I need consent under POPIA to use device signals for fraud checks?

Not necessarily. Section 11 lists several justifications besides consent, including the legitimate interest of the responsible party. Which one fits depends on your facts; take advice.

### Who enforces POPIA?

The Information Regulator of South Africa, which also publishes guidance and handles complaints.

## Related pages

- [GDPR and ePrivacy](https://whiskerjs.com/privacy/gdpr-eprivacy/): The EU rules, for sites with users in both regions.
- [What a privacy notice should say](https://whiskerjs.com/privacy/privacy-notice/): Including what section 18 asks you to tell users.
- [Privacy (library docs)](https://whiskerjs.com/docs/privacy/): What WhiskerJS collects and never collects.
- [Payment fraud](https://whiskerjs.com/use-cases/payment-fraud/): Device context at checkout.


---

# What a privacy notice should say

> A disclosure you can adapt, what to fill in, and what different regions ask you to add. Informational, not legal advice.

Source: https://whiskerjs.com/privacy/privacy-notice/ (last updated 2026-10-26)

> **In plain words:**
>
> If your site reads device signals, tell your users in words they can follow: what you read, why, when, how long you keep it, and who gets it. This page gives you a text to start from, a list of the blanks to fill in, and what the main laws add in different regions.

> **Informational, not legal advice.** The text below is a starting point, not a compliant notice for your site. What you must say depends on your jurisdiction, your purpose and your setup. Take advice from a qualified lawyer or your data protection officer before you publish it.

## Text you can adapt

> **Device information for security.** When you sign in [or: register, pay], our site runs a script in your browser that reads technical characteristics of your device and browser, such as screen size, language and time zone settings, installed fonts, and how your device draws a test image and processes a test sound. Most of these are turned into short codes (hashes) in your browser. We use them to recognise devices you have used before and to detect automated or fraudulent access. The script does not ask for any permission, does not read your location, contacts, files, camera or microphone, and does not store anything on your device. The results are sent to us only with the form you submit, are kept for [period], and are not sold or used for advertising. [Legal basis.] [How to object or contact us.]

Every statement about the script in this text is true of WhiskerJS as built: it asks for no permission, reads no location, contacts, files, camera or microphone, stores nothing on the device and sends nothing by itself. Keep it true of your setup: if you add other scripts, share results with a vendor or keep them longer, say so.

## What to fill in

| Blank | What to decide | Notes |
| --- | --- | --- |
| Moments | when you collect: sign-in, registration, payment, change of payout details | collect only where you need it; the notice should match |
| Purpose | for example security, fraud prevention, preventing automated abuse | do not add uses you do not have; do not reuse results for marketing |
| What is read | adjust if you drop components with `collect({ exclude })` | see [Signals](https://whiskerjs.com/signals/) for what each one reads |
| Retention | how long you keep ids and results, and why | a concrete period, enforced by deletion |
| Recipients | who receives the results: only you, or a vendor or payment provider too | WhiskerJS itself sends nothing to anyone |
| Legal basis | your basis in each region | for example legitimate interests (EU and UK), a section 11 justification (South Africa) |
| Device access | whether you ask for consent before the script runs, or rely on an exemption | an EU and UK question; see [GDPR and ePrivacy](https://whiskerjs.com/privacy/gdpr-eprivacy/) |
| Automated decisions | whether a device rule can refuse access or payments without a person | say how users can ask for human review |
| Rights and contact | how to object, access, delete, complain | include the regulator where required |

## Region notes

### EU and UK (GDPR, ePrivacy, PECR)

Articles 13 and 14 of the GDPR list what you must tell people, including: who you are and how to contact you (and your data protection officer, if any), the purposes and the legal basis, the legitimate interests you rely on where that is the basis, recipients, transfers outside the EEA or UK, the retention period, the rights to access, rectification, erasure, restriction, objection and complaint to a supervisory authority, and the existence of automated decision-making with meaningful information about the logic involved. Where consent is used for device access, the information has to be given before consent is asked for.

### South Africa (POPIA)

Section 18 asks you to make the data subject aware of, among other things, the information collected, your name and address, the purpose, whether providing it is voluntary or mandatory and the consequences of not providing it, any law requiring the collection, any intended transfer abroad, and the data subject’s rights, including the right to object and to complain to the Information Regulator. See [POPIA](https://whiskerjs.com/privacy/popia/).

### California (CCPA as amended by the CPRA)

At or before collection, tell consumers the categories of personal information you collect (for example identifiers and device information), the purposes, whether you sell or share it, and how long you keep it, and link to your privacy policy. The policy also covers consumers’ rights and how to exercise them. See [CCPA and CPRA](https://whiskerjs.com/privacy/ccpa-cpra/).

## A short version for the form

A one-line notice next to the form, linking to the full text, helps users see it when it matters:

> We check technical details of your device to protect your account from fraud. Learn more in our privacy policy.

Link “privacy policy” to the section that holds the full text.

## Keeping the notice true

- Review the notice when you upgrade WhiskerJS: a new `signalsVersion` can add or change components. The [changelog](https://whiskerjs.com/whats-new/) lists every change.
- Review it when you change retention, add a vendor or start a new use.
- Keep the description of what is read consistent with your `exclude` list.

## Questions and answers

### Where should the notice appear?

In your privacy policy, and in short form where you collect, such as near the login, sign-up or payment form, with a link to the full text. Some laws require information at or before collection.

### Can I just copy the text?

Use it as a starting point. Change the moments, purpose, retention, legal basis and contact details to what you really do, and have your adviser review it.

### Should the notice name WhiskerJS?

Naming the tool is optional. What matters is describing what is collected, why, how long it is kept and who receives it.

## Related pages

- [The disclosure text in the docs](https://whiskerjs.com/docs/privacy/#disclosure-text-you-can-adapt): The original short text.
- [GDPR and ePrivacy](https://whiskerjs.com/privacy/gdpr-eprivacy/): What Articles 13 and 14 ask for.
- [POPIA](https://whiskerjs.com/privacy/popia/): What section 18 asks for.
- [CCPA and CPRA](https://whiskerjs.com/privacy/ccpa-cpra/): Notice at collection in California.


---

# How WhiskerJS compares, feature by feature

> Which signals each open-source library collects, under which licence, what each one says about its own stability and uniqueness, and which ones send data home by default.

Source: https://whiskerjs.com/compare/ (last updated 2026-10-26)

> **No head-to-head measurement yet.** This page compares features: what each library reads. It does not say that WhiskerJS is more accurate, more stable or more unique than any other library, because the measurement that could show that has not run yet. A measurement harness that runs the libraries side by side on the same devices is coming, and its results will be published here.

How this was made: each library's public repository was read at the version below on 2026-10-24 (code read, never installed or run). The stability and uniqueness column quotes what each project publishes about itself; "not published" means it gives no figure. Projects are linked to their own pages. No logos are used. If something here is out of date or wrong, it is a reading error on our side; the project's own documentation is the reference.

## Pair by pair

Longer, feature-only comparisons with the libraries the research covers in most detail, and an overview of the open-source options:

- [Open-source alternatives](https://whiskerjs.com/compare/open-source-alternatives/): Every library read, what kind it is, licence and network defaults.
- [WhiskerJS and FingerprintJS](https://whiskerjs.com/compare/fingerprintjs/): Noise skips and confidence score against double render and statuses.
- [WhiskerJS and ThumbmarkJS](https://whiskerjs.com/compare/thumbmarkjs/): Common-pixel reduction and sampled logging against no network.
- [WhiskerJS and ClientJS](https://whiskerjs.com/compare/clientjs/): A 32-bit hash with the full user agent against versioned ids.
- [WhiskerJS and BotD](https://whiskerjs.com/compare/botd/): A bot verdict against flags without a verdict.
- [WhiskerJS and fpscanner](https://whiskerjs.com/compare/fpscanner/): Sectioned fsid against structuredId; obfuscation against a digest.

## The libraries

| Key | Library | Version read | Licence | Last release | Status |
| --- | --- | --- | --- | --- | --- |
| **WJ** | [WhiskerJS](https://whiskerjs.com/docs/) | 0.1.0 (signalsVersion 5) | Apache-2.0 | not yet published | In development |
| **F5** | [FingerprintJS](https://github.com/fingerprintjs/fingerprintjs) | 5.3.0 | MIT | 2026-10-07 | Maintained |
| **F3** | [FingerprintJS](https://github.com/fingerprintjs/fingerprintjs) | 3.4.2 | MIT | 2023-07-06 | Historical |
| **F4** | [FingerprintJS](https://github.com/fingerprintjs/fingerprintjs) | 4.6.2 | BUSL-1.1 | 2025-04-10 | Historical |
| **TM** | [ThumbmarkJS](https://github.com/thumbmarkjs/thumbmarkjs) | 1.12.0 | MIT | 2026-09-25 | Maintained |
| **CJ** | [ClientJS](https://github.com/jackspirou/clientjs) | 0.2.1 | Apache-2.0 | 2021-10-25 | Unmaintained |
| **BD** | [BotD](https://github.com/fingerprintjs/BotD) a bot classifier, not a device identifier | 2.0.0 | MIT | 2025-11-04 | Maintained (stability-only roadmap) |
| **FS** | [fpscanner](https://github.com/antoinevastel/fpscanner) | 1.0.8 | MIT | 2026-08-05 | Maintained |
| **RS** | [A browser fingerprinting research site](https://github.com/abrahamjuliot/creepjs) its name is a claimed trade mark, so this page describes it instead of naming it | commit 10aa672 | MIT, plus a trade mark policy on its name | no releases; last push 2026-06-11 | Maintained as a research site |
| **FR** | [fingerprinter-js](https://github.com/Lorenzo-Coslado/fingerprinter-js) | 2.0.1 | MIT | 2026-01-30 | Maintained, small |
| **GB** | [get-browser-fingerprint](https://github.com/damianobarbati/get-browser-fingerprint) | 5.2.4 | MIT in package.json, no LICENSE file | 2026-04-02 | Maintained, small |
| **DU** | [device-uuid](https://github.com/biggora/device-uuid) | 3.0.6 | MIT | 2026-09-28 | Maintained |
| **TD** | [TrustDevice-JS](https://github.com/trustdecision/trustdevice-js) | 1.0.6 | MIT | 2025-03-07 | Historical |

Not compared here because they are not browser collectors: JA4 (a TLS fingerprint computed at the network edge; WhiskerJS does not compute it), and Bowser and ua-parser-js (they parse a User-Agent string; WhiskerJS reports raw signals and leaves parsing to the receiver).

## Signals collected

**Y** collected for the identifier · **b** used only as a bot, lie or consistency check · **o** opt-in, or collected but outside the hash · **-** not collected. Each column is as of the version in the table above. Scroll sideways on a small screen.

| Signal | WJ | F5 | F3 | F4 | TM | CJ | BD | FS | RS | FR | GB | DU | TD |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Canvas 2D image | Y (double render, tamper probe) | Y (noise skip, double render) | Y | Y | Y (3 renders, common pixel) | Y | - | Y (+ tamper check) | Y (image, blob, paint, text, emoji) | Y | Y | o | Y |
| WebGL vendor and renderer (unmasked) | Y | Y | Y | Y | Y | - | b | Y | Y | Y | Y | o | Y |
| WebGL parameters and extensions | Y | Y | - | Y | - | - | - | - | Y | Y (few) | - | o | - |
| WebGL rendered image | Y (double render) | - | - | - | Y | - | - | - | Y | - | - | - | - |
| WebGPU adapter info | Y | - | - | - | - | - | - | Y | Y | - | Y | - | - |
| Audio (OfflineAudioContext) | Y | Y | Y | Y | Y | - | - | - | Y | o | Y | o | Y |
| Audio base latency | o (Safari and Android only) | Y | - | Y | - | - | - | - | - | - | - | - | - |
| Fonts (how probed) | Y (54, span width and canvas measureText) | Y (52, span width, iframe) | Y (52, span) | Y | Y (89, canvas measureText, iframe) | Y (231, span) | - | - | Y (document.fonts and FontFace local()) | Y | Y (span width) | o (span and canvas) | Y |
| Font preferences (default font sizes) | Y | Y | Y | Y | - | - | - | - | - | - | - | - | - |
| Screen size and colour depth | Y | Y | Y | Y | Y | Y | b | Y | Y | Y | Y (size mobile only) | Y | Y |
| Screen frame or available area | o | Y | Y | Y | - | Y | b (outer size) | Y | Y | - | - | - | - |
| Time zone | Y | Y | Y | Y | Y | Y (offset) | - | Y | Y | Y | Y | o | Y |
| Intl locale and calendars | Y | Y | - | Y | - | - | - | Y | Y | - | Y | - | - |
| Languages | Y | Y | Y | Y | Y | Y | b | Y | Y | Y | Y | Y | Y |
| User-Agent and platform | Y (platform; the UA string only for the class and checks) | Y | Y | Y | Y | Y | b | Y | Y | Y | Y | Y | Y |
| UA Client Hints (high entropy) | Y (versions outside the id) | Y | - | - | - | - | - | Y | Y | Y | Y | - | Y |
| Hardware concurrency | Y | Y | Y | Y | Y | - | - | Y | Y | Y | Y | Y | Y |
| Device memory | Y | Y | Y | Y | Y | - | - | Y | Y | Y | Y | Y | Y |
| JS heap limit | Y | - | - | - | Y | - | - | - | - | - | - | - | - |
| CPU architecture (NaN trick or CH) | Y (NaN) | Y | Y | Y | - | - | - | Y (CH) | - | - | Y (CH) | - | - |
| Touch support | Y | Y | Y | Y | Y | - | - | - | Y | Y | Y | Y | Y |
| Plugins and mimeTypes | Y (+ consistency check) | Y | Y | Y | Y | Y | b | Y | Y (+ lies) | Y | - | - | Y |
| Math precision | Y | Y | Y | Y | Y | - | - | - | Y | Y | - | - | - |
| CSS media features | Y (5) | Y (8) | Y (7) | Y (8) | Y (11) | - | - | Y (9) | Y | - | Y (5) | - | - |
| Storage availability | Y | Y | Y | Y | - | Y | - | - | Y (quota) | Y | - | - | Y |
| Cookies enabled | Y | Y | Y | Y | Y | Y | - | - | - | - | - | - | Y |
| Media codecs | Y | - | - | - | - | - | - | Y | Y | - | Y | - | - |
| Speech voices | o | - | - | - | Y | - | - | - | Y | - | - | - | - |
| Permissions states | o (24) | - | - | - | Y (28) | - | b | - | Y | o | Y (2) | - | - |
| Media device counts | - | - | - | - | - | - | - | Y | Y | Y | - | o | - |
| WebRTC | - | - | - | - | Y (SDP, no IP) | - | - | - | Y | o (IPs via Google STUN) | - | - | - |
| Network information | - | - | - | - | - | - | b (rtt) | - | Y | o | Y | o | - |
| Battery | - | - | - | - | - | - | - | - | Y | o | - | - | - |
| Keyboard layout | o | - | - | - | - | - | - | Y | - | - | - | - | - |
| Content blockers or extensions | o (8 bait elements) | Y (filter lists) | Y | Y | - | - | - | Y (8 extensions) | Y (privacy resistance) | - | - | - | - |
| Vendor-specific globals | Y | Y | Y | Y | Y (Apple Pay) | Y (Java, Flash) | b | Y | Y | - | - | - | - |
| Apple Pay, Private Click Measurement | Y | Y | - | Y | Y (Apple Pay) | - | - | Y (ApplePaySetup) | - | - | - | - | - |
| PDF viewer | Y | Y | Y | Y | - | - | - | - | Y | - | Y | - | - |
| Automation markers (webdriver, Selenium, Playwright, CDP, PhantomJS) | b (webdriver, 32 globals, headless; no CDP) | - | - | - | - | - | b (18 kinds) | b (21 rules, CDP, Playwright) | b (headless, stealth) | b | b (webdriver) | b (bot UA) | b (webdriver) |
| Lie or tamper detection | b (native source, descriptors, clean iframe, Proxy) | b (canvas noise) | - | b (canvas noise) | - | - | b (consistency) | b (descriptors, canvas tamper, context mismatch) | b (prototype and Proxy lies, about 25 checks) | - | - | - | - |
| iframe and Worker cross-check | b (iframe; no Worker) | Y (iframe for fonts only) | - | - | Y (iframe for fonts) | - | - | b (iframe and Worker) | b (iframe and Worker) | - | - | - | - |
| Anti-replay (nonce, time) | Y | - | - | - | - | - | - | Y | - | - | - | - | - |
| Identifier format | 32-hex visitorId plus 7-part structuredId | 32-hex hash | hash | hash | hash | 32-bit int | none (bot verdict) | structured `fsid` (JA4-like) | hash | SHA-256 | 32-bit hex | MD5 | MD5 in cookie |

WhiskerJS's column describes main at signalsVersion 5: 46 components, 37 of them in the visitorId across 7 groups, and 14 integrity checks. Every one is listed on [Signals](https://whiskerjs.com/docs/signals/) and [Integrity checks](https://whiskerjs.com/docs/integrity/). WhiskerJS leaves out WebRTC, media device counts, network information, battery and Chrome DevTools Protocol detection on purpose: they need a network-capable API, a permission-coupled API or console output.

