9 Top Browser Fingerprinting APIs for Returning Visitors

Which Browser Fingerprinting API Recognises a Returning Visitor?

The short answer: the top browser fingerprinting apis for identifying returning visitors are Fingerprint for confident hosted visitor IDs, ThumbmarkJS for a cheap open-source-plus-hosted path, cside for a first-party script, and Castle or SEON when the fingerprint has to feed a risk decision. Each returns a probabilistic browser handle, not a person. Matching works only when you link that handle to your own account ID and gate actions on confidence.

How These Fingerprinting APIs Were Judged

Fingerprinting vendors publish their own accuracy figures, and many round-up blogs that rank them are written by vendors ranking themselves. Treat every percentage as a claim with a methodology attached, then test it on your own traffic. Each option below is scored on seven criteria — the same list you should apply when you shortlist the top browser fingerprinting apis for identifying returning visitors yourself.

• Signal coverage: browser attributes (canvas, WebGL, audio, fonts, hardware) plus server-side signals (TLS, headers, IP reputation). Browser-side alone is the weakest configuration.
• Published accuracy: is there a uniqueness or continuity number, and does the vendor say how it was measured?
• Confidence scoring: can your backend see how sure the API is, so it can choose between allow, step-up and block?
• Server-side verification: can you confirm the ID from your own server instead of trusting the client?
• SDK behaviour: documented caching rules, payload weight, and whether the key ships to the browser.
• Price at your volume: free allowance, entry tier, overage rate, and whether you can cap spend.
• Data handling: retention, region and what the vendor does with the signals it collects.

If you also run several browser profiles for client work, our breakdown of how to compare browser fingerprinting APIs against profile isolation covers the parts vendor documentation leaves out.

The 9 Top Browser Fingerprinting APIs for Returning Visitors

Ordered by how fast a normal team can put each one into production, not by marketing budget. If you need the mechanics first, read what a browser fingerprint is before you pick a vendor.

1. Fingerprint (Pro Plus) — the default hosted visitor ID

Fingerprint returns a visitor ID, a confidence score and Smart Signals, and lets your backend confirm the identification server-side instead of trusting the client payload. Its documentation is specific: call start() at page load, call get() on demand, leave at least one second between the two, and cap the visitor ID cache at one hour in sessionStorage.

• Pros: free tier of 1,000 API calls a month; Pro Plus at $99/month covers 20,000 web and iOS calls plus 500,000 Android calls, with $4 per extra 1,000; confidence scoring and server-side verification are built in.
• Cons: cost scales fast at volume, and the client-side agent still needs your backend to make the actual decision.

Best for: teams that need a dependable returning-visitor ID and a number they can defend in a budget meeting. Confirm current allowances on Fingerprint’s pricing page.

2. ThumbmarkJS — open-source core, cheap hosted tier

The MIT-licensed library builds a hash in the browser and, by the project’s own figure, reaches about 80% uniqueness. Its hosted API adds TLS and HTTP header signals and reports about 99%. Version 1.12.0 shipped in September 2026 on a roughly monthly cadence, so it is actively maintained.

• Pros: free 1,000 calls a month; Pro is €15/month for 15,000 calls, then €0.001 per extra call; you set a monthly cap and get email alerts at 90% and 100%.
• Cons: API keys are public by design because they live in client-side code, so protection depends on allowed hostnames in the console — rotate or disable a key if a domain leaks.

Best for: small teams that want an open-source core, an optional server-side upgrade and a hard spending ceiling.

3. cside — first-party script with a wide signal set

cside ships a first-party script that collects more than 250 signals and returns a persistent visitor ID alongside bot, AI agent and VPN signals, so one payload covers identification and traffic quality.

• Pros: free 1,000 calls a month; Business is $99/month for 50,000 calls with a 14-day trial.
• Cons: most published comparisons come from the vendor’s own blog, so measure the match rate on your own traffic before committing.

Best for: teams that want script-level bot signals next to the fingerprint rather than a second vendor.

4. DigitalFingerprint — the cheapest identifies, with an honest caveat

DigitalFingerprint gives 1,000 free identifies a month and a Pro tier at $40/month for 20,000 identifies, with $2 per 1,000 overage and smart signals through a server-side Events API. Its documentation is plain about limits: the originId is a browser handle, not a unique-human or cross-device ID.

