7 Browser Fingerprinting JavaScript Libraries Compared

Which Browser Fingerprinting JavaScript Library Should You Install?

A browser fingerprinting JavaScript library is a small client-side package that reads signals — canvas output, WebGL renderer strings, audio, fonts, screen metrics, hardware limits — and hashes them into an identifier. In 2026 the realistic shortlist is FingerprintJS, ThumbmarkJS, ClientJS, CreepJS, ImprintJS and Benny the Doorman, plus Fingerprint’s hosted commercial API. Choose on three things: the licence, whether you need cross-browser identity, and whether you can live with a per-call bill.

What a Fingerprinting Library Actually Computes

Every browser fingerprinting JavaScript library on this list runs the same three steps: call browser APIs, normalise the results, hash the combination. ThumbmarkJS collects from more than 15 signals by default — canvas, WebGL, audio, fonts, hardware, locale, permissions and speech synthesis among them. FingerprintJS covers over 40 signals and ships in under 15 KB gzipped, with more than 3 million monthly npm downloads; those figures come from vendor-friendly write-ups rather than an independent benchmark.

Two hard limits apply to all of them. A client-side library sees only what the page can see, so the TLS handshake and the exit IP never reach it — those need a server-side component. And a hash is only useful if it is stable: the same browser on the same machine with the same settings must return the same value next week. Change the browser version, the font set or the GPU driver and the hash moves.

That stability requirement explains why browser-level protections look the way they do. Firefox’s privacy.resistFingerprinting adds noise to canvas output and standardises several values, lowering entropy for every visitor who enables it. A library that expects pixel-exact canvas results degrades the moment a visitor turns that on.

What Still Works in 2026 — and What Is Fading

Chrome froze the user-agent string at Chrome 107 in late 2022, pinning the reported OS to Windows NT 10.0 on Windows and stripping most platform detail. navigator.plugins now returns a fixed generic array in both Chrome and Firefox. Both were bread-and-butter inputs for older libraries, and both now carry near-zero entropy.

Canvas remains the workhorse, but it is eroding. A September 2026 technical audit by one developer put it at roughly 80% of browsers, with no published methodology behind the number — treat that as a working estimate, not a figure you can quote in a contract. This blog’s breakdown of canvas fingerprinting in 2026 covers which rendering variations still separate devices.

WebGL holds up better. GPU renderer strings stay diverse across hardware, and pixel output is genuinely hard to standardise without breaking legitimate rendering. Screen size, by contrast, is close to worthless on its own: a 1920×1080 display at a 1× pixel ratio describes tens of millions of devices.

The durability leader is not a JavaScript signal at all. TLS fingerprinting in the JA4 style rates high entropy and very high durability because the network stack generates it and JavaScript cannot read or alter it. If you are building a scoring model, pair the JS hash with a network-level signal rather than stacking more canvas variants.

7 Browser Fingerprinting JavaScript Libraries Compared

1. FingerprintJS (open source)

FingerprintJS is the library most developers meet first, and it does one job well: return a single per-browser hash from a broad set of signals. The catch is the licence. It is no longer plain open source — it moved to the Business Source License, which permits development use but restricts some production use, so read the terms before you ship it inside a commercial product. Self-hosting costs nothing per call because there is no hosted service behind it.

• Pros: Free to self-host; small bundle; the hash is computed locally with no network round trip.
• Cons: Licence restricts some production use; one per-browser hash only; no server-side scoring or cross-browser matching.

Best for: teams that want a self-hosted hash and can live with the licence terms.

2. ThumbmarkJS

ThumbmarkJS is MIT-licensed, actively maintained, and it lets you include or exclude individual components rather than handing you one fixed signal set. Each component carries a default 5-second timeout, so a single slow API cannot stall the whole hash. It ships as UMD, ESM and CommonJS with React, Vue, Angular and Preact wrappers. Its own pricing page quotes roughly 80% indicative uniqueness for the open-source build against about 99% for the hosted tiers.

• Pros: MIT with no per-call fee; per-component control; framework plugins; documented include/exclude options.
• Cons: Per-browser hash only; no network-level signals; bot, VPN, datacenter and threat-level detection sit behind the paid tiers.