## Stability and uniqueness, in each project's own words

These are each project's own claims, quoted from its README or docs at the version read. They were not measured by us, and they are not comparable with each other: each project uses its own method and audience, or gives no figure.

| Library | Stability (their words) | Uniqueness (their words) |
| --- | --- | --- |
| **WhiskerJS 0.1.0** | Not published yet. Ids are versioned (signalsVersion and idVersion) and change when a version bumps. | Not published yet: waiting for the measurement harness. |
| **FingerprintJS 5.3.0** | Docs (version policy): "The library tries to keep visitor identifiers the same within a minor version ... Some visitor identifiers may change within a minor version due to stability fixes." Noisy sources are skipped where noise is known. | README: "the accuracy is significantly lower than in the commercial version" (no figure). The code returns a fixed confidence score by platform, from 0.3 to 0.7. |
| **FingerprintJS 3.4.2** | Same version policy as 5.x. | README: "limited accuracy (40% - 60%)", and "Accuracy: up to 60%" in its comparison table. |
| **FingerprintJS 4.6.2** | Same version policy as 5.x. | README: "the accuracy is limited (40% - 60%)". |
| **ThumbmarkJS 1.12.0** | Option `stabilize`, default `['private', 'iframe']`: "Preset exclusion list for stability across private browsing and iframes". | README: "The client library achieves ~80% uniqueness across general browser populations. Mac/Safari users can show higher collision rates or higher noise depending on the audience." |
| **ClientJS 0.2.1** | Not published. | README: "It is not a full proof technique" (no figure). |
| **BotD 2.0.0** | Not applicable (a classifier). | Not published. |
| **fpscanner 1.0.8** | Not published; its structured `fsid` allows partial matching. | Not published. README: "Fingerprints are representations, not verdicts." |
| **Research site** | Not published as figures; it excludes APIs it detects as lied about. | Not published. |
| **fingerprinter-js 2.0.1** | README: "Only stable data contributes to fingerprint hash". | README gives per-collector entropy estimates, for example canvas "~10 bits". |
| **get-browser-fingerprint 5.2.4** | README: "The script does not try to bypass intentional randomization or hardening." | Not published. |
| **device-uuid 3.0.6** | Not published. | Not published. |
| **TrustDevice-JS 1.0.6** | README: "Will remain the same after uninstalling and reinstalling or clearing browser data." (it caches the id in a cookie) | Not published. |

## Which send data home by default

| Library | Default network behaviour | Off switch |
| --- | --- | --- |
| **FingerprintJS 5.3.0, 4.6.2, 3.4.2** | On by default, about 1 in 1000 loads: a GET to the vendor's monitoring host ("installation statistics"). | `load({ monitoring: false })` |
| **BotD 2.0.0** | On by default, about 1 in 1000 loads: a GET to the vendor's monitoring host. | `load({ monitoring: false })` |
| **ThumbmarkJS 1.12.0** | On by default, about 1 in 10000 runs: a POST of all components and the page path to its logging API, which on the same run also fetches and evaluates a remote script. With an API key, further calls to its API and a beacon. | `logging: false`, no `api_key`, `collect_beacon: false` |
| **fingerprinter-js 2.0.1** | No telemetry found. Its WebRTC collector (outside the hash) contacts a Google STUN server. | skip the WebRTC collector |
| **The research site** | Fetches its own script and a samples file from its own site (it is a website, not a packaged library). | not applicable |
| **ClientJS, fpscanner, get-browser-fingerprint, device-uuid, TrustDevice-JS** | No network call found in the code read. | not needed |
| **WhiskerJS 0.1.0 (main, signalsVersion 5)** | No network call of any kind. The test suite scans the compiled code and records every call on a fake browser. | not needed |

## Measured so far: WhiskerJS's own early lab runs

> **An early, small sample, not a benchmark.** These runs used WhiskerJS 0.1.0 at **signalsVersion 1** (the first collector, 30 components), not the current signalsVersion 5. They involved no other library. They show only that the id held across reloads on these four device and browser pairs.

| Device and browser | Runs | Identifiers seen |
| --- | --- | --- |
| Mac, Chrome | 4 | 1 (the same in every run) |
| Mac, Safari | 2 | 1 (the same in every run) |
| iPhone, Chrome | 3 | 1 (the same in every run) |
| iPhone, Safari | 3 | 1 (the same in every run) |

- Each pair kept one identifier across all its runs.
- The four identifiers were all different from each other.
- `device_memory` was `unavailable` on Safari and on iOS, by design: only Chromium-based browsers offer `navigator.deviceMemory`, and Chrome on iPhone runs on WebKit.

Twelve runs on four pairs say nothing about how WhiskerJS behaves across many devices, after browser updates, or against other libraries. The measurement harness will answer those questions with numbers; until then, you can measure it on your own devices with the lab mode of the [live demo](https://whiskerjs.com/demo/#lab).

- [Try the live demo](https://whiskerjs.com/demo/): The real library, in your browser. Nothing is sent.
- [Every signal](https://whiskerjs.com/docs/signals/): What each of the 46 components reads.
- [What's new](https://whiskerjs.com/whats-new/): signalsVersion 1 to 5, idVersion 1 to 2.


---

# WhiskerJS and BotD

> BotD is a bot classifier that returns a verdict. WhiskerJS is a collector whose integrity flags report what it saw and leave the verdict to your server. Compared from a code reading of BotD 2.0.0.

Source: https://whiskerjs.com/compare/botd/ (last updated 2026-10-26)

> **In plain words:**
>
> BotD is a small MIT-licensed library from the makers of FingerprintJS that answers one question in the browser: is this a bot, and if so which tool? WhiskerJS does not answer that question. It runs a set of similar checks, reports each one that fired as a flag next to its device signals, and leaves the decision to your server, where you can weigh the flags with what you already know (account history, rate, network).

## At a glance

|   | WhiskerJS 0.1.0 | BotD 2.0.0 |
| --- | --- | --- |
| Licence | Apache-2.0 | MIT |
| Version read | main at signalsVersion 5, idVersion 2 | tag v2.0.0, commit dc6a8f9 |
| Last release | not yet published | 2025-11-04 |
| Status | in development | maintained; README: “the near-term roadmap is stability-only” |
| Kind | collector: signals, ids and integrity flags, no verdict | bot classifier |
| Output | 46 components, `visitorId`, `structuredId`, `integrityFlags` | `{ bot: boolean, botKind }` |
| Identifier | yes | none (a verdict) |
| Default network behaviour | none | sampled monitoring GET, about 1 in 1000 loads |
| Off switch | not needed | `load({ monitoring: false })` |
| Install | build from source; npm package coming | npm package `@fingerprintjs/botd` |

How this was made: BotD’s public repository was read at v2.0.0 on 2026-10-24 (code read, never installed or run). Its own documentation is the reference if anything here differs.

## Signals

**Y** collected for the identifier · **b** used only as a bot, lie or consistency check · **o** opt-in, or collected but outside the hash · **-** not collected.

| Signal | WhiskerJS 0.1.0 (signalsVersion 5) | BotD 2.0.0 |
| --- | --- | --- |
| Canvas 2D image | Y (double render, tamper probe) | - |
| WebGL vendor and renderer (unmasked) | Y | b |
| WebGL parameters and extensions | Y | - |
| WebGL rendered image | Y (double render) | - |
| WebGPU adapter info | Y | - |
| Audio (OfflineAudioContext) | Y | - |
| Audio base latency | o (Safari and Android only) | - |
| Fonts (how probed) | Y (54, span width and canvas measureText) | - |
| Font preferences (default font sizes) | Y | - |
| Screen size and colour depth | Y | b |
| Screen frame or available area | o | b (outer size) |
| Time zone | Y | - |
| Intl locale and calendars | Y | - |
| Languages | Y | b |
| User-Agent and platform | Y (platform; the UA string only for the class and checks) | b |
| UA Client Hints (high entropy) | Y (versions outside the id) | - |
| Hardware concurrency | Y | - |
| Device memory | Y | - |
| JS heap limit | Y | - |
| CPU architecture (NaN trick or CH) | Y (NaN) | - |
| Touch support | Y | - |
| Plugins and mimeTypes | Y (+ consistency check) | b |
| Math precision | Y | - |
| CSS media features | Y (5) | - |
| Storage availability | Y | - |
| Cookies enabled | Y | - |
| Media codecs | Y | - |
| Speech voices | o | - |
| Permissions states | o (24) | b |
| Media device counts | - | - |
| WebRTC | - | - |
| Network information | - | b (rtt) |
| Battery | - | - |
| Keyboard layout | o | - |
| Content blockers or extensions | o (8 bait elements) | - |
| Vendor-specific globals | Y | b |
| Apple Pay, Private Click Measurement | Y | - |
| PDF viewer | Y | - |
| Automation markers (webdriver, Selenium, Playwright, CDP, PhantomJS) | b (webdriver, 32 globals, headless; no CDP) | b (18 kinds) |
| Lie or tamper detection | b (native source, descriptors, clean iframe, Proxy) | b (consistency) |
| iframe and Worker cross-check | b (iframe; no Worker) | - |
| Anti-replay (nonce, time) | Y | - |
| Identifier format | 32-hex visitorId plus 7-part structuredId | none (bot verdict) |

BotD’s column is mostly `b` or `-` because it collects only what it needs for its checks; it builds no device identifier.

## What each one checks

| Check | WhiskerJS flag | BotD |
| --- | --- | --- |
| `navigator.webdriver` true | `automation_webdriver` | yes (webDriver source) |
| Globals and document properties left by automation tools | `automation_globals` (32 names, `$cdc_`, `$wdc_`, `cdc_` prefixes, `webdriver`, `selenium`, `driver` attributes on `<html>`) | yes (distinctiveProperties, documentElementKeys) |
| Headless names in the User-Agent | `headless_user_agent` (HeadlessChrome, PhantomJS, SlimerJS) | yes (HeadlessChrome, PhantomJS, Electron, SlimerJS and others) |
| Outer window size 0 | `headless_markers` (outerWidth and outerHeight both 0, or desktop Chrome without `window.chrome`) | yes (window size while the document has focus) |
| Engine consistency | `engine_mismatch` (eval source length and productSub against the browser class) | yes (evalLength, productSub) |
| Notification permission quirk | `permissions_inconsistent` | yes (notificationPermissions) |
| Plugin and mimeType types | `plugins_inconsistent` | yes (pluginsArray, mimeTypesConsistence) |
| Software renderer | `software_renderer` (SwiftShader, llvmpipe and others) | yes (webGL: vendor “Brian Paul” with renderer “Mesa OffScreen”) |
| Electron, Rhino, Sequentum and similar | no | yes (process, spawn, windowExternal) |
| `navigator.connection.rtt` zero | no (network information is not read) | yes (rtt) |
| Native function tampering, navigator own properties, writable webdriver, impossible hardware | `native_tampering`, `navigator_own_property`, `webdriver_writable`, `impossible_hardware` | no |
| Clean iframe cross-checks | `iframe_mismatch`, `prototype_lie` | no |

The flag names and conditions are in [Integrity checks](https://whiskerjs.com/docs/integrity/#the-flags).

## How they differ in approach

**Verdict or evidence.** BotD combines its detectors into a single answer and a `botKind` (for example `selenium`, `headless_chrome`, `phantomjs`). WhiskerJS never combines its checks. Its flags are a sorted list of the checks that fired; the docs list the known false positives of each (for example privacy extensions set `native_tampering`, users without GPU acceleration set `software_renderer`). Your server decides what a combination means for your site.

**Device context.** BotD tells you about automation only. WhiskerJS returns its flags in the same result as 46 device signals and two identifiers, so your server can also ask “have I seen this setup before?” and “is the `ua_client_hints` platform consistent with the request headers?”.

**Client trust.** Both run in a browser you do not control. WhiskerJS’s docs put it plainly: a flag’s presence is informative, its absence proves nothing. Its optional [anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding) stops an old result from being sent again; BotD has no such option in the version read.

**Network and console.** BotD’s monitoring request is on by default and sampled. WhiskerJS has no network code and writes nothing to the console, which is why it leaves out Chrome DevTools Protocol detection (that technique needs a console call).

## Their claims, in their words

- BotD publishes no accuracy figure in the version read.
- `README.md` (2.0.0), Maintenance Status: “the near-term roadmap is stability-only, so new features are unlikely to land soon”; for “more demanding applications” it points to the vendor’s commercial bot detection.

WhiskerJS publishes no detection rate either: its flags are not measured against any bot population yet.

## Code credits

WhiskerJS contains no BotD code. Its `THIRD_PARTY_NOTICES.md` credits BotD 2.0.0 for ideas only: automation globals and headless markers, the eval length and productSub engine checks, the notification permission quirk, and the plugin and mimeType type checks.

## When you might pick either

- You want a ready verdict in the browser with no server logic: BotD gives one.
- You want the raw checks with their false positives documented, next to device signals, and to make the decision on your server: that is WhiskerJS’s design.
- Some teams run a classifier and a collector together; the outputs do not conflict.
- Either way, treat client-side detection as one input among others, and measure on your own traffic.