• Pros: the lowest paid entry point on this list; the vendor itself tells you to gate on confidence plus account rather than the ID alone.
• Cons: the ≥99% same-browser continuity figure comes from a 500-visitor test the vendor ran, so it is a claim, not an independent result.

Best for: cost-sensitive products that will do their own backend gating anyway.

5. Castle — device evidence for account security

Castle packages the fingerprint as risk evidence: device context, a risk score and a policy outcome your backend can act on. It is built for login, signup and password-reset flows rather than analytics.

• Pros: a $5/month API allowance covers up to 1,000 Risk API calls, so a pilot is cheap; Pro at $200/month includes 40,000 calls.
• Cons: you are buying a decision engine, not a raw ID, which fits security workflows better than product instrumentation.

Best for: account-security and trust-and-safety teams that need policy outcomes, not hashes.

6. SEON — fraud enrichment around the device

SEON combines device context with fraud enrichment and workflow evidence, so the fingerprint arrives next to email, phone and IP intelligence instead of on its own.

• Pros: one vendor for device, identity and network signals; trials available on request.
• Cons: Starter is $699/month for 2,500 fraud checks, which prices out small teams and means a sales conversation.

Best for: fraud teams that want device signals inside a wider enrichment stack.

7. IPQualityScore — device ID plus network reputation

IPQualityScore provides device identifiers with network and fraud-risk context. It is the pragmatic pick if your stack already uses its IP, email or phone checks and you would rather not add another vendor.

• Pros: free account and lookup access to start; network-reputation data is the strong half of the offer.
• Cons: the device-fingerprinting scope and the plan that includes it must be confirmed with the vendor — the public material is vague on both.

Best for: teams consolidating risk checks rather than adding a specialist fingerprint API.

8. FingerprintJS (open source) — free, and narrower than people assume

FingerprintJS returned to the MIT licence at version 5.0.0, so commercial production use is free again. Version 5.3.0 shipped in October 2026 and returns a single client-side hash with no cross-browser identity and no server-side check on the result. Its own README states the accuracy is significantly lower than the commercial product.

• Pros: genuinely free, a small integration, and fine for prototypes, internal tooling and low-stakes deduplication.
• Cons: everything runs in the browser, so the value is bounded by what a client-side hash can prove.

Best for: prototypes and internal dashboards where a rough returning-visitor signal is enough. Three neighbours are worth knowing: ClientJS last shipped v0.2.1 in October 2021, BotD v2.0.0 (MIT, November 2025) returns a bot/not-bot verdict rather than a visitor identity, and CreepJS is a research and demonstration project, not a production identification library.

9. Radar Reveal — session risk rather than a sticky ID

Reveal is a session-risk and location product rather than a classic persistent visitor ID, which is why it sits last. A third-party 2026 round-up lists pricing from $2.00 per 1,000 API calls; treat that as reported rather than confirmed and check the current terms with the vendor.

• Pros: risk scoring and location evidence in one place, useful when you already score sessions and want the signals joined up.
• Cons: no classic cross-session visitor ID pitch, so it complements an identification API rather than replacing one.

Best for: teams that want session risk alongside a visitor ID, not instead of it.

Comparison Table: Free Tier, Paid Entry and Best Use

The top browser fingerprinting apis for identifying returning visitors differ most on free allowance, paid entry point and what the vendor will confirm in writing.

Every figure above reflects what vendors published in October 2026, and they change often — confirm on the vendor’s own pricing page before you budget for the year.

Visitor ID, Device ID and Account ID Are Not the Same Thing

A visitor ID is a hash scoped to one browser on one device. A device ID implies something stronger — hardware-level or cross-browser — and most of these products cannot honestly deliver that; DigitalFingerprint says as much about its own originId. An account ID is the only identifier you control, which is why the linking step matters more than the vendor choice.

Matching is probabilistic. The API returns a hash plus, in the better products, a confidence score, and your backend decides what to do with it: act silently at high confidence, demand a second factor at medium, fall back to email verification at low. Skipping that ladder is how teams lock out real customers or wave through a shared browser.