Best for: teams that want an MIT library they can tune signal by signal.

3. ClientJS

ClientJS is Apache-2.0 licensed, lightweight and readable, wrapping ordinary browser properties into a numeric fingerprint. The problem is time: its last public release was 2021, and it has no WebGL readback, no WebGPU work and no modern canvas techniques. It also returns a single per-browser value with no hosted equivalent.

• Pros: Permissive licence; tiny; easy to read the source and see exactly which properties it touches.
• Cons: Effectively unmaintained; misses signals added since 2021; weaker uniqueness than current libraries.

Best for: legacy codebases already depending on it, and for reading source to see how earlier signal collection worked.

4. CreepJS

CreepJS is an MIT-licensed research and demonstration project rather than an identifier library. It collects deep signals, reports where a browser’s claimed values do not match what it actually does, and prints a detailed trust report with a lie-detection score. It is excellent at telling you what a browser update silently changed. It is not a stable hashed identifier — two runs can produce different reports, and the report format evolves with the project.

• Pros: Free and MIT; very deep signal coverage; surfaces browser changes early.
• Cons: No stable hash; heavy to run; output format changes between versions.

Best for: QA engineers and researchers checking how a browser build behaves after an update.

5. ImprintJS

ImprintJS is a newer MIT library with no dependencies. Tests are registered as promises and exposed through an alias plus a factory method, so you can compose your own test set; built-in test names include canvas, webGl, installedFonts and processorCores, and custom tests simply return a promise. The documentation carries no publication or update date, so maturity and maintenance cadence cannot be confirmed from it alone.

• Pros: Zero dependencies; promise-based extensibility; easy to add one test without pulling in a framework.
• Cons: Unverified maturity; small community; no hosted tier; per-browser hash only.

Best for: teams that want to assemble a bespoke test set from a small base.

6. Fingerprint (hosted, formerly FingerprintJS Pro)

Fingerprint is the commercial platform, and it solves the two things no client-side library can: cross-browser identity and server-side scoring. You call the API, and it resolves a visitor ID using IP intelligence and machine-learning checks, with native mobile SDKs alongside. Pricing is per API call — an entry Pro plan around $99/month including 20,000 calls, with roughly $4 per 1,000 additional calls as of 2026, per a third-party pricing comparison. Treat those figures as indicative and confirm them with the vendor, because overage dominates the bill: one analysis estimates 500,000 extra calls at roughly $2,000 on that rate.

• Pros: Server-resolved visitor IDs; cross-browser matching; mobile SDKs; far less engineering than self-hosting.
• Cons: Per-call cost scales with traffic; visitor data leaves your stack; vendor lock-in.

Best for: fraud and risk teams whose traffic volume justifies per-call billing.

7. Benny the Doorman

Benny the Doorman is free but closed source. Its distinguishing feature is that it splits hardware-bound signals from engine-bound signals, returning a per-browser hash plus a separate hardwareFingerprint hash and offering compareFingerprints with six match modes — so you can ask whether two visits are the same machine in a different browser. Note that its published comparisons of other libraries are the vendor’s own view of the market.

• Pros: Hardware versus engine separation; match modes for comparison; free to use.
• Cons: Closed source, so signal handling cannot be audited; small ecosystem; no hosted option.

Best for: teams that need to distinguish a shared machine from a shared browser engine.

Quickstart: ThumbmarkJS in Ten Lines

The fastest way to see what a browser fingerprinting JavaScript library returns is to run it against your own browser. Install the package, exclude the components you do not want in your model, and log the hash. Component exclusion matters more than it sounds: dropping audio or WebGL removes signals that are unstable on virtualised hardware and on browsers with noise injection enabled.

import { getFingerprint, setOption } from '@thumbmarkjs/thumbmarkjs'

// Leave out components that are noisy on your visitor base
setOption({ exclude: ['audio', 'webgl'] })

const result = await getFingerprint()

// Older builds return the hash as a string; newer ones return an object
const hash = typeof result === 'string' ? result : result.thumbmark

console.log('per-browser hash:', hash)

ThumbmarkJS lets you switch components on and off, and the 5-second default timeout per component keeps one slow API from stalling the whole hash. If you need a test the library does not ship, ImprintJS registers tests as promise-returning functions behind an alias and a factory method — a pattern worth copying before you write your own collector. To see where the raw values come from and how engine-level differences are separated from hardware differences, start with JavaScript engine fingerprinting.