> **No head-to-head measurement has run.** This page compares checks and designs. It does not say that either library detects more bots or fewer false positives. A side-by-side measurement is planned and will be published on the [comparison page](https://whiskerjs.com/compare/).

## Questions and answers

### Can WhiskerJS replace BotD?

They answer different questions. BotD returns bot true or false and a bot kind. WhiskerJS returns 14 integrity flags with device signals and leaves the decision to your server. Whether the flags cover your needs depends on your traffic; nothing has been measured side by side.

### Does WhiskerJS use BotD code?

No. WhiskerJS credits BotD 2.0.0 for ideas only: automation globals and headless markers, the eval length and productSub engine checks, the notification permission quirk and the plugin and mimeType type checks.

### Does BotD send data by default?

In 2.0.0, on about 1 in 1000 loads it sends a GET request to the vendor's monitoring host. load({ monitoring: false }) turns it off. WhiskerJS has no network code.

## Related pages

- [Integrity checks](https://whiskerjs.com/docs/integrity/): All 14 WhiskerJS flags and their false positives.
- [Bot and headless detection](https://whiskerjs.com/use-cases/bot-detection/): Using the flags and signals on your server.
- [WhiskerJS and fpscanner](https://whiskerjs.com/compare/fpscanner/): Another library with automation checks.
- [WhiskerJS and FingerprintJS](https://whiskerjs.com/compare/fingerprintjs/): The same vendor's device identifier.
- [Headless browser](https://whiskerjs.com/glossary/#headless-browser): What headless means and how it shows.


---

# WhiskerJS and ClientJS

> Both are Apache-2.0. ClientJS is an older, unmaintained library with a 32-bit hash over values that include the full User-Agent; WhiskerJS is a current collector with versioned ids. Compared from a code reading of ClientJS 0.2.1.

Source: https://whiskerjs.com/compare/clientjs/ (last updated 2026-10-26)

> **In plain words:**
>
> ClientJS is one of the older open-source fingerprint libraries. It reads the User-Agent, screen, plugins, fonts, a canvas drawing and a few other values, and turns them into one 32-bit number. It has not been updated since 2021. WhiskerJS is a current collector under the same licence (Apache-2.0) with a much larger set of signals, statuses for every value, and identifiers that do not include the browser version.

## At a glance

|   | WhiskerJS 0.1.0 | ClientJS 0.2.1 |
| --- | --- | --- |
| Licence | Apache-2.0 | Apache-2.0 (bundles fontdetect.js, swfobject.js, deployJava.js; depends on ua-parser-js 0.7 and murmurhash-js) |
| Version read | main at signalsVersion 5, idVersion 2 | tag v0.2.1, commit 8f98834 |
| Last release | not yet published | 2021-10-25 (last push 2023-01-08) |
| Status | in development | unmaintained |
| Kind | collector: signals, ids and flags, no verdict | device identifier plus a parsed User-Agent |
| Identifier | 32-hex `visitorId` (128 bits) plus a 7-part `structuredId` | 32-bit MurmurHash3 integer (seed 256) |
| Bot and tamper checks | 14 integrity flags | none |
| Default network behaviour | none | none found |
| Off switch | not needed | not needed |
| Install | build from source; npm package coming | npm package `clientjs` |

How this was made: ClientJS’s public repository was read at v0.2.1 on 2026-10-24 (code read, never installed or run). Its own documentation is the reference if anything here differs.

## Signals

**Y** collected for the identifier · **b** used only as a bot, lie or consistency check · **o** opt-in, or collected but outside the hash · **-** not collected.

| Signal | WhiskerJS 0.1.0 (signalsVersion 5) | ClientJS 0.2.1 |
| --- | --- | --- |
| Canvas 2D image | Y (double render, tamper probe) | Y |
| WebGL vendor and renderer (unmasked) | Y | - |
| WebGL parameters and extensions | Y | - |
| WebGL rendered image | Y (double render) | - |
| WebGPU adapter info | Y | - |
| Audio (OfflineAudioContext) | Y | - |
| Audio base latency | o (Safari and Android only) | - |
| Fonts (how probed) | Y (54, span width and canvas measureText) | Y (231, span) |
| Font preferences (default font sizes) | Y | - |
| Screen size and colour depth | Y | Y |
| Screen frame or available area | o | Y |
| Time zone | Y | Y (offset) |
| Intl locale and calendars | Y | - |
| Languages | Y | Y |
| User-Agent and platform | Y (platform; the UA string only for the class and checks) | Y |
| UA Client Hints (high entropy) | Y (versions outside the id) | - |
| Hardware concurrency | Y | - |
| Device memory | Y | - |
| JS heap limit | Y | - |
| CPU architecture (NaN trick or CH) | Y (NaN) | - |
| Touch support | Y | - |
| Plugins and mimeTypes | Y (+ consistency check) | Y |
| Math precision | Y | - |
| CSS media features | Y (5) | - |
| Storage availability | Y | Y |
| Cookies enabled | Y | Y |
| Media codecs | Y | - |
| Speech voices | o | - |
| Permissions states | o (24) | - |
| Media device counts | - | - |
| WebRTC | - | - |
| Network information | - | - |
| Battery | - | - |
| Keyboard layout | o | - |
| Content blockers or extensions | o (8 bait elements) | - |
| Vendor-specific globals | Y | Y (Java, Flash) |
| Apple Pay, Private Click Measurement | Y | - |
| PDF viewer | Y | - |
| Automation markers (webdriver, Selenium, Playwright, CDP, PhantomJS) | b (webdriver, 32 globals, headless; no CDP) | - |
| Lie or tamper detection | b (native source, descriptors, clean iframe, Proxy) | - |
| iframe and Worker cross-check | b (iframe; no Worker) | - |
| Anti-replay (nonce, time) | Y | - |
| Identifier format | 32-hex visitorId plus 7-part structuredId | 32-bit int |

In short: ClientJS reads the classic set of its time (User-Agent, screen and available screen, colour depth, plugins and mimeTypes, Java, Flash and Silverlight presence, 231 fonts, storage and cookies, time zone offset, language, a canvas drawing). It does not read WebGL, audio, Math, CSS media features, hardware concurrency, device memory or touch details. WhiskerJS reads all of those and more, and reports the plugin list but none of the obsolete plugin technologies.

## How they differ in approach

**What goes into the hash.** ClientJS joins its values with `|` and hashes them, including the full User-Agent string. The User-Agent carries the browser version, so a browser update changes the fingerprint (an inference from `getFingerprint`; the project publishes no stability notes). WhiskerJS keeps volatile values out of its ids: exact Client Hints versions are in [`ua_versions`](https://whiskerjs.com/signals/ua-versions/), which is reported but never hashed into the `visitorId`, and the User-Agent string itself is used only for the [browser class](https://whiskerjs.com/signals/browser-class/) and integrity checks.

**Hash size.** A 32-bit integer has about 4.3 billion values; at scale different inputs collide. WhiskerJS ids are the first 128 bits of SHA-256, and large values inside the result are digests of the same size. Hash size only bounds accidental collisions of different inputs; how often two real devices give identical inputs is a separate question that only measurement answers.

**Missing values.** ClientJS returns values or empty results. WhiskerJS gives every component a status (`ok`, `unavailable`, `blocked`, `noisy`, `excluded`, `timed_out`) and a reason code, and every non-ok status contributes the same placeholder to the id, so a component blocked in one run and timed out in the next does not change it.

**Versions.** WhiskerJS stamps every result with `signalsVersion` and `idVersion` and documents what each bump changes ([What’s new](https://whiskerjs.com/whats-new/)). ClientJS has no such versioning of its fingerprint.

**User-Agent parsing.** ClientJS parses the User-Agent with the bundled ua-parser-js 0.7 and offers browser, OS and device getters. WhiskerJS does not parse the User-Agent; that is left to your server.

**Privacy browsers and noise.** ClientJS has no handling for canvas noise or privacy browsers. WhiskerJS renders canvas and WebGL twice and uses an [exclusion table](https://whiskerjs.com/docs/how-it-works/#the-exclusion-table) for Brave and Firefox with resistFingerprinting.

## Their claims, in their words

- `README.md` (0.2.1): “By taking multiple data points, combining them, and representing them as a number, you can be surprisingly accurate at recognizing not only browsers and devices, but also individual users”.
- `README.md` (0.2.1): “It is not a full proof technique”.
- No stability or uniqueness figure is published.

WhiskerJS publishes no accuracy, stability or uniqueness figure yet.

## Code credits

WhiskerJS contains no ClientJS code. Its `THIRD_PARTY_NOTICES.md` credits ClientJS 0.2.1 for ideas only: font and plugin probes.

## When you might pick either

- You maintain an existing integration of ClientJS and only need its User-Agent getters: the code is unchanged since 2021.
- You need signals current browsers offer (WebGL, audio, Client Hints, Intl, media features), statuses per value, a part-by-part id or integrity flags: those are in WhiskerJS.
- You need an installable package today: ClientJS is on npm; WhiskerJS is built from source until its npm package is published.
- Either way, measure on your own traffic.

> **No head-to-head measurement has run.** This page compares features and designs. It does not say that either library is more accurate, more stable or more unique. A side-by-side measurement on the same devices is planned and will be published on the [comparison page](https://whiskerjs.com/compare/).

## Questions and answers

### Is ClientJS still maintained?

Its last release, 0.2.1, was published on 2021-10-25 and the last push to its repository was on 2023-01-08, so it is unmaintained in the version read.

### Why does the ClientJS fingerprint change after a browser update?

Its getFingerprint joins the full User-Agent string into the hashed values, and the User-Agent carries the browser version. WhiskerJS keeps exact version numbers in ua_versions, which is outside its ids.

### Is a 32-bit hash a problem?

A 32-bit hash has about 4.3 billion possible values, so different inputs collide more often as the number of devices grows. WhiskerJS ids use the first 128 bits of SHA-256. Neither number says how often two real devices produce the same inputs.

## Related pages

- [Feature comparison matrix](https://whiskerjs.com/compare/): All twelve libraries on one table.
- [Open-source alternatives](https://whiskerjs.com/compare/open-source-alternatives/): Every library we read, described the same way.
- [fonts](https://whiskerjs.com/signals/fonts/): WhiskerJS's span-width font probe over 54 families.
- [ua_versions](https://whiskerjs.com/signals/ua-versions/): Where WhiskerJS keeps exact browser versions, outside the ids.
- [Why versions bump](https://whiskerjs.com/docs/identifiers/#why-versions-bump): How WhiskerJS versions its ids.


---

# WhiskerJS and FingerprintJS

> Two MIT and Apache-licensed browser collectors with overlapping signal sets and different designs, compared feature by feature from a code reading of FingerprintJS 5.3.0.

Source: https://whiskerjs.com/compare/fingerprintjs/ (last updated 2026-10-26)

> **In plain words:**
>
> FingerprintJS is an established open-source browser fingerprint library. Version 5 is MIT-licensed and reads a broad set of signals, then returns one visitor id with a confidence score. WhiskerJS reads an overlapping set, returns every measurement with a status, two identifiers and integrity flags, and makes no network request. This page compares what each one does. It does not say which identifies devices better: that has not been measured.

## At a glance

|   | WhiskerJS 0.1.0 | FingerprintJS 5.3.0 |
| --- | --- | --- |
| Licence | Apache-2.0 | MIT (from 5.0.0; 4.x was BUSL-1.1) |
| Version read | main at signalsVersion 5, idVersion 2 | tag v5.3.0, commit dac5ae5 |
| Last release | not yet published | 2026-10-07 |
| Status | in development | maintained |
| Kind | collector: signals, ids and flags, no verdict | device identifier with a confidence score |
| Identifier | 32-hex `visitorId` plus a 7-part `structuredId` | 32-hex visitor id |
| Bot and tamper checks | 14 integrity flags | none (bot detection is the separate BotD) |
| Default network behaviour | none | sampled monitoring GET, about 1 in 1000 loads |
| Off switch | not needed | `load({ monitoring: false })` |
| Install | build from source; npm package coming | npm package `@fingerprintjs/fingerprintjs` |

How this was made: FingerprintJS’s public repository was read at v5.3.0 on 2026-10-24 (code read, never installed or run). Its own documentation is the reference if anything here differs.

## Signals

**Y** collected for the identifier · **b** used only as a bot, lie or consistency check · **o** opt-in, or collected but outside the hash · **-** not collected.

| Signal | WhiskerJS 0.1.0 (signalsVersion 5) | FingerprintJS 5.3.0 |
| --- | --- | --- |
| Canvas 2D image | Y (double render, tamper probe) | Y (noise skip, double render) |
| WebGL vendor and renderer (unmasked) | Y | Y |
| WebGL parameters and extensions | Y | Y |
| WebGL rendered image | Y (double render) | - |
| WebGPU adapter info | Y | - |
| Audio (OfflineAudioContext) | Y | Y |
| Audio base latency | o (Safari and Android only) | Y |
| Fonts (how probed) | Y (54, span width and canvas measureText) | Y (52, span width, iframe) |
| Font preferences (default font sizes) | Y | Y |
| Screen size and colour depth | Y | Y |
| Screen frame or available area | o | Y |
| Time zone | Y | Y |
| Intl locale and calendars | Y | Y |
| Languages | Y | Y |
| User-Agent and platform | Y (platform; the UA string only for the class and checks) | Y |
| UA Client Hints (high entropy) | Y (versions outside the id) | Y |
| Hardware concurrency | Y | Y |
| Device memory | Y | Y |
| JS heap limit | Y | - |
| CPU architecture (NaN trick or CH) | Y (NaN) | Y |
| Touch support | Y | Y |
| Plugins and mimeTypes | Y (+ consistency check) | Y |
| Math precision | Y | Y |
| CSS media features | Y (5) | Y (8) |
| Storage availability | Y | Y |
| Cookies enabled | Y | Y |
| Media codecs | Y | - |
| Speech voices | o | - |
| Permissions states | o (24) | - |
| Media device counts | - | - |
| WebRTC | - | - |
| Network information | - | - |
| Battery | - | - |
| Keyboard layout | o | - |
| Content blockers or extensions | o (8 bait elements) | Y (filter lists) |
| Vendor-specific globals | Y | Y |
| Apple Pay, Private Click Measurement | Y | Y |
| PDF viewer | Y | Y |
| Automation markers (webdriver, Selenium, Playwright, CDP, PhantomJS) | b (webdriver, 32 globals, headless; no CDP) | - |
| Lie or tamper detection | b (native source, descriptors, clean iframe, Proxy) | b (canvas noise) |
| iframe and Worker cross-check | b (iframe; no Worker) | Y (iframe for fonts only) |
| Anti-replay (nonce, time) | Y | - |
| Identifier format | 32-hex visitorId plus 7-part structuredId | 32-hex hash |

In short: the two sets overlap on most classic signals (canvas, WebGL identity and parameters, audio, fonts, font preferences, screen, Intl, Client Hints, Math, media features, Apple Pay and Private Click Measurement, vendor flavours, PDF viewer). WhiskerJS also reads a WebGL rendered image, WebGPU adapter details, media codecs, the JS heap limit, speech voices, permission states and the keyboard layout, the last three outside its ids. FingerprintJS reads a few CSS media features and navigator values that WhiskerJS does not (for example inverted colours, monochrome, reduced transparency, `osCpu`).