Entropy is the other half of the story. A browser with a common canvas hash, a stock font list and a mainstream GPU carries far less identifying information than a machine with unusual settings, and no API can manufacture uniqueness that is not there. Our explainer on fingerprint entropy explained walks through the arithmetic.

How to Wire a Returning-Visitor Check

Whichever of the top browser fingerprinting apis for identifying returning visitors you install, the pattern is similar: start the agent early, request the ID only when you need it, cache briefly, then verify server-side. This example uses Fingerprint’s JavaScript agent and its documented one-hour cache ceiling.

// Load the agent once per page; call get() only when you need the ID.
import FingerprintJS from '@fingerprintjs/fingerprintjs-pro';

const fpPromise = FingerprintJS.load({ apiKey: 'PUBLIC_API_KEY' });
const ONE_HOUR = 60 * 60 * 1000;

export async function getVisitorId(accountId) {
  const cached = sessionStorage.getItem('vid');
  const storedAt = Number(sessionStorage.getItem('vid_at') || 0);

  if (cached && Date.now() - storedAt < ONE_HOUR) {
    return { visitorId: cached, confidence: null, fromCache: true };
  }

  const fp = await fpPromise;
  // Fingerprint asks for at least one second between start() and get().
  const result = await fp.get({ linkedId: accountId });

  sessionStorage.setItem('vid', result.visitorId);
  sessionStorage.setItem('vid_at', String(Date.now()));

  return {
    visitorId: result.visitorId,
    confidence: result.confidence ? result.confidence.score : null,
    fromCache: false
  };
}

Four rules keep this honest. Cache in sessionStorage, not localStorage, and expire at one hour, because a stale ID degrades accuracy after the browser or network changes. Never let the client decide: post the ID to your server and confirm it before you trust it. Always send your session’s account ID along as linkedId so the vendor can return every ID ever attached to that account. And log the decision you took, not just the ID, so you can audit false matches later. The visitor identification docs cover the timing and caching rules in more detail.

Consent, Lawful Basis and Retention

Fingerprinting is generally lawful with a valid legal basis, but the basis differs by jurisdiction. In the EU and UK, ePrivacy plus GDPR point to opt-in consent before you read device signals for anything beyond strictly necessary security. In California, CCPA/CPRA names device fingerprints as unique personal identifiers and works on an opt-out model with notice. Many US state laws carry a security-of-service carve-out for strictly fraud-prevention use.

That carve-out is fragile. It collapses the moment the same fingerprint also feeds analytics, retargeting, A/B testing or any other non-security purpose, because the purpose is no longer strictly security. If your fraud team and your growth team share one ID, you have merged the two purposes whether you meant to or not.

Retention is the part teams forget. A visitor ID that lives for two years is a persistent identifier with a long tail of obligations; one that lives for 90 days is easier to justify and easier to delete on request. Write down the purpose, the basis, the retention window and who can query the data, then have counsel review that page — none of the above is legal advice.

Where Profile Isolation Fits in the Workflow

Everything above assumes you are the one doing the measuring. Flip it around and there is a second problem: a QA or support team has to test the returning-visitor rules from several clean states — brand-new visitor, returning visitor, visitor in another region — without one test contaminating the next. Clearing cookies by hand between runs produces messy results and no record of what was tested.

That is where a browser profile manager earns its place. Send.win runs isolated profiles that each keep their own cookies, storage, sessions, fingerprint settings and proxy, and that fingerprint handling sits inside its Chromium-based engine as privacy protection, so profiles do not share one browser identity. You can run the same flow as a first-time visitor in one profile and a returning visitor in another, and keep a third pointed at a different region through its proxy, because timezone, locale, WebRTC and geolocation follow the proxy exit IP.

Two practical notes. The desktop app covers Windows, macOS and Linux, and the cloud browser hosted in Helsinki lets a support agent reproduce a customer’s view from any device without installing anything. Sharing a profile with a paid teammate opens it already signed in, and cloud sync carries logins across devices. There is no API, SDK or automation, so every session is manual, and there is no free trial of the desktop app — the cloud demo gives you 10 minutes a day.