Licence and Real Cost: Self-Hosted vs Per Call

The licence question bites earlier than the pricing question. FingerprintJS moved to the Business Source License, which allows development use but restricts some production use — a distinction that matters if you are shipping a commercial product rather than an internal tool. ThumbmarkJS stayed MIT, so if the terms of one library do not fit your product, the other is the obvious place to look.

Then compare total cost of ownership honestly. A self-hosted library is free per call but costs engineering time: you build collection endpoints, storage for the hash, collision handling and your own scoring. A hosted tier is the reverse — no infrastructure, but a bill that tracks traffic, and overage rates that are easy to underestimate. ThumbmarkJS’s free hosted tier covers 1,000 calls a month, with Pro at 15€/mo covering 15,000 calls and 0.001€ for additional calls; you can check current tiers on ThumbmarkJS’s pricing page.

Run that arithmetic against your own numbers before you commit. Take your expected monthly fingerprint volume, price it at the per-call rate, and compare it with the engineer-weeks you would spend building and maintaining the self-hosted path. Traffic growth is the variable that flips the answer, so model the bill at double your current volume before choosing.

Cross-Browser Identity: Why One Device Returns Two Hashes

Here is the limitation that surprises most teams. No browser fingerprinting JavaScript library in the table above produces a cross-browser identifier on its own: FingerprintJS and ThumbmarkJS both return a per-browser hash, so the same physical laptop returns a different value in Chrome and in Safari. Nothing is broken — the hash describes the browser environment, not the human. If you need “this is the same person on a new browser”, you need a server-side component that also reads network and request-level data.

The concept to internalise is browser fingerprint entropy: some signals are cheap to change and some are not. User-agent and locale are trivial to alter; WebGL renderer strings and CPU core counts move only with hardware. A stable, boring fingerprint with consistent values beats an exotic one whose values contradict each other, because contradictions are exactly what a trust report or a risk model flags.

If you manage several client accounts from one workstation, the same mechanism shows up in reverse. Each isolated browser profile keeps its own settings, so it produces its own hash; profiles do not collapse into one identity. Where a platform limits how many accounts one person may hold, follow its rules and use its official route — Meta’s Business Manager roles for agencies, or Amazon’s approval process for an additional seller account. Nothing in a fingerprinting library changes those terms.

Why Profile Consistency Matters Next to Your Fingerprint Hash

Send.win is not a fingerprinting library and it does not return a visitor ID. It is the layer underneath for teams running several accounts: a browser profile manager where each profile keeps its own cookies, storage, sessions, fingerprint settings and proxy, handled inside the browser engine so profiles do not share one browser identity. Sendwin Browser is the desktop app for Windows 10/11, macOS 12+ and Linux, built on Chromium; the cloud browser runs profiles on Send.win’s servers in Helsinki, Finland, and needs nothing installed on your machine.

Two details connect directly to this list of libraries. First, per-profile consistency: timezone, locale, WebRTC and geolocation follow the proxy’s exit IP automatically, which removes the mismatched values that make a hash look contradictory to a risk model. Pro and Team both include residential proxies — 5 GB a month on Pro, 20 GB on Team — plus bring-your-own HTTP or SOCKS5, and every plan allows up to 50 profiles open at once. Second, handover: sharing a profile with a paid teammate opens it already signed in, and cloud sync makes logins follow you across devices. There is no API, SDK, headless mode or automation interface on any plan, so treat it as the environment your fingerprinting stack observes rather than a scoring engine itself — and use it for accounts you own or are authorised to manage. If profiles drifting into one shared identity is your problem, the isolation mechanics are worth reading up on: browser isolation.

Before You Ship: Consent, Collisions and Deprecation

Treat a stable visitor identifier as personal data. In most jurisdictions a value that singles out a returning browser earns the same treatment as a cookie: a lawful basis, clear disclosure, a retention limit and a way to honour deletion requests. Deciding this after you have collected six months of hashes is considerably more expensive than deciding it before your first deploy.