## How they differ in approach

**Noise.** FingerprintJS skips sources where it knows browsers add noise (its code comments name canvas in Safari 17 and later and Firefox 120 and later) and renders canvas twice to drop noisy results. WhiskerJS has no browser-version skip list. It renders canvas and WebGL twice on every browser and reports `noisy` with ruleId `render_mismatch` when they differ, and for Brave and Firefox with resistFingerprinting it uses an [exclusion table](https://whiskerjs.com/docs/how-it-works/#the-exclusion-table) that does not collect the randomised components at all. Its audio probe is rendered once. See [the double render](https://whiskerjs.com/docs/how-it-works/#noise-handling-the-double-render).

**What a missing value looks like.** FingerprintJS distinguishes per-source error states. WhiskerJS gives every one of its 46 components exactly one of six statuses with a short reason code (`no_api`, `security_error`, `timeout` and so on), so your server can tell “this browser has no such API” from “it was blocked” from “it ran out of time”. See [statuses and reason codes](https://whiskerjs.com/docs/how-it-works/#statuses-and-reason-codes).

**Identifier.** FingerprintJS returns one hash and a confidence score; in the open-source code the score is a fixed value by platform (0.3 to 0.7), and its code comment says the true probability depends on the number of visitors, which the agent cannot know. WhiskerJS returns no score. It returns a `visitorId` over 37 stable components and a `structuredId` with one short hash per signal group, so two results can be compared part by part. Both ids carry versions (`signalsVersion`, `idVersion`). See [Identifiers](https://whiskerjs.com/docs/identifiers/).

**Bot and tamper detection.** FingerprintJS 5 leaves automation markers to BotD. WhiskerJS includes 14 read-only integrity checks (automation globals, `navigator.webdriver`, headless markers, native function tampering, a clean iframe cross-check and others) and reports them as flags, never as a verdict. See [Integrity checks](https://whiskerjs.com/docs/integrity/).

**Network and console.** FingerprintJS’s monitoring request is on by default and sampled. WhiskerJS has no network code at all and writes nothing to the console (which is also why it reads `audio_latency` only in Safari and on Android, the same choice FingerprintJS makes for its audio base latency source).

**Anti-replay.** WhiskerJS can bind a server nonce and timestamp into the result with a digest ([Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding)). FingerprintJS 5.3.0 has no such option in the code read.

## Their claims, in their words

- `README.md` (5.3.0): “the accuracy is significantly lower than in the commercial version” (no figure).
- `README.md` (5.3.0): “a fingerprint stays the same in incognito/private mode and even when browser data is purged.”
- `README.md` (5.3.0), Limitations: “Because fingerprints are generated and processed in the browser, they are vulnerable to spoofing and reverse engineering.”
- `docs/version_policy.md`: “The library tries to keep visitor identifiers the same within a minor version … Some visitor identifiers may change within a minor version due to stability fixes.”
- For the older lines: the 3.4.2 README says “limited accuracy (40% - 60%)” and “Accuracy: up to 60%”; the 4.6.2 README says “the accuracy is limited (40% - 60%)”.

WhiskerJS publishes no accuracy, stability or uniqueness figure yet.

## Code credits

WhiskerJS adapts one part from FingerprintJS 5.3.0 under its MIT licence: the list of Math operations, their input constants and the polyfill expressions used by the [`math`](https://whiskerjs.com/signals/math/) component, with the notice kept in the source file, `NOTICE` and `THIRD_PARTY_NOTICES.md`. Several techniques were taken as ideas only, with no code copied: the double canvas render, screen orientation normalisation, media feature probes, vendor flavour globals, Client Hints with GREASE filtering and the Permissions Policy marker, the NaN sign bit for CPU architecture, screen frame, Intl locale, Apple Pay and Private Click Measurement, font preferences, audio base latency and content-blocker baits. Nothing from the 4.x (BUSL) line was used.

## When you might pick either

- You want an established package from npm today, with a known upgrade path to a commercial service: FingerprintJS fits that.
- You need a library you can install from a registry now: WhiskerJS is not published yet.
- You need per-component statuses, a part-by-part id, integrity flags or a nonce binding in the same result: those are WhiskerJS features.
- You must guarantee no request leaves the page from the library: WhiskerJS has none; with FingerprintJS turn monitoring off.
- Either way, measure on your own traffic before relying on the ids.

> **No head-to-head measurement has run.** This page compares features and designs. It does not say that either library is more accurate, more stable or more unique. A side-by-side measurement on the same devices is planned and will be published on the [comparison page](https://whiskerjs.com/compare/).

## Questions and answers

### Does WhiskerJS contain FingerprintJS code?

One small part: the list of Math operations, their input constants and polyfill expressions in the math collector are adapted from FingerprintJS 5.3.0 under its MIT licence, with the notice kept. Everything else is original code; some techniques were taken as ideas only.

### Which one is more accurate?

Unknown. No head-to-head measurement has run. FingerprintJS publishes no accuracy figure for 5.x beyond saying it is significantly lower than its commercial version, and WhiskerJS publishes none yet.

### Does FingerprintJS send data anywhere?

In 5.3.0, on about 1 in 1000 loads it sends a GET request to the vendor's monitoring host for installation statistics. load({ monitoring: false }) turns it off. WhiskerJS has no network code.

### Can I use FingerprintJS 4.x instead?

The 4.x line (4.0.0 to 4.6.2) is under the Business Source License 1.1, which its README describes as for non-production purposes. 5.x returned to MIT.

## Related pages

- [Feature comparison matrix](https://whiskerjs.com/compare/): All twelve libraries on one table.
- [Open-source alternatives](https://whiskerjs.com/compare/open-source-alternatives/): Every library we read, described the same way.
- [The double render](https://whiskerjs.com/docs/how-it-works/#noise-handling-the-double-render): How WhiskerJS detects canvas and WebGL noise.
- [math](https://whiskerjs.com/signals/math/): The one collector with operations adapted from FingerprintJS.
- [WhiskerJS and BotD](https://whiskerjs.com/compare/botd/): The same vendor's open-source bot classifier.


---

# WhiskerJS and fpscanner

> Both return an identifier in parts and support a nonce against replay. They differ in what they check, how they protect the payload and what they leave out. Compared from a code reading of fpscanner 1.0.8.

Source: https://whiskerjs.com/compare/fpscanner/ (last updated 2026-10-26)

> **In plain words:**
>
> fpscanner is an MIT-licensed library, rewritten as a new 1.x line, that collects device signals and runs a broad set of bot detections, then returns a fingerprint in sections and a payload your server checks. WhiskerJS shares two of its ideas (an id in parts and a nonce against replay) and differs in the rest: what it reads, what it refuses to do (console calls, Workers), and how the result is protected. Neither returns a final verdict.

## At a glance

|   | WhiskerJS 0.1.0 | fpscanner 1.0.8 |
| --- | --- | --- |
| Licence | Apache-2.0 | MIT |
| Version read | main at signalsVersion 5, idVersion 2 | tag v1.0.8, commit c701505 |
| Last release | not yet published | 2026-08-05 |
| Status | in development | maintained |
| Kind | collector: signals, ids and integrity flags, no verdict | collector with detections (a `fastBotDetection` flag) |
| Identifier | 32-hex `visitorId` plus `structuredId` (`2_` and seven 12-hex parts) | `fsid` in sections (`FS1_<det>_<auto>_<dev>_<brw>_<gfx>_<cod>_<loc>_<ctx>`) |
| Anti-replay | your nonce and timestamp, echoed and bound by a digest | time, nonce and page URL in the payload |
| Payload protection | digest (not a signature) | XOR obfuscation with a build-time key (“NOT cryptographically secure”) |
| Default network behaviour | none | none found |
| Install | build from source; npm package coming | npm package `fpscanner` |

How this was made: fpscanner’s public repository was read at v1.0.8 on 2026-10-24 (code read, never installed or run). Its own documentation is the reference if anything here differs.

## Signals

**Y** collected for the identifier · **b** used only as a bot, lie or consistency check · **o** opt-in, or collected but outside the hash · **-** not collected.

| Signal | WhiskerJS 0.1.0 (signalsVersion 5) | fpscanner 1.0.8 |
| --- | --- | --- |
| Canvas 2D image | Y (double render, tamper probe) | Y (+ tamper check) |
| WebGL vendor and renderer (unmasked) | Y | Y |
| WebGL parameters and extensions | Y | - |
| WebGL rendered image | Y (double render) | - |
| WebGPU adapter info | Y | Y |
| Audio (OfflineAudioContext) | Y | - |
| Audio base latency | o (Safari and Android only) | - |
| Fonts (how probed) | Y (54, span width and canvas measureText) | - |
| Font preferences (default font sizes) | Y | - |
| Screen size and colour depth | Y | Y |
| Screen frame or available area | o | Y |
| Time zone | Y | Y |
| Intl locale and calendars | Y | Y |
| Languages | Y | Y |
| User-Agent and platform | Y (platform; the UA string only for the class and checks) | Y |
| UA Client Hints (high entropy) | Y (versions outside the id) | Y |
| Hardware concurrency | Y | Y |
| Device memory | Y | Y |
| JS heap limit | Y | - |
| CPU architecture (NaN trick or CH) | Y (NaN) | Y (CH) |
| Touch support | Y | - |
| Plugins and mimeTypes | Y (+ consistency check) | Y |
| Math precision | Y | - |
| CSS media features | Y (5) | Y (9) |
| Storage availability | Y | - |
| Cookies enabled | Y | - |
| Media codecs | Y | Y |
| Speech voices | o | - |
| Permissions states | o (24) | - |
| Media device counts | - | Y |
| WebRTC | - | - |
| Network information | - | - |
| Battery | - | - |
| Keyboard layout | o | Y |
| Content blockers or extensions | o (8 bait elements) | Y (8 extensions) |
| Vendor-specific globals | Y | Y |
| Apple Pay, Private Click Measurement | Y | Y (ApplePaySetup) |
| PDF viewer | Y | - |
| Automation markers (webdriver, Selenium, Playwright, CDP, PhantomJS) | b (webdriver, 32 globals, headless; no CDP) | b (21 rules, CDP, Playwright) |
| Lie or tamper detection | b (native source, descriptors, clean iframe, Proxy) | b (descriptors, canvas tamper, context mismatch) |
| iframe and Worker cross-check | b (iframe; no Worker) | b (iframe and Worker) |
| Anti-replay (nonce, time) | Y | Y |
| Identifier format | 32-hex visitorId plus 7-part structuredId | structured `fsid` (JA4-like) |

In short: both read WebGL identity, WebGPU adapter details, media codecs, Client Hints, Intl, keyboard layout, screen and a canvas with a tamper check. fpscanner also reads media device counts, browser extensions and the Summarizer API, and cross-checks values in a Web Worker. WhiskerJS also reads audio, fonts (two methods), font preferences, Math, WebGL parameters and a WebGL image, permissions, speech voices and storage, and leaves out media devices by rule.

## How they differ in approach

**The id in parts.** fpscanner’s `fsid` is, in its README’s words, “a JA4-inspired, locality-preserving fingerprint identifier”, with sections that include detections and automation. WhiskerJS’s `structuredId` covers only the 37 stable components, one 48-bit part per group (gpu, audio, fonts, device, browser, locale, prefs); its flags are a separate list and never change an id. See [comparing two results](https://whiskerjs.com/docs/identifiers/#comparing-two-results).

**Anti-replay and protection.** fpscanner puts time and a nonce in an obfuscated payload and recommends rejecting payloads older than about 60 seconds; the obfuscation key is set at build time (the default build uses a placeholder). WhiskerJS takes a nonce and timestamp from your server, echoes them and computes a SHA-256 digest over the whole result; your server recomputes it with `bindingInput`. Both projects say plainly that this is not cryptographic protection: the digest stops replay and catches edits, it does not prove the browser told the truth. See [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding).

**Automation checks.** Both check `navigator.webdriver`, a writable webdriver, Selenium and Playwright globals, impossible CPU or memory values, eval length against the engine, a software renderer and iframe mismatches. fpscanner also checks Chrome DevTools Protocol use, the 800x600 headless screen, a UTC time zone, language and platform mismatches and Worker mismatches. WhiskerJS also checks native function tampering and Proxy lies against a [clean iframe realm](https://whiskerjs.com/docs/how-it-works/#the-clean-iframe-realm), and plugin and mimeType consistency. It does not flag a UTC time zone, which real users in that zone also have.

**What is left out on purpose.** WhiskerJS has no console output, so no CDP detection; no Worker, because a `blob:` Worker can be blocked by a page CSP that then reports over the network; no media device counts, because that API is coupled to camera and microphone permissions. See the [FAQ](https://whiskerjs.com/docs/faq/).

**Statuses.** WhiskerJS gives every component a status and reason code, so a missing value is explained rather than empty.

## Their claims, in their words

- `README.md` (1.0.8): “Fingerprints are representations, not verdicts.”
- `README.md` (1.0.8), Limits: “All client-side fingerprinting and bot detection techniques can be spoofed or emulated”.
- `src/crypto-helpers.ts`: “Simple and fast XOR-based encryption/decryption. Note: This is NOT cryptographically secure - use only for obfuscation”.
- Stability and uniqueness figures: not published.

WhiskerJS publishes no accuracy, stability or uniqueness figure yet.

## Code credits

WhiskerJS adapts one part from fpscanner 1.0.8 under its MIT licence: the audio and video MIME type strings used by [`media_codecs`](https://whiskerjs.com/signals/media-codecs/) (the probing code is original), with the notice kept in the source file, `NOTICE` and `THIRD_PARTY_NOTICES.md`. WhiskerJS’s roadmap names fpscanner’s `fsid` and its timestamp-plus-nonce check as the ideas behind the `structuredId` and the binding; no code was taken for them.

## When you might pick either

- You want detections such as CDP and Worker cross-checks run in the browser and accept a console call and a `blob:` Worker: fpscanner includes them.
- You need no console output, no Worker and no request of any kind from the library, with audio, fonts and Math signals as well: that is WhiskerJS’s design.
- You want an obfuscated payload by default: fpscanner; you want a plain JSON result with a verifiable digest: WhiskerJS. Neither replaces a server-side signature.
- Either way, measure on your own traffic.

> **No head-to-head measurement has run.** This page compares features and designs. It does not say that either library is more accurate, more stable or more unique. A side-by-side measurement on the same devices is planned and will be published on the [comparison page](https://whiskerjs.com/compare/).

## Questions and answers

### Is the fpscanner fsid the same as the WhiskerJS structuredId?

They share an idea: an identifier made of sections so two results can be compared part by part. The sections differ. fpscanner's fsid covers detections, automation, device, browser, graphics, codecs, locale and contexts. WhiskerJS's structuredId has seven parts for gpu, audio, fonts, device, browser, locale and prefs, computed only from its 37 stable components.

### Does either library sign the result?

No. fpscanner obfuscates its payload with a build-time XOR key and says itself that this is not cryptographically secure. WhiskerJS computes a digest over the result and your nonce, and says itself that this is not a signature. Signing belongs on your server.