How to Pick by Use Case

Match the top browser fingerprinting apis for identifying returning visitors to the job in front of you:

• Login and account-security decisions: Castle or SEON, because you want a policy outcome rather than a hash.
• Product analytics and returning-visitor dedupe: Fingerprint for the most complete documentation and confidence scoring, cside if you also want bot signals.
• Tight budget at real volume: ThumbmarkJS with its user-set cap, or DigitalFingerprint’s $40/month tier.
• Prototype or internal tool: FingerprintJS open source, with the expectation that you replace it before launch.
• QA and agency work across many accounts: one of the APIs above for measurement, plus separated browser profiles to test from.

Whatever you shortlist, run it against your own traffic for a week and compare with a cohort you can verify independently, such as logged-in users. Our round-up of browser fingerprint test tools shows how to check what a page actually exposes before you blame the vendor.

Frequently Asked Questions

Which fingerprinting API is most accurate for returning visitors?

There is no independent benchmark covering all vendors. ThumbmarkJS reports roughly 80% uniqueness for its open-source library and about 99% for its hosted API; DigitalFingerprint claims ≥99% same-browser continuity on Chromium from a 500-visitor test it ran itself. Both are vendor methodology, so validate against a cohort of users you can identify independently.

Is FingerprintJS free for commercial use?

Yes. The open-source library returned to the MIT licence at version 5.0.0, and v5.3.0 shipped in October 2026 under the same terms. The catch is capability rather than licensing: it returns a single client-side hash with no cross-browser identity and no server-side verification, and its README states the accuracy is significantly lower than the commercial product.

How much does Fingerprint Pro Plus cost per month?

Pro Plus is $99/month and includes 20,000 web and iOS API calls plus 500,000 Android calls per month, with $4 per additional 1,000 calls. The free tier stops at 1,000 API calls per month. Confirm the current numbers on the vendor’s pricing page before committing to an annual budget.

How long should I cache a visitor ID?

An hour at most, stored in sessionStorage. Fingerprint’s own guidance caps the cache at one hour because a stale ID reduces identification accuracy after the browser or network changes. Re-request the ID on demand rather than holding it in localStorage across sessions.

What is the difference between a visitor ID and a device ID?

A visitor ID identifies a browser profile on a device; a device ID implies something that survives a browser change or represents the hardware itself. Most products on this list deliver the former. DigitalFingerprint states plainly that its originId is a browser handle, not a unique-human or cross-device identifier.

Do fingerprinting libraries work across Chrome, Safari and Firefox?

The libraries run in all three, but a hash from a Chrome session will not match a hash from a Safari session on the same machine. Cross-browser identity is not something these products promise, and the attributes each engine exposes differ enough that a same-device match across browsers is unlikely.

Are open-source libraries accurate enough for fraud decisions?

Usually not on their own. A client-side hash is reset by cleared storage, altered by private mode and changeable by anyone who controls the page. Use it as one signal among several — account history, device reputation, network intelligence and step-up authentication — rather than as the deciding input.

Is browser fingerprinting legal under GDPR and CCPA?

Generally yes, with the right basis. EU and UK practice requires opt-in consent for anything beyond strictly necessary security; California uses an opt-out model and treats device fingerprints as unique personal identifiers; several US state laws carve out strictly fraud-prevention use, and that carve-out breaks if the same data also feeds analytics or retargeting. Retention limits and jurisdiction-specific rules apply, so have counsel review your setup.

How Send.win Helps With Top Browser Fingerprinting Apis For Identifying Returning Visitors

Send.win is a browser profile manager for professionals and teams: every account gets its own isolated browser profile.

• Isolated profiles – separate cookies, storage and sessions per profile
• Fingerprint protection – each profile keeps its own consistent browser fingerprint, so profiles never share one browser identity
• Desktop app + cloud browser – native app for Windows, macOS and Linux, or run profiles in the cloud with no install
• Residential proxies included – on Pro and Team, with timezone and locale matched to the proxy
• Team sharing – share a signed-in profile with a teammate without sharing the password

Try the free cloud demo — no install — or download the desktop app. Paid plans start at $19/month, and your first card purchase is covered by a 7-day money-back guarantee (see pricing).

Related Products & Resources

• Download
• Demo Browser
• Pricing
• Fingerprint Checker
• Canvas Fingerprint Test