Next, measure collisions instead of trusting vendor copy. Run a second browser fingerprinting JavaScript library in parallel on a sample of your own traffic and compare how often the two disagree on the same visit. Where they agree on nearly every visit, either will do for most scoring models; where they diverge tells you which signals your traffic actually depends on. Then plan for deprecation: build so that a missing or timed-out component lowers confidence rather than breaking the hash entirely, because user-agent detail and plugin enumeration are already gone and canvas is the next candidate.

Frequently Asked Questions

Is FingerprintJS free to use commercially?

Partly. The open-source library is free to self-host with no per-call fee, but it is licensed under the Business Source License, which permits development use and restricts some production use. Read the licence text against your own use case before shipping it inside a commercial product, and treat the hosted Fingerprint platform as a separate paid service.

What is the difference between FingerprintJS and ThumbmarkJS?

The biggest difference is licence and control. FingerprintJS is under the Business Source License and returns one per-browser hash; ThumbmarkJS is MIT, actively maintained, and lets you include or exclude individual components with a 5-second default timeout per component. ThumbmarkJS also publishes hosted tiers, with 1,000 free API calls a month and Pro at 15€/mo for 15,000 calls.

Does FingerprintJS recognise the same device in Chrome and Safari?

No, not by itself. Both FingerprintJS and ThumbmarkJS produce per-browser hashes, so the same laptop returns a distinct hash in each browser. Cross-browser matching is a hosted-platform feature that combines the client hash with server-side data such as IP intelligence and request characteristics.

Do canvas fingerprinting libraries still work in 2026?

Yes, but with caveats. One developer’s September 2026 audit estimated canvas still separates roughly 80% of browsers, and no methodology was published for that figure, so treat it as an estimate. No browser fingerprinting JavaScript library gets far on canvas alone — noise injection in browsers such as Firefox’s privacy.resistFingerprinting cuts uniqueness further, which is why the current ones combine canvas with WebGL, audio and hardware signals.

Can I use CreepJS in production?

Not as an identifier. CreepJS is an MIT research and demonstration tool that prints a trust report with a lie-detection score, and it does not return a stable hashed value — two runs can differ. It is genuinely useful for QA and for spotting what a browser update changed, but you would need a separate library for production identification.

Is ClientJS still maintained?

Effectively no. Its last public release was in 2021, and it lacks WebGL readback, WebGPU support and newer canvas techniques. The Apache-2.0 licence and readable source still make it useful for understanding how earlier fingerprint collection worked, but new builds should start elsewhere.

How do I customise the signals ThumbmarkJS collects?

Use the include and exclude options to control which components feed the hash; each component has a 5-second default timeout so a slow one cannot stall the result. If you need a test the library does not ship, look at ImprintJS: it registers tests as promises behind an alias and a factory method, and custom tests return a promise of their own.

Does running many browser profiles break per-browser fingerprint hashes?

No — it does the opposite. Each isolated profile keeps its own settings, so each produces its own hash, which is what you want when you manage several authorised accounts side by side. What a hash cannot tell you is who owns the hardware, and where a platform limits how many accounts one person may hold, that limit still applies.

How Send.win Helps With Browser Fingerprinting Javascript Library

Send.win is a browser profile manager for professionals and teams: every account gets its own isolated browser profile.

• Isolated profiles – separate cookies, storage and sessions per profile
• Fingerprint protection – each profile keeps its own consistent browser fingerprint, so profiles never share one browser identity
• Desktop app + cloud browser – native app for Windows, macOS and Linux, or run profiles in the cloud with no install
• Residential proxies included – on Pro and Team, with timezone and locale matched to the proxy
• Team sharing – share a signed-in profile with a teammate without sharing the password

Try the free cloud demo — no install — or download the desktop app. Paid plans start at $19/month, and your first card purchase is covered by a 7-day money-back guarantee (see pricing).

Related Products & Resources

• Download
• Demo Browser
• Pricing
• Fingerprint Checker
• Canvas Fingerprint Test