### Why does WhiskerJS leave out CDP detection and the Worker cross-check?

CDP detection works by logging an object to the console, and WhiskerJS writes nothing to the console. A Worker needs a blob: script that a page Content Security Policy may block and report over the network, which would be a request caused by the library.

## Related pages

- [structuredId](https://whiskerjs.com/docs/identifiers/#structuredid): The seven parts and how to compare them.
- [Anti-replay binding](https://whiskerjs.com/docs/integration/#anti-replay-binding): Nonce, timestamp and digest, and what they do not prove.
- [media_codecs](https://whiskerjs.com/signals/media-codecs/): The MIME lists adapted from fpscanner.
- [WhiskerJS and BotD](https://whiskerjs.com/compare/botd/): Automation checks in a classifier.
- [Feature comparison matrix](https://whiskerjs.com/compare/): All twelve libraries on one table.


---

# Open-source alternatives for browser fingerprinting

> Twelve open-source browser fingerprint libraries and research projects, described the same way: licence, status, what they collect, what they claim about themselves and whether they send data by default.

Source: https://whiskerjs.com/compare/open-source-alternatives/ (last updated 2026-10-26)

> **In plain words:**
>
> A browser fingerprint library is a script that reads characteristics of a browser and device (screen, fonts, how a test image is drawn and many more) and combines them so a site can recognise the same setup again, or notice automation. Several open-source projects do this, in different ways and under different licences. This page lists the ones we read, describes each the same way, and quotes what each says about itself. It does not rank them: no head-to-head measurement has run.

## What these libraries do, and the kinds

All of them run JavaScript in the page and read browser APIs. What they hand back differs, and that matters more than the list of signals:

| Kind | What you get | Examples below |
| --- | --- | --- |
| Device identifier | one hash (sometimes with the parts) meant to stay the same for the same browser setup | FingerprintJS, ThumbmarkJS, ClientJS, fingerprinter-js, get-browser-fingerprint, device-uuid, TrustDevice-JS |
| Structured identifier | an id in sections, so two results can match in some parts and differ in others | fpscanner (`fsid`), WhiskerJS (`structuredId`) |
| Bot classifier | a verdict: bot or not, and which tool | BotD |
| Research site | a website that studies fingerprinting and lie detection; not packaged as a library | the research site described below |
| User-agent parser | browser, engine, OS and device type parsed from the User-Agent string | Bowser, ua-parser-js (not collectors, so not listed in detail) |
| Edge fingerprint | a fingerprint of the TLS handshake, computed on the server or proxy, not in the browser | JA4 (not a browser library) |

A fingerprint describes a browser setup, not a person. Every project below that discusses limits says the same thing in its own words: client-side values can be spoofed.

## How this list was made

Each library’s public repository was read at the version named on **2026-10-24** (code read, never installed or run). Licences come from each project’s LICENSE file and package metadata. Claims are quoted from each project’s README or docs; “not published” means the project gives no figure. If something here is out of date, the project’s own documentation is the reference. For a signal-by-signal view see the [feature comparison](https://whiskerjs.com/compare/).

## The libraries

### FingerprintJS 5.3.0 (and the 3.x and 4.x lines)

- **Licence**: MIT from 5.0.0 (its `docs/licensing.md`: “Starting from version 5.0.0, FingerprintJS is licensed under MIT license.”). 4.x (4.0.0 to 4.6.2, 2023 to 2025) was under the Business Source License 1.1; 3.4.2 (2023-07-06) was the last MIT release before it.
- **Last release read**: 5.3.0, 2026-10-07. Maintained.
- **Collects**: one of the broadest sets: Client Hints, fonts (52, span widths in a hidden iframe), font preferences, audio, canvas (with known-noise skips and a double render), screen frame, Math, CSS media features, WebGL basics and full parameters, Apple Pay, Private Click Measurement, audio base latency, content-blocker filter lists and more.
- **Its claims**: README: “the accuracy is significantly lower than in the commercial version” (no figure in the v5 README); the 3.4.2 README: “limited accuracy (40% - 60%)”. Version policy: “The library tries to keep visitor identifiers the same within a minor version”.
- **Network by default**: a sampled monitoring GET on about 1 in 1000 loads; off with `load({ monitoring: false })`.
- **Project**: [github.com/fingerprintjs/fingerprintjs](https://github.com/fingerprintjs/fingerprintjs). Compared in detail: [WhiskerJS and FingerprintJS](https://whiskerjs.com/compare/fingerprintjs/).

### ThumbmarkJS 1.12.0

- **Licence**: MIT. **Last release**: 2026-09-25. Maintained.
- **Collects**: audio, canvas rendered three times with the most common byte per pixel kept, a WebGL image, 89 fonts by canvas `measureText` in an iframe, permissions over 28 names, speech voices, WebRTC SDP details without addresses, screen and media queries, the JS heap limit and more.
- **Its claims**: README: “The client library achieves ~80% uniqueness across general browser populations. Mac/Safari users can show higher collision rates or higher noise depending on the audience.” Option `stabilize` (default `['private', 'iframe']`).
- **Network by default**: sampled logging on about 1 in 10000 runs (a POST of the components and the page path to its logging API, which on the same run fetches and evaluates a remote script); with an API key, further API calls and a beacon. Off with `logging: false`, no `api_key`, `collect_beacon: false`.
- **Project**: [github.com/thumbmarkjs/thumbmarkjs](https://github.com/thumbmarkjs/thumbmarkjs). In detail: [WhiskerJS and ThumbmarkJS](https://whiskerjs.com/compare/thumbmarkjs/).

### ClientJS 0.2.1

- **Licence**: Apache-2.0. **Last release**: 2021-10-25; last push 2023-01-08. Unmaintained.
- **Collects**: the User-Agent and its parse, screen values, plugins and mimeTypes, Java, Flash and Silverlight presence (obsolete today), 231 fonts by span width, storage and cookie availability, time zone offset, language and a canvas drawing. The fingerprint is a 32-bit MurmurHash3 of the joined values.
- **Its claims**: README: “It is not a full proof technique” (no figure).
- **Network by default**: none found in the code read.
- **Project**: [github.com/jackspirou/clientjs](https://github.com/jackspirou/clientjs). In detail: [WhiskerJS and ClientJS](https://whiskerjs.com/compare/clientjs/).

### BotD 2.0.0

- **Licence**: MIT. **Last release**: 2025-11-04. Maintained; README: “the near-term roadmap is stability-only”.
- **Collects**: automation and bot markers only (globals left by automation tools, `navigator.webdriver`, eval length, productSub, the notification permission quirk, plugin and mimeType prototypes, window size and others). It returns `{ bot, botKind }`, not a device id.
- **Its claims**: no accuracy figure published.
- **Network by default**: a sampled monitoring GET on about 1 in 1000 loads; off with `load({ monitoring: false })`.
- **Project**: [github.com/fingerprintjs/BotD](https://github.com/fingerprintjs/BotD). In detail: [WhiskerJS and BotD](https://whiskerjs.com/compare/botd/).

### fpscanner 1.0.8

- **Licence**: MIT. **Last release**: 2026-08-05. Maintained (a rewritten 1.x line).
- **Collects**: automation checks (webdriver, writable webdriver, Selenium and Playwright properties, Chrome DevTools Protocol detection), device and browser values, Client Hints, WebGL and WebGPU, media codecs, keyboard layout, media device counts, a canvas tamper check, iframe and Worker cross-checks, and a request context (time, nonce, page URL).
- **Its claims**: README: “Fingerprints are representations, not verdicts.” and “All client-side fingerprinting and bot detection techniques can be spoofed or emulated”. Its `fsid` is “a JA4-inspired, locality-preserving fingerprint identifier”.
- **Network by default**: none found in the code read.
- **Project**: [github.com/antoinevastel/fpscanner](https://github.com/antoinevastel/fpscanner). In detail: [WhiskerJS and fpscanner](https://whiskerjs.com/compare/fpscanner/).

### A browser fingerprinting research site

- **Licence**: MIT, plus a trade mark policy on its name (which is why this site describes it instead of naming it). No tagged releases; last push 2026-06-11. Maintained as a research site.
- **Collects**: a very wide set, from CSS and DOM measurements to audio, canvas, WebGL, fonts via `document.fonts`, Web Worker values and known privacy-resistance patterns, and extensive prototype and Proxy lie detection.
- **Its claims**: README: “The goal of this project is to conduct research and provide education, not to create a fingerprinting library.” No stability or uniqueness figures.
- **Network**: fetches its own script and a samples file from its own site (it is a website).
- **Project**: [its repository](https://github.com/abrahamjuliot/creepjs).

### fingerprinter-js 2.0.1

- **Licence**: MIT. **Last release**: 2026-01-30. Maintained, small.
- **Collects**: a “stable” set in the hash (user agent, languages, time zone, screen, plugins, canvas, WebGL, fonts, hardware, Client Hints, storage, touch, Math, media device counts) and an “unstable” set outside it (WebRTC, battery, connection, permissions, audio); optional bot analysis with a `riskLevel`.
- **Its claims**: README: “Only stable data contributes to fingerprint hash”, with per-collector entropy estimates (for example canvas “~10 bits”).
- **Network by default**: its WebRTC collector contacts Google’s STUN server; skip that collector to avoid it.
- **Project**: [github.com/Lorenzo-Coslado/fingerprinter-js](https://github.com/Lorenzo-Coslado/fingerprinter-js).

### get-browser-fingerprint 5.2.4

- **Licence**: `package.json` declares MIT; the repository at this tag has no LICENSE file. **Last release**: 2026-04-02. Maintained, small.
- **Collects**: UA and Client Hints, Intl and locale details, preferences, screen (size on mobile only), network type, hardware, media codecs, canvas, WebGL, WebGPU, audio, fonts and two permission states; a 32-bit MurmurHash3.
- **Its claims**: README: “The script does not try to bypass intentional randomization or hardening.”
- **Network by default**: none found in the library code.
- **Project**: [github.com/damianobarbati/get-browser-fingerprint](https://github.com/damianobarbati/get-browser-fingerprint).

### device-uuid 3.0.6

- **Licence**: MIT. **Last release**: 2026-09-28. Maintained.
- **Collects**: by default a User-Agent parse, screen, language and feature flags (MD5 hash); canvas, WebGL, audio, fonts, media devices, network information and incognito detection only when asked for.
- **Its claims**: no figures; README: “privacy-by-design (fingerprinting is opt-in)”.
- **Network by default**: none found.
- **Project**: [github.com/biggora/device-uuid](https://github.com/biggora/device-uuid).

### TrustDevice-JS 1.0.6

- **Licence**: MIT. **Last release**: 2025-03-07. Historical; the open “basic version” of a commercial vendor.
- **Collects**: screen, many navigator values, canvas, WebGL, audio, fonts, storage availability and a developer-tools guess. The id is an MD5 kept in a cookie.
- **Its claims**: README: “Will remain the same after uninstalling and reinstalling or clearing browser data.” (the cookie cache).
- **Network by default**: none found.
- **Project**: [github.com/trustdecision/trustdevice-js](https://github.com/trustdecision/trustdevice-js).

### WhiskerJS 0.1.0 (this site)

- **Licence**: Apache-2.0. **Status**: in development, not yet published; build from source, npm package coming.
- **Collects**: 46 components at signalsVersion 5 (37 in the `visitorId`, in seven groups that form the `structuredId`), 14 integrity checks without a verdict, and an optional anti-replay binding. Every component always has a status and a reason code. See [Signals](https://whiskerjs.com/signals/).
- **Its claims**: none about accuracy, stability or uniqueness yet: the measurement harness has not run.
- **Network**: none. No network code, no telemetry, no storage, no permission prompts, no console output.
- **More**: [Docs](https://whiskerjs.com/docs/), [facts](https://whiskerjs.com/facts/), [live demo](https://whiskerjs.com/demo/).

## How to choose

These questions sort the options by what you need, not by which is “best”:

1. **Licence.** Can you ship it? MIT and Apache-2.0 both allow commercial use with the notice kept; Apache-2.0 adds an explicit patent grant. A Business Source License version needs its own terms checked. A package without a LICENSE file needs the author’s text first.
2. **Network defaults.** Does the library contact anyone by default? If your privacy notice promises that device data goes only to you, check the defaults and turn off any monitoring or logging.
3. **Identifier, structured identifier or classifier?** A single hash answers “same or not”. A structured id answers “what changed”. A classifier answers “bot or not” for you, with its own rules. Decide which decision you want to keep on your server.
4. **Maintenance.** Browsers change every few weeks. An unmaintained library keeps reading APIs the way they worked when it stopped.
5. **Similarity and anti-replay.** If you need to match devices across small changes, look for an id in parts. If you worry about recorded results being replayed, look for a nonce and timestamp bound into the result (and remember that a client-side digest is not a signature).
6. **Privacy browsers.** Brave and Firefox with resistFingerprinting randomise or normalise some values on purpose. Check how the library treats them: skipped, reduced, or read anyway.
7. **Measure on your own traffic.** Published figures are not comparable with each other. Run the candidates on your own devices and users before relying on any of them.

> **No head-to-head measurement has run.** This page describes features and each project’s own words. It does not say that WhiskerJS or any other library is more accurate, more stable or more unique. A measurement harness that runs the libraries side by side on the same devices is planned; its results will be published on the [comparison page](https://whiskerjs.com/compare/).

## Questions and answers

### Which open-source fingerprint library is the most accurate?

This page does not say, because nobody has measured the libraries side by side on the same devices under one method. The figures some projects publish use their own methods and audiences and are not comparable. A head-to-head measurement for WhiskerJS has not run yet.

### Is FingerprintJS open source?

FingerprintJS 5.x is published under the MIT licence; its README says the open-source accuracy is significantly lower than in the commercial version. The 4.x line was under the Business Source License 1.1, and 3.x was MIT.

### Which libraries make network requests by default?

In the versions read, FingerprintJS and BotD send a sampled monitoring request on about 1 in 1000 loads, and ThumbmarkJS a sampled logging request on about 1 in 10000 runs, each with an off switch. fingerprinter-js contacts a Google STUN server from its WebRTC collector. WhiskerJS has no network code.

### Is a bot detection library the same as a fingerprint library?

No. A bot classifier such as BotD returns a verdict (bot or not, and which kind). A device fingerprint library returns an identifier or signals. WhiskerJS returns signals, two identifiers and integrity flags, and leaves the verdict to your server.

## Related pages

- [Feature comparison matrix](https://whiskerjs.com/compare/): Every library side by side, signal by signal.
- [WhiskerJS and FingerprintJS](https://whiskerjs.com/compare/fingerprintjs/): The most complete MIT signal set, compared feature by feature.
- [WhiskerJS and fpscanner](https://whiskerjs.com/compare/fpscanner/): Structured ids and anti-replay, two designs.
- [Privacy](https://whiskerjs.com/docs/privacy/): What WhiskerJS does and never does.
- [WhiskerJS facts](https://whiskerjs.com/facts/): Licence, version, signal count and status in short statements.


