As of 28 October 2026
Device fingerprinting solutions for developers: libraries and hosted services compared
Device fingerprinting options fall into three groups: open-source libraries that run in the browser, hosted services that identify the visitor on a server, and fraud platforms that include device identification among many other signals. Which fits depends on whether you need an identifier you can trust, a decision, or just a rough hint.
Client-side libraries
A library runs in the visitor’s browser and produces an identifier there. It is free to adopt and keeps data in your own stack, but anything computed in the browser can be read, replayed or changed by the person using it.
- FingerprintJS (open source): described in its README as an open-source, client-side browser fingerprinting library under the MIT licence. It produces a hashed visitor identifier in the browser, installed from npm or loaded from a CDN. The README says its accuracy is significantly lower than the commercial version because processing happens in the browser, and that browser-side fingerprints are vulnerable to spoofing and reverse engineering. Suits: prototypes, low-stakes analytics, personalisation.
- ThumbmarkJS: a free, open-source JavaScript library (MIT) that runs entirely in the browser and cannot run server-side. Its README also describes a separate hosted ThumbmarkJS API with a free tier that adds server-side inputs, bot detection and VPN, Tor and datacenter identification. Suits: teams that want a lightweight library and an optional hosted upgrade.
- ClientJS: a pure JavaScript library (Apache-2.0) that returns a numeric fingerprint and exposes browser, OS, device and screen details. Its repository shows no releases, so check that it is maintained before you depend on it. Suits: simple client-side identification where a collision costs little.
Hosted identification services
- Fingerprint (fingerprint.com): a commercial device intelligence platform that identifies web and mobile visitors, with Smart Signals such as VPN, incognito and tampering, and bot and AI agent detection. It maintains the open-source FingerprintJS library and describes its own platform as closed source. You get an identifier and signals and write the rules. Suits: teams that want rich signals and their own decision logic. Our direct comparison has the details.
- FingerPrint Checker: a hosted API that returns a decision (allow, a human check or deny) with a reason, for free trials, coupons, quotas and referrals. The agent runs in the browser or app and the identifier is computed on our server. Web, Android, iOS and macOS SDKs and server SDKs for Node.js, Python, Go, Java, PHP and .NET; client SDKs and the protocol are Apache-2.0. We run one API region, incognito detection works only in Chrome and Firefox on desktop, and mobile device signals are recorded but not scored yet. Suits: teams that want one-claim-per-person enforced without writing the rules.
Fraud platforms with device identification
- SEON: describes itself as a fraud prevention and AML compliance platform, with Device Intelligence, Digital Footprint, behavioral biometrics and AI agent and bot detection among its products. Its home page does not describe fingerprinting as a separate product. Suits: regulated businesses that want identity checks and compliance in the same platform.
- Castle: a fraud and account-abuse platform that lists device fingerprinting, IP intelligence, bot detection, risk scoring, email intelligence and real-time allow, challenge or deny rules behind one API. Suits: teams fighting account takeover and fake sign-ups who want scoring and rules in one place.
Build it yourself
You can collect browser attributes yourself and match them on your server. That gives full control and no vendor, and it is a real option for a small, low-stakes use. The cost is in what comes after: keeping matching stable as browsers change, handling identical devices, spotting tampering, and keeping up with the signals that browsers restrict. A library gets you the first step; the server side is where most of the work is.
FingerprintJS alternative: client-side ID or server-verified ID →
How to choose
- Low stakes, no budget: a client-side library.
- You want signals and your own rules: a hosted identification service with a signal catalogue.
- You want a decision, not signals: a decision API such as ours.
- You need identity checks and compliance as well: a fraud platform.
- Not sure: try our free browser fingerprint test to see what a server-side ID looks like next to a library.
Sources
Statements about other tools come from their own public pages. Check them, since sites change.
- https://github.com/fingerprintjs/fingerprintjs (read 28 October 2026)
- https://fingerprint.com/ (read 28 October 2026)
- https://github.com/thumbmarkjs/thumbmarkjs (read 28 October 2026)
- https://github.com/jackspirou/clientjs (read 28 October 2026)
- https://seon.io/ (read 28 October 2026)
- https://castle.io/ (read 28 October 2026)
Frequently asked questions
What is the difference between FingerprintJS and Fingerprint Pro?
FingerprintJS is the open-source client-side library under the MIT licence. Fingerprint Pro is the commercial hosted product, which the library’s README says adds server-side processing and higher accuracy.
Is a JavaScript fingerprint enough to stop abuse?
For low-stakes cases it can help. Because the identifier is built in the browser, someone motivated can change what it reports, which is why abuse prevention usually relies on a server-computed identifier.
Is this comparison complete?
No. It covers what we could confirm from each tool’s own public pages on the date above, and leaves out anything we could not check. Tools change; if something here is out of date or wrong, tell us through the contact form and we will correct it.
Try it on your own sign-up flow
Every new account gets 2,000 free checks. No card required.