---

# WhiskerJS and ThumbmarkJS

> Two open-source collectors with a similar signal surface and very different defaults on telemetry and noise, compared from a code reading of ThumbmarkJS 1.12.0.

Source: https://whiskerjs.com/compare/thumbmarkjs/ (last updated 2026-10-26)

> **In plain words:**
>
> ThumbmarkJS is an MIT-licensed browser fingerprint library with a client part and an optional paid API. Its client reads a wide set of signals, including permissions, speech voices and WebRTC session details, and returns a hash. WhiskerJS reads a similar surface, keeps the easily changing parts out of its ids, and has no network code at all. The biggest practical difference is the defaults: ThumbmarkJS samples telemetry by default, WhiskerJS never sends anything.

## At a glance

|   | WhiskerJS 0.1.0 | ThumbmarkJS 1.12.0 |
| --- | --- | --- |
| Licence | Apache-2.0 | MIT |
| Version read | main at signalsVersion 5, idVersion 2 | tag v1.12.0, commit 7eeda65 |
| Last release | not yet published | 2026-09-25 |
| Status | in development | maintained |
| Kind | collector: signals, ids and flags, no verdict | device identifier (client library plus optional paid API) |
| Identifier | 32-hex `visitorId` plus a 7-part `structuredId` | hash of the components |
| Bot and tamper checks | 14 integrity flags | none client-side |
| Default network behaviour | none | sampled logging on about 1 in 10000 runs, with a remote script fetched and evaluated on that run |
| Off switch | not needed | `logging: false`, no `api_key`, `collect_beacon: false` |
| Install | build from source; npm package coming | npm package `@thumbmarkjs/thumbmarkjs` |

How this was made: ThumbmarkJS’s public repository was read at v1.12.0 on 2026-10-24 (code read, never installed or run). Its own documentation is the reference if anything here differs.

## Signals

**Y** collected for the identifier · **b** used only as a bot, lie or consistency check · **o** opt-in, or collected but outside the hash · **-** not collected.

| Signal | WhiskerJS 0.1.0 (signalsVersion 5) | ThumbmarkJS 1.12.0 |
| --- | --- | --- |
| Canvas 2D image | Y (double render, tamper probe) | Y (3 renders, common pixel) |
| WebGL vendor and renderer (unmasked) | Y | Y |
| WebGL parameters and extensions | Y | - |
| WebGL rendered image | Y (double render) | Y |
| WebGPU adapter info | Y | - |
| Audio (OfflineAudioContext) | Y | Y |
| Audio base latency | o (Safari and Android only) | - |
| Fonts (how probed) | Y (54, span width and canvas measureText) | Y (89, canvas measureText, iframe) |
| Font preferences (default font sizes) | Y | - |
| Screen size and colour depth | Y | Y |
| Screen frame or available area | o | - |
| Time zone | Y | Y |
| Intl locale and calendars | Y | - |
| Languages | Y | Y |
| User-Agent and platform | Y (platform; the UA string only for the class and checks) | Y |
| UA Client Hints (high entropy) | Y (versions outside the id) | - |
| Hardware concurrency | Y | Y |
| Device memory | Y | Y |
| JS heap limit | Y | Y |
| CPU architecture (NaN trick or CH) | Y (NaN) | - |
| Touch support | Y | Y |
| Plugins and mimeTypes | Y (+ consistency check) | Y |
| Math precision | Y | Y |
| CSS media features | Y (5) | Y (11) |
| Storage availability | Y | - |
| Cookies enabled | Y | Y |
| Media codecs | Y | - |
| Speech voices | o | Y |
| Permissions states | o (24) | Y (28) |
| Media device counts | - | - |
| WebRTC | - | Y (SDP, no IP) |
| Network information | - | - |
| Battery | - | - |
| Keyboard layout | o | - |
| Content blockers or extensions | o (8 bait elements) | - |
| Vendor-specific globals | Y | Y (Apple Pay) |
| Apple Pay, Private Click Measurement | Y | Y (Apple Pay) |
| PDF viewer | Y | - |
| Automation markers (webdriver, Selenium, Playwright, CDP, PhantomJS) | b (webdriver, 32 globals, headless; no CDP) | - |
| Lie or tamper detection | b (native source, descriptors, clean iframe, Proxy) | - |
| iframe and Worker cross-check | b (iframe; no Worker) | Y (iframe for fonts) |
| Anti-replay (nonce, time) | Y | - |
| Identifier format | 32-hex visitorId plus 7-part structuredId | hash |

In short: both read canvas, a WebGL image, WebGL identity, audio, fonts by canvas `measureText`, Math, the JS heap limit, screen, languages, time zone, permissions and speech voices. ThumbmarkJS also reads WebRTC session details (with no ICE servers, so no address) and more media queries; WhiskerJS does not touch WebRTC at all. WhiskerJS also reads WebGL parameters, WebGPU, Client Hints, Intl locale details, media codecs, storage availability and font preferences, and runs integrity checks.

## How they differ in approach

**Canvas and WebGL noise.** ThumbmarkJS renders its canvas three times (its WebGL image once, or three times in Samsung Browser) and keeps the most frequent byte per pixel, which reconstructs a usable image even when a browser adds per-read noise. WhiskerJS takes the opposite position: it renders twice, and if the two differ the component is `noisy` and carries no value; for Brave and Firefox with resistFingerprinting it does not collect the randomised components at all. That keeps a noised value out of the id instead of working around a privacy feature. See [Noise handling](https://whiskerjs.com/docs/how-it-works/#noise-handling-the-double-render).

**Stability.** ThumbmarkJS has an option `stabilize` (default `['private', 'iframe']`) that drops components known to change in private windows and iframes. WhiskerJS has no such presets; instead nine components that change easily (pixel ratio, screen frame, versions, permissions, keyboard layout, voices, audio latency, canvas readback, content blockers) are always reported but never part of the ids, and you can drop any component with `collect({ exclude })`.

**Permissions.** Both read permission states only through `navigator.permissions.query`, which never prompts: ThumbmarkJS over 28 names inside its hash, WhiskerJS over 24 names outside its ids (states change when users grant or revoke).

**Network.** ThumbmarkJS’s sampled logging posts all components and the page path to its logging API, and on that run fetches and evaluates `experimental.min.js` from its own host; with an API key it also calls its API and may send a beacon. WhiskerJS has no network code, no telemetry and an optional `onResult` hook that you wire to your own endpoint.

**Identifier and storage.** ThumbmarkJS keeps the API’s visitor id in localStorage when the paid API is used. WhiskerJS stores nothing and returns a versioned `visitorId` and a part-by-part `structuredId`.

**Integrity and anti-replay.** WhiskerJS adds 14 integrity flags and an optional nonce binding. ThumbmarkJS’s client does not include automation or lie detection in the version read.

## Their claims, in their words

- `README.md` (1.12.0): “The client library achieves ~80% uniqueness across general browser populations. Mac/Safari users can show higher collision rates or higher noise depending on the audience.”
- `README.md` (1.12.0): the paid API claims “over 99% uniqueness” with server-side signals.
- Option `stabilize`: “Preset exclusion list for stability across private browsing and iframes”.
- `README.md`, sampled logging: the samples show “which components turn out to be unstable across real browsers.”

WhiskerJS publishes no accuracy, stability or uniqueness figure yet.

## Code credits

WhiskerJS contains no ThumbmarkJS code. Its `THIRD_PARTY_NOTICES.md` credits ThumbmarkJS 1.12.0 for ideas only: the component layout, the offline audio graph, speech voices as a signal, permission states, the JS heap limit and font detection by canvas `measureText`. Its API and telemetry calls were not used.

## When you might pick either

- You want a registry package today and may later add a paid server-side API: ThumbmarkJS offers that path.
- You want a value even in browsers that add per-read canvas noise: ThumbmarkJS’s common-pixel reduction is designed for that.
- You must guarantee that no request and no remote code leaves or enters the page through the library: WhiskerJS has none; with ThumbmarkJS set `logging: false` and leave out the API options.
- You need statuses per component, a part-by-part id, integrity flags or a nonce binding: those are WhiskerJS features.
- Either way, measure on your own traffic.

> **No head-to-head measurement has run.** This page compares features and designs. It does not say that either library is more accurate, more stable or more unique. A side-by-side measurement on the same devices is planned and will be published on the [comparison page](https://whiskerjs.com/compare/).

## Questions and answers

### Does ThumbmarkJS send data by default?

In 1.12.0, sampled logging is on by default: on about 1 in 10000 runs it posts the components and the page path to its logging API and, on the same run, fetches and evaluates a remote script. logging: false turns it off. API and beacon calls happen only with an API key or after an API response.

### ThumbmarkJS says about 80 percent uniqueness. What does WhiskerJS say?

Nothing yet. The 80 percent figure is ThumbmarkJS's own claim for its client library across general browser populations. WhiskerJS publishes no uniqueness figure until its measurement has run.

### How do the two handle canvas noise?

ThumbmarkJS renders the canvas several times and keeps the most common byte per pixel. WhiskerJS renders twice and, if the two differ, reports the component as noisy and leaves it out instead of reconstructing a value.

## Related pages

- [Feature comparison matrix](https://whiskerjs.com/compare/): All twelve libraries on one table.
- [Open-source alternatives](https://whiskerjs.com/compare/open-source-alternatives/): Every library we read, described the same way.
- [canvas](https://whiskerjs.com/signals/canvas/): WhiskerJS's canvas signal and its double render.
- [fonts_canvas](https://whiskerjs.com/signals/fonts-canvas/): Font detection by measureText, an idea credited to ThumbmarkJS.
- [Privacy](https://whiskerjs.com/docs/privacy/): No network, no storage, no prompts.


---

# Roadmap

> What we plan to build next, why, and what WhiskerJS will not do. Every item rests on public sources listed at the bottom of the page.

Source: https://whiskerjs.com/roadmap/ (last updated 2026-10-26)

> **In plain words:**
>
> WhiskerJS today reads 46 browser and device signals and returns them as one JSON result, without sending or storing anything. The next steps are mostly about **reliability**: telling apart real values from values a privacy browser has deliberately changed, keeping ids stable when browsers update, spotting automation through values that do not fit together, and testing in real browsers. New signals are added **outside the id first** and join it only after measurement shows they are stable. The rules stay the same: no network, no storage, no permission prompts, no console output, no verdicts.

**Priority**: P1 means we do it in that phase, P2 when the P1 items are done, P3 only with a clear use. **Effort**: S is up to two days, M up to two weeks, L more. Plans can change as measurements come in.

## Now: the next 2 to 4 weeks

| Item | Priority | Effort | Why, in plain words |
| --- | --- | --- | --- |
| **Spot “seeded” noise.** Paint a known colour and read it back; do the same for WebGL and audio. If the value comes back changed, the browser is adding noise | P1 | S | Brave and Firefox’s fingerprinting protection add the same noise to every read in one session, so drawing twice and comparing does not catch it. A known answer does |
| **Recognise more privacy modes.** New browser classes for Firefox fingerprinting protection, Safari’s advanced fingerprinting protection, Tor and Mullvad, and Android WebView; Brave’s newer WebGL and WebGPU protections | P1 | M | Signals a browser randomises on purpose should be left out, not counted. Firefox 151 started bringing its protection to normal windows |
| **Read capped values more than once.** Check the CPU core count several times; note Chrome’s new memory buckets | P1 | S | Safari 26 gives some scripts a core count that changes between reads; Chrome 146 plans new memory buckets |
| **Time and version every signal.** Each signal reports how long it took and which revision of its collector ran | P1 | S | Servers can then tell which signals changed and why, and how much each one costs |
| **Keep ids across upgrades.** For one release after a change, also report the id computed the old way | P1 | M | A site can link the old and the new id with certainty instead of losing returning devices |
| **First consistency checks.** Screen size in CSS against JavaScript, time zone in Intl against Date, User-Agent against Client Hints, Playwright’s exposed functions, virtual machine and emulator graphics | P1 | M | Modern automation hides its own traces, but a faked value often disagrees with a second way of reading it |
| **Cheap new signals, outside the id.** Pointer and hover media queries, colour scheme, WebGL2 limits, all WebGPU limits and shader language features, full text and emoji measurements | P1 | M | Each is quick to read and needs no prompt or network; they join the id only once measured as stable |
| **Real browsers in CI.** Chromium, Firefox (also with its privacy settings) and WebKit; the same browser twice must give the same id | P1 | M | A simulated browser cannot show real noise or real timing |
| **Size and speed budgets.** Measure and publish the bundle size; let the page breathe between collectors | P1 | S | Sites choose libraries by cost; long tasks make pages feel slow |
| **Ready for a public repository.** Security policy, automated security checks, licence headers | P1 | S | Needed before the first release and outside contributions |
| **Decide on diagnostics.** An open proposal would send small, sampled diagnostic reports by default, which would change the no-network promise. It waits on the maintainer’s decision | P1 | S | The privacy promise on this site depends on it |

## Next: 1 to 3 months

| Item | Priority | Effort | Why, in plain words |
| --- | --- | --- | --- |
| **Engine version vector.** Which JavaScript, WebAssembly and Intl features exist, and which device APIs are present (presence only) | P1 | M | Adds little to the id but shows when a browser claims to be a version it cannot be |
| **Version mismatch flag.** Fires when a browser claims to be older than a feature it has | P1 | S | Anti-detect browsers often claim another engine or version |
| **More consistency checks.** Graphics names against the platform and WebGPU, two media APIs against each other, impossible window sizes, a phone with no touch, fonts from another operating system | P1 | M | Spoofing tools tend to change one API at a time |
| **Video decoding capabilities.** Whether common codecs decode efficiently, read without any DRM query | P2 | S | Shows hardware video decoders, a real device trait |
| **More rendering signals, reported.** System colours, font smoothing, SVG text sizes, a small GPU maths drawing, screen orientation | P2 | M | Different engine paths give different, mostly stable, results |
| **Compare two canvas types.** Draw the same scene on a normal and an offscreen canvas | P2 | S | Extensions often patch only one of them |
| **Optional worker check.** Only if the site provides a worker file of its own: read key values again inside it and compare | P2 | M | A worker is harder for extensions to fake; the site makes the request, so WhiskerJS still makes none |
| **Version-free variants.** Browser and driver versions also reported without minor numbers | P2 | S | Lets servers compare devices across automatic updates |
| **Optional server package.** A separate open-source package: group-by-group matching that treats very common setups as a crowd rather than one device, header checks, the JA4 TLS fingerprint, and open IP lists | P1 | L | Matching quality is decided on the server; checks across network and browser layers catch scripts that pretend to be browsers |
| **Published test protocol first.** Write down how we will measure uniqueness and stability before collecting any data, including identical twin devices | P1 | M | Published figures vary a lot with who is measured; a fixed protocol makes ours comparable and honest |
| **Real devices, including iPhones.** Nightly runs on a device farm and real Safari | P2 | M | Every iPhone browser outside the EU uses WebKit, and test WebKit is not Safari |
| **Packaging.** Import only the collectors you need; a single script file for script tags; checked types | P2 | M | Smaller pages for sites that need fewer signals |
| **First package release (0.x).** Once the repository is public, published with provenance from CI | P1 | S | Lets anyone verify that the package was built from this source |
| **A page per signal with measured figures.** What each signal reads, how stable and distinctive it measured, and what it costs | P2 | M | Makes the trade-offs open to inspection |

## Later

| Item | Priority | Effort | Why, in plain words |
| --- | --- | --- | --- |
| Learned signal weights in the server package | P2 | M | Weight signals by how stable and distinctive they measured, once there is data |
| Faster matching for large sites | P2 | M | Published linking methods slowed down and lost accuracy at scale |
| Replay test against the anti-replay binding | P2 | M | Research showed that copied browser values can fool matchers |
| A public, opt-in test page | P3 | L | Only with explicit consent, digests only, no IP addresses kept and an ethics review |
| HTTP/2 and later network-level checks in the server package | P2 to P3 | M to L | Separate real browsers from HTTP libraries |
| Small extra signals (CSS support list, passkey capabilities, Global Privacy Control and others) | P3 | S each | Little new information each; useful for consistency |
| GPU timing research module, opt-in and off by default | P3 | L | Can tell identical hardware apart, but costs seconds of GPU work |
| Framework wrappers (React first) | P3 | M | Easier adoption once the core settles |
| External security audit before 1.0 | P2 | M | An outside view of tampering and replay risks |

## Not doing

| What | Why not |
| --- | --- |
| WebRTC, media device lists, network information, battery, geolocation | They can trigger network activity, prompts or permission-linked data |
| Storage quota | Browsers now report it in a way that tells little, and it changes with use |
| DRM key system queries, payment checks, installed related apps | They can show browser UI, fetch files or reveal installed apps |
| Starting sensors, screen details or any device chooser | They prompt the user; only “does this API exist” is read |
| Gamepad values | Empty until the user presses a button, by design |
| Detecting DevTools through the console | Needs console output, and stopped working in 2025 |
| Workers the library builds itself | A page’s security policy can block them and report the block over the network |
| Timing tricks inside the id | Too unstable from run to run |
| Detecting installed extensions | Too invasive for a device collector |
| Mouse and keyboard behaviour in the core | Outside a device collector |
| Parsing the User-Agent in the browser | Belongs on the server |
| JA3 | Chrome shuffles the data it is computed from, so it changes per connection |
| The JA4+ family beyond JA4 | Its licence allows non-commercial use only |
| Scores, verdicts or stored ids in the browser | WhiskerJS collects; the site’s server decides |

## Sources

All sources were read on 2026-10-26. Some were available only as an abstract or a summary; the full roadmap in the library repository (`docs/ROADMAP.md`) marks which.

### Specifications and vendor documentation

- [W3C, Mitigating Browser Fingerprinting in Web Specifications (Group Note, 2025-09-25)](https://www.w3.org/TR/fingerprinting-guidance/)
- [W3C TAG, Unsanctioned Web Tracking (2015-07-17)](https://www.w3.org/2001/tag/doc/unsanctioned-tracking/)
- [W3C WebGPU, privacy considerations](https://www.w3.org/TR/webgpu/)
- [MDN, WGSLLanguageFeatures](https://developer.mozilla.org/en-US/docs/Web/API/WGSLLanguageFeatures)
- [MDN, GPU.getPreferredCanvasFormat](https://developer.mozilla.org/en-US/docs/Web/API/GPU/getPreferredCanvasFormat)
- [MDN, GPUAdapter.limits](https://developer.mozilla.org/en-US/docs/Web/API/GPUAdapter/limits)
- [MDN, GPUAdapter.info](https://developer.mozilla.org/en-US/docs/Web/API/GPUAdapter/info)
- [Chrome, New in WebGPU 120](https://developer.chrome.com/blog/new-in-webgpu-120)
- [web.dev, WebGPU supported in major browsers](https://web.dev/blog/webgpu-supported-major-browsers)
- [W3C CSS Color 4, system colours](https://www.w3.org/TR/css-color-4/)
- [MDN, TextMetrics](https://developer.mozilla.org/en-US/docs/Web/API/TextMetrics)
- [MDN, prefers-reduced-transparency](https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-reduced-transparency)
- [MDN, video-dynamic-range](https://developer.mozilla.org/en-US/docs/Web/CSS/@media/video-dynamic-range)
- [MDN, scripting media feature](https://developer.mozilla.org/en-US/docs/Web/CSS/@media/scripting)
- [MDN, inverted-colors](https://developer.mozilla.org/en-US/docs/Web/CSS/@media/inverted-colors)
- [MDN, Screen.isExtended](https://developer.mozilla.org/en-US/docs/Web/API/Screen/isExtended)
- [W3C Media Capabilities (Working Draft, 2026-10-18)](https://www.w3.org/TR/media-capabilities/)
- [MDN, MediaCapabilities.decodingInfo](https://developer.mozilla.org/en-US/docs/Web/API/MediaCapabilities/decodingInfo)
- [MDN, Storage quotas and eviction criteria](https://developer.mozilla.org/en-US/docs/Web/API/Storage_API/Storage_quotas_and_eviction_criteria)
- [blink-dev, PSA on a predictable reported storage quota](https://groups.google.com/a/chromium.org/g/blink-dev/c/7q0YGQNVkjs/m/mpYkQVWpAQAJ)
- [MDN, Performance.now](https://developer.mozilla.org/en-US/docs/Web/API/Performance/now)
- [MDN, crossOriginIsolated](https://developer.mozilla.org/en-US/docs/Web/API/Window/crossOriginIsolated)
- [MDN, Intl.supportedValuesOf](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Intl/supportedValuesOf)
- [Mozilla bug 2044813, canonical time zones under FPP](https://bugzilla.mozilla.org/show_bug.cgi?id=2044813)
- [MDN, Temporal](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Temporal)
- [web.dev, New to the web platform in May 2025](https://web.dev/blog/web-platform-05-2025)
- [MDN, Error.prototype.stack](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Error/stack)
- [GoogleChromeLabs, wasm-feature-detect](https://github.com/GoogleChromeLabs/wasm-feature-detect)
- [W3C Generic Sensor API](https://www.w3.org/TR/generic-sensor/)
- [MDN, DeviceOrientationEvent.requestPermission](https://developer.mozilla.org/en-US/docs/Web/API/DeviceOrientationEvent/requestPermission_static)
- [WebKit, Tracking Prevention](https://webkit.org/tracking-prevention/)
- [W3C Gamepad](https://www.w3.org/TR/gamepad/)
- [W3C Compute Pressure](https://www.w3.org/TR/compute-pressure/)
- [W3C Device Posture](https://www.w3.org/TR/device-posture/)
- [MDN, PublicKeyCredential.getClientCapabilities](https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredential/getClientCapabilities_static)
- [W3C Payment Request](https://www.w3.org/TR/payment-request/)
- [MDN, Navigator.getInstalledRelatedApps](https://developer.mozilla.org/en-US/docs/Web/API/Navigator/getInstalledRelatedApps)
- [Web Speech API](https://webaudio.github.io/web-speech-api/)
- [Global Privacy Control](https://w3c.github.io/gpc/)
- [MDN, Document.featurePolicy](https://developer.mozilla.org/en-US/docs/Web/API/Document/featurePolicy)
- [MDN, Navigator.userActivation](https://developer.mozilla.org/en-US/docs/Web/API/Navigator/userActivation)
- [Mozilla bug 1320796, service workers in private browsing](https://bugzilla.mozilla.org/show_bug.cgi?id=1320796)
- [MDN, CSP worker-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/worker-src)
- [MDN, Worker constructor](https://developer.mozilla.org/en-US/docs/Web/API/Worker/Worker)
- [MDN, NavigatorUAData.getHighEntropyValues](https://developer.mozilla.org/en-US/docs/Web/API/NavigatorUAData/getHighEntropyValues)
- [Chrome, Headless mode](https://developer.chrome.com/docs/chromium/headless)

### Browser privacy changes

- [Privacy Sandbox feature status (updated 2026-08-14)](https://privacysandbox.google.com/overview/status)
- [Update on plans for Privacy Sandbox technologies (2025-10-17)](https://privacysandbox.google.com/blog/update-on-plans-for-privacy-sandbox-technologies)
- [GoogleChrome/ip-protection (archived 2025-11-03)](https://github.com/GoogleChrome/ip-protection)
- [Incognito Script Blocking explainer](https://github.com/explainers-by-googlers/script-blocking)
- [Chromium, User-Agent Reduction](https://www.chromium.org/updates/ua-reduction/)
- [blink-dev, Intent to Ship: Device Memory limits (2026-01-20)](https://groups.google.com/a/chromium.org/g/blink-dev/c/vXtAmrVZeDk/m/kO39WH6NAwAJ)
- [Android Developers, UA reduction on Android WebView (2024-12-06)](https://android-developers.googleblog.com/2024/12/user-agent-reduction-on-android-webview.html)
- [WebKit, Safari Technology Preview 254 (2026-10-08)](https://webkit.org/blog/18420/release-notes-for-safari-technology-preview-254/)
- [WebKit, Features for Safari 27.0 (2026-09-17)](https://webkit.org/blog/18325/webkit-features-for-safari-27-0/)
- [WebKit, Features in Safari 26.0 (2025-09-15)](https://webkit.org/blog/17333/webkit-features-in-safari-26-0/)
- [WebKit, News from WWDC25 (2025-06-09)](https://webkit.org/blog/16993/news-from-wwdc25-web-technology-coming-this-fall-in-safari-26-beta/)
- [WebKit, Private Browsing 2.0 (2024-07-16)](https://webkit.org/blog/15697/private-browsing-2-0/)
- [WebKit, Features in Safari 17.0 (2023-09-18)](https://webkit.org/blog/14445/webkit-features-in-safari-17-0/)
- [Apple, Safari User Guide: advanced fingerprinting protection](https://support.apple.com/en-gb/guide/safari/ibrw1069/mac)
- [Apple, Alternative browser engines in the EU](https://developer.apple.com/support/alternative-browser-engines/)
- [Mozilla, Firefox fingerprinting protections (2025-11-10)](https://blog.mozilla.org/en/firefox/fingerprinting-protections/)
- [Firefox 151 release notes (2026-05-19)](https://www.firefox.com/en-US/firefox/151.0/releasenotes/)
- [Mozilla wiki, Fingerprinting (2026-05-12)](https://wiki.mozilla.org/Fingerprinting)
- [mozilla-central, RFPTargetsDefault.inc](https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/RFPTargetsDefault.inc)
- [mozilla-central, RFPTargets.inc](https://searchfox.org/mozilla-central/source/toolkit/components/resistfingerprinting/RFPTargets.inc)
- [Firefox source, nsRFPService.h](https://raw.githubusercontent.com/mozilla-firefox/firefox/main/toolkit/components/resistfingerprinting/nsRFPService.h)
- [Mozilla bug 1816189, RFP canvas noise](https://bugzilla.mozilla.org/show_bug.cgi?id=1816189)
- [Mozilla bug 1360039, RFP hardwareConcurrency](https://bugzilla.mozilla.org/show_bug.cgi?id=1360039)
- [Brave, WebGL and WebGPU fingerprinting protections (2026-08-13)](https://brave.com/privacy-updates/38-webgl-webgpu-fingerprinting-protections/)
- [Brave, Sunsetting strict fingerprinting mode (2024-01-18)](https://brave.com/privacy-updates/28-sunsetting-strict-fingerprinting-mode/)
- [Brave, Language fingerprinting protections (2022)](https://brave.com/privacy-updates/17-language-fingerprinting/)
- [Brave, Fingerprinting defenses 2.0](https://brave.com/privacy-updates/4-fingerprinting-defenses-2.0/)
- [Brave wiki, Fingerprinting Protections](https://github.com/brave/brave-browser/wiki/Fingerprinting-Protections)
- [Brave, farbling test page](https://dev-pages.brave.software/fingerprinting/farbling.html)
- [Tor Project, Tor Browser 15.0 (2025-10-28)](https://blog.torproject.org/new-release-tor-browser-150/)
- [Tor Project, Tor Browser 15.0.26 (2026-10-21)](https://blog.torproject.org/new-release-tor-browser-15026/)
- [Mullvad Browser, hard facts (2026-01-13)](https://mullvad.net/en/browser/hard-facts)
- [Microsoft, Edge tracking prevention (2026-09-02)](https://learn.microsoft.com/en-us/microsoft-edge/web-platform/tracking-prevention)
- [DuckDuckGo, web tracking protections](https://duckduckgo.com/duckduckgo-help-pages/privacy/web-tracking-protections/)
- [DuckDuckGo, content-scope-scripts features](https://github.com/duckduckgo/content-scope-scripts/tree/main/injected/src/features)
- [ICO, response to Google’s fingerprinting policy change (2024-12-19)](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/12/our-response-to-google-s-policy-change-on-fingerprinting/)
- [ICO, storage and access technologies: exemptions](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/what-are-the-exceptions/)
- [Google, platforms program policy update (effective 2025-02-16)](https://support.google.com/platformspolicy/answer/15610408?hl=en)
- [EDPB, Guidelines 2/2023 on Article 5(3) ePrivacy, version 2 (2024-10-07)](https://www.edpb.europa.eu/system/files/documents/2024-10/edpb_guidelines_202302_technical_scope_art_53_eprivacydirective_v2_en_0.pdf)
- [EDPB, Guidelines 1/2024 on legitimate interest (2024-10-08)](https://www.edpb.europa.eu/system/files/2024-10/edpb_guidelines_202401_legitimateinterest_en.pdf)

### Academic papers

- [Laperdrix, Bielova, Baudry, Avoine, Browser Fingerprinting: A Survey (ACM TWEB 2020), with the comparison tables for Panopticlick, AmIUnique and Hiding in the Crowd](https://ar5iv.labs.arxiv.org/html/1905.01051)
- [Andriamilanto, Allard, Le Guelvouit, Garel, A Large-scale Empirical Analysis of Browser Fingerprints Properties for Web Authentication (ACM TWEB 2022)](https://ar5iv.labs.arxiv.org/html/2006.09511)
- [Andriamilanto, Allard, Le Guelvouit, FPSelect (ACSAC 2020)](https://ar5iv.labs.arxiv.org/html/2010.06404)
- [Vastel, Laperdrix, Rudametkin, Rouvoy, FP-STALKER (IEEE S&P 2018)](https://ieeexplore.ieee.org/document/8418634)
- [Pugliese, Riess, Gassmann, Benenson, Long-Term Observation on Browser Fingerprinting (PoPETs 2020)](https://petsymposium.org/popets/2020/popets-2020-0041.php)
- [FAU, browser fingerprinting research group](https://www.cs1.tf.fau.de/research/human-factors-in-security-and-privacy-group/browser-fingerprinting/)
- [Eckersley, How Unique Is Your Web Browser? (PETS 2010)](https://www.springerprofessional.de/en/how-unique-is-your-web-browser/3331922)
- [Laperdrix, Rudametkin, Baudry, Beauty and the Beast (IEEE S&P 2016)](https://hal.archives-ouvertes.fr/hal-01285470)
- [Li, Cao, Who Touched My Browser Fingerprint? (IMC 2020)](https://yinzhicao.org/fpmeasurement/imc20.pdf)
- [Liu, Shrestha, Saxena, Gummy Browsers (2021)](https://arxiv.org/abs/2110.10129)
- [Samlioglu, threshold-based linking scheme for browser fingerprints (Sabanci University thesis, 2025)](https://research.sabanciuniv.edu/id/eprint/53631/)
- [Bacis et al., Assessing Web Fingerprinting Risk (WWW 2024)](https://arxiv.org/html/2403.15607)
- [How Unique is Whose Web Browser? The role of demographics in browser fingerprinting among US users (2024)](https://arxiv.org/html/2410.06954)
- [University of Cambridge, SensorID](https://www.cst.cam.ac.uk/node/10022)
- [Kurtz et al., Fingerprinting Mobile Devices Using Personalized Configurations (PoPETs 2016)](https://petsymposium.org/popets/2016/popets-2015-0027.php)
- [Laor et al., DrawnApart (NDSS 2022)](https://arxiv.org/abs/2201.09956)
- [AmIUnique blog, explainer on DrawnApart](https://blog.amiunique.org/an-explicative-article-on-drawnapart-a-gpu-fingerprinting-technique/)
- [Hohentanner et al., AtomicIncrement (WiSec 2025)](https://cris.fau.de/publications/348779971)
- [Laor, Oren, LockedApart (poster)](https://ojs.ub.rub.de/index.php/uASC/article/view/12008)
- [Trampert et al., Cascading Spy Sheets (NDSS 2025)](https://www.ndss-symposium.org/ndss-paper/cascading-spy-sheets/)
- [Fifield, Egelman, Fingerprinting web users through font metrics (FC 2015)](https://blues.cs.berkeley.edu/?p=152)
- [Venugopalan et al., FP-Inconsistent (2024)](https://arxiv.org/abs/2406.07647)
- [Vastel et al., FP-Scanner (USENIX Security 2018)](https://www.usenix.net/system/files/conference/usenixsecurity18/sec18-vastel.pdf)
- [Web Runner 2049 (DIMVA 2020)](https://hal.archives-ouvertes.fr/hal-02612454)
- [Li et al., Good Bot, Bad Bot (IEEE S&P 2021)](https://www.securitee.org/files/goodbotbadbot_oakland2021.pdf)
- [Laperdrix et al., Fingerprinting in Style (USENIX Security 2021)](https://par.nsf.gov/servlets/purl/10301513)
- [Schwarz et al., JavaScript Template Attacks (NDSS 2019)](https://ndss-symposium.org/ndss-paper/javascript-template-attacks-automatically-inferring-host-information-for-targeted-exploits)
- [Patat et al., Widevine client id leakage (PoPETs 2023)](https://arxiv.org/abs/2308.05416)
- [LWN, getClientRects fingerprinting in Tor Browser (2016)](https://lwn.net/Articles/679147/)
- [Mozilla bug 2020894, emoji measureText against DOM widths](https://bugzilla.mozilla.org/show_bug.cgi?id=2020894)
- [Tor bugs list, WebGL readPixels entropy (2019)](https://lists.torproject.org/pipermail/tor-bugs/2019-May/188627.html)

### Automation and anti-detect tools (public documentation)

- [Castle blog, detecting Playwright (2025-03-19)](https://blog.castle.io/how-to-detect-headless-chrome-bots-instrumented-with-playwright/)
- [Castle blog, detecting Puppeteer (2025-03-13)](https://blog.castle.io/how-to-detect-headless-chrome-bots-instrumented-with-puppeteer-2/)
- [Castle blog, why a classic CDP signal stopped working (2025-08-28)](https://blog.castle.io/why-a-classic-cdp-bot-detection-signal-suddenly-stopped-working-and-nobody-noticed/)
- [rebrowser-patches](https://github.com/rebrowser/rebrowser-patches)
- [Patchright](https://github.com/Kaliiiiiiiiii-Vinyzu/patchright)
- [puppeteer-extra-plugin-stealth evasions](https://github.com/berstend/puppeteer-extra/tree/master/packages/puppeteer-extra-plugin-stealth/evasions)
- [undetected-chromedriver](https://github.com/ultrafunkamsterdam/undetected-chromedriver)
- [nodriver](https://github.com/ultrafunkamsterdam/nodriver)
- [Selenium-Driverless](https://github.com/kaliiiiiiiiii/Selenium-Driverless)
- [Camoufox, fingerprint injection](https://camoufox.com/fingerprint/)
- [Multilogin, fingerprint settings help](https://multiloginx.helpjuice.com/en_US/browser-profile-setup/profile-settings-fingerprint-section)
- [Kameleo, product page](https://kameleo.io/)
- [web3dsurvey, WebGL vendor strings (Android emulator)](https://web3dsurvey.com/webgl/vendors/Google%20%28Google%20Inc.%20%28Google%29%29)

### Server-side signals and open data

- [FoxIO, JA4 repository and licences](https://github.com/FoxIO-LLC/ja4)
- [FoxIO, JA4 technical details](https://github.com/FoxIO-LLC/ja4/blob/main/technical_details/JA4.md)
- [Cloudflare, JA3 and JA4 fingerprints](https://developers.cloudflare.com/bots/additional-configurations/ja3-ja4-fingerprint/)
- [Cloudflare, cf.bot_management.ja4 field](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.bot_management.ja4/)
- [Cloudflare Workers, Request and its `cf` properties](https://developers.cloudflare.com/workers/runtime-apis/request/)
- [Go, crypto/tls ClientHelloInfo](https://pkg.go.dev/crypto/tls#ClientHelloInfo)
- [Fastly, a first look at Chrome’s TLS ClientHello permutation](https://fastly.com/blog/a-first-look-at-chromes-tls-clienthello-permutation-in-the-wild)
- [Shuster, Segal, Passive Fingerprinting of HTTP/2 Clients (Black Hat EU 2017)](https://www.blackhat.com/docs/eu-17/materials/eu-17-Shuster-Passive-Fingerprinting-Of-HTTP2-Clients.pdf)
- [Cloudflare blog, JA4 signals](https://blog.cloudflare.com/ja4-signals/)
- [p0f v3](https://lcamtuf.coredump.cx/p0f)
- [Tor Project, bulk exit list](https://check.torproject.org/torbulkexitlist)
- [AWS, IP address ranges](https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-ranges.html)
- [iptoasn.com](https://iptoasn.com/)
- [Spamhaus, DROP lists and terms](https://www.spamhaus.org/blocklists/do-not-route-or-peer/)
- [FireHOL blocklist-ipsets](https://github.com/firehol/blocklist-ipsets)
- [Apple, Prepare your network for iCloud Private Relay](https://developer.apple.com/support/prepare-your-network-for-icloud-private-relay/)

### Engineering, release and governance

- [bundlejs, FingerprintJS 5.3.0 size](https://deno.bundlejs.com/?q=@fingerprintjs/fingerprintjs)
- [bundlejs, ThumbmarkJS 1.12.0 size](https://deno.bundlejs.com/?q=@thumbmarkjs/thumbmarkjs)
- [bundlejs, BotD 2.0.0 size](https://deno.bundlejs.com/?q=@fingerprintjs/botd)
- [FingerprintJS repository](https://github.com/fingerprintjs/fingerprintjs)
- [FingerprintJS, version policy](https://raw.githubusercontent.com/fingerprintjs/fingerprintjs/master/docs/version_policy.md)
- [FingerprintJS, API docs](https://raw.githubusercontent.com/fingerprintjs/fingerprintjs/master/docs/api.md)
- [ThumbmarkJS repository](https://github.com/thumbmarkjs/thumbmarkjs)
- [size-limit](https://github.com/ai/size-limit)
- [webpack, tree shaking](https://webpack.js.org/guides/tree-shaking/)
- [esbuild, API](https://esbuild.github.io/api/#metafile)
- [web.dev, Optimize long tasks](https://web.dev/articles/optimize-long-tasks)
- [MDN, Scheduler.yield](https://developer.mozilla.org/en-US/docs/Web/API/Scheduler/yield)
- [MDN, Long animation frame timing](https://developer.mozilla.org/en-US/docs/Web/API/Performance_API/Long_animation_frame_timing)
- [MDN, OffscreenCanvas](https://developer.mozilla.org/en-US/docs/Web/API/OffscreenCanvas)
- [Next.js, lazy loading](https://nextjs.org/docs/app/guides/lazy-loading)
- [Are the types wrong](https://github.com/arethetypeswrong/arethetypeswrong.github.io)
- [Changesets](https://github.com/changesets/changesets)
- [Playwright, browsers](https://playwright.dev/docs/browsers)
- [Vitest, browser mode](https://vitest.dev/guide/browser/)
- [WebKit, WebDriver support in Safari](https://webkit.org/blog/6900/webdriver-support-in-safari-10/)
- [BrowserStack, open source program](https://www.browserstack.com/open-source)
- [Sauce Labs, Open Sauce announcement](https://saucelabs.com/resources/blog/announcing-open-sauce-free-unlimited-testing-for-open-source-projects)
- [AWS Device Farm pricing](https://aws.amazon.com/device-farm/pricing)
- [Center for Open Science, preregistration](https://www.cos.io/initiatives/prereg)
- [AmIUnique, FAQ](https://amiunique.org/faq)
- [npm, trusted publishers](https://docs.npmjs.com/trusted-publishers)
- [GitHub changelog, npm trusted publishing generally available (2025-07-31)](https://github.blog/changelog/2025-07-31-npm-trusted-publishing-with-oidc-is-generally-available/)
- [GitHub changelog, npm token changes (2025-11-05)](https://github.blog/changelog/2025-11-05-npm-security-update-classic-token-creation-disabled-and-granular-token-changes/)
- [GitHub changelog, classic tokens revoked (2025-12-09)](https://github.blog/changelog/2025-12-09-npm-classic-tokens-revoked-session-based-auth-and-cli-token-management-now-available/)
- [npm, generating provenance statements](https://docs.npmjs.com/generating-provenance-statements)
- [SLSA, security levels](https://slsa.dev/spec/v1.0/levels)
- [OpenSSF Scorecard](https://github.com/ossf/scorecard)
- [OpenSSF Best Practices, passing criteria](https://www.bestpractices.dev/en/criteria/0)
- [GitHub, private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository)
- [Developer Certificate of Origin](https://developercertificate.org/)
- [Apache, applying the Apache License](https://www.apache.org/legal/apply-license.html)
- [Apache, licensing how-to](https://infra.apache.org/licensing-howto.html)
- [REUSE specification](https://reuse.software/spec/)


---

# What's new

> Every signal set and identifier version so far, and what each one changed.

Source: https://whiskerjs.com/whats-new/ (last updated 2026-10-26)

> **In short:**
>
> Since the first collector (30 components, 7 checks) WhiskerJS has grown to **46 components** in **7 groups**, **14 integrity checks**, a **structuredId** for group-by-group similarity, an **anti-replay binding** with your server’s nonce, and an opt-in **onResult hook**, all with no network calls and no storage. The current versions are **signalsVersion 5** and **idVersion 2**. [See it run in the live demo](https://whiskerjs.com/demo/).

WhiskerJS has three version numbers in every result:

- `version`: the library release (0.1.0, not yet published).
- `signalsVersion`: what is measured: the collectors, the integrity checks and the exclusion table. A bump can change ids (when a stable component changes) and flags.
- `idVersion`: how the visitorId and structuredId are derived. A bump changes every id.

Compare ids only within the same `signalsVersion` and `idVersion`.

## 0.1.0 (in development, not published)

Newest first. The live demo runs the current version.

### signalsVersion 5, idVersion 2 (current, main 1100e48)

- Fixed a false positive in the Firefox resistFingerprinting class: stock Firefox under automation such as Playwright (UTC time zone, screen equal to the viewport) was classed `firefox_rfp` and lost nine components. The class now needs every trait at once (an RFP time zone, now also `Atlantic/Reykjavik`; screen equal to the content area; no taskbar space; pixel ratio 1; window at 0,0) and never applies when `navigator.webdriver` is true.
- Id effect: only for Firefox browsers that were wrongly classed before; their `browser_class` and excluded components change.

### Opt-in result hook (no version change)

- `load({ onResult })`: off by default; called with a copy of every result. The library still sends nothing itself.

### idVersion 2 (with signalsVersion 4)

- New `structuredId`: the idVersion and one 48-bit part per signal group (`gpu`, `audio`, `fonts`, `device`, `browser`, `locale`, `prefs`), so two results can be compared group by group. New exports `ID_GROUPS`, `ID_GROUP_ORDER`, `ID_PART_LENGTH`.
- New anti-replay binding: `collect({ binding: { nonce, timestamp } })` echoes them in `result.binding` with a digest over the whole result; `bindingInput()` gives the exact text. Not a signature.
- The visitorId prefix line is now `whiskerjs/id/2`. Id effect: every visitorId changes.

### signalsVersion 4

- Seven new integrity flags: `engine_mismatch`, `iframe_mismatch`, `impossible_hardware`, `permissions_inconsistent`, `plugins_inconsistent`, `prototype_lie`, `webdriver_writable` (14 in total). A clean `about:blank` iframe realm is used for the cross-checks.
- `automation_globals` knows more tools (CEF, CefSharp, Awesomium, FMiner, Geb, Phantomas, WebdriverIO and older drivers).
- Id effect: none (no collector changed).

### signalsVersion 3

- Six new components (46 in total): `webgpu`, `fonts_canvas` and `font_preferences` (in the visitorId), and `canvas_readback`, `audio_latency`, `content_blockers` (not in the visitorId).
- `fonts_canvas` added to the Brave exclusions.
- Id effect: the three new stable components change nearly every visitorId.

### signalsVersion 2

- Ten new components (40 in total): `ua_client_hints`, `cpu_architecture`, `intl_locale`, `heap_limit`, `apple_pay`, `private_click` (in the visitorId), and `ua_versions`, `permissions`, `keyboard_layout`, `screen_frame` (not in the visitorId).
- `screen_frame` added to the Firefox resistFingerprinting exclusions.
- Id effect: the six new stable components change nearly every visitorId.

### signalsVersion 1, idVersion 1 (first collector)

- `load()` and `agent.collect()`, which never throw; a 1000 ms inner timeout per component, an overall budget (default 5000 ms) and abort support.
- 30 components: `audio`, `browser_class`, `canvas`, `color_depth`, `color_gamut`, `device_memory`, `dynamic_range`, `fonts`, `forced_colors`, `hardware_concurrency`, `languages`, `math`, `media_codecs`, `pdf_viewer`, `pixel_ratio`, `platform`, `plugins`, `prefers_contrast`, `reduced_motion`, `screen_resolution`, `speech_voices`, `storage`, `time_zone`, `touch_support`, `vendor`, `vendor_flavors`, `webgl_image`, `webgl_params`, `webgl_renderer`, `webgl_vendor`.
- Seven integrity flags: `automation_globals`, `automation_webdriver`, `headless_markers`, `headless_user_agent`, `native_tampering`, `navigator_own_property`, `software_renderer`.
- Large values reported only as the first 128 bits of SHA-256.
- visitorId over the stable components with the prefix `whiskerjs/id/1`.
- Exclusion table for Brave farbling and Firefox resistFingerprinting.