FingerprintJS vs Pro: Where the Identification Actually Happens
The fingerprintjs vs pro question comes down to where identification happens. FingerprintJS is a free, self-hosted JavaScript library that computes a browser hash inside the visitor’s page. Fingerprint Pro is a hosted API, free to 1,000 calls a month, that resolves a visitor ID on Fingerprint’s servers using network signals the library cannot see. Choose the library for prototypes and internal tooling. Choose Pro when an ID must survive months and resist tampering.
📌 TL;DR Executive Summary
- Core Takeaway: The library gives you a free client-side browser hash you host yourself. Pro resolves a visitor ID server-side, adding IP, TLS, header order and behavioural signals, plus incognito detection, a query API and webhooks. Pro Plus is listed at $99/mo for 20,000 web and iOS calls, then $4 per 1,000 extra.
- Key Risk/Challenge: Client-side hashes age fast. The vendor rates browser-only accuracy as significantly lower and warns the values can be altered or reverse-engineered. Both products also need an ePrivacy Article 5(3) consent basis unless a genuine fraud or security exception covers the use.
- Recommended Solution: Ship the library first if you need a hash and full data control, then move to Pro when IDs must persist or you need network-level signals. Fingerprint only the endpoints where a decision is made, or the call bill will outgrow the project.
Side-by-Side: Library vs Pro
The fingerprintjs vs pro split looks narrow on paper and wide in production. The two share a name and a signal set, then diverge on five things that decide the purchase: where the work runs, which signals are visible, how long an ID lasts, who holds the data and what you pay.
| Capability | FingerprintJS (open source) | Fingerprint Pro |
|---|---|---|
| Where it runs | In the visitor’s browser, inside your own page | Resolved on Fingerprint’s servers, hosted in the US, EU or APAC |
| Signals available | Canvas, audio, fonts, WebGL, media queries — roughly forty registered entropy sources in v5 | Same client signals plus IP, TLS signature, HTTP header order and behavioural data |
| Extra detections | None | Bot, VPN and proxy, tampering, virtual machine and incognito detection on Pro Plus and Enterprise |
| Visitor ID lifetime | Several weeks, per the vendor | Months to years, per the vendor |
| Where data lives | Your own infrastructure | Vendor side, encrypted at rest, unlimited storage |
| Entry cost | $0, under a Business Source License | Free plan at 1,000 web and iOS calls a month; Pro Plus listed at $99/mo for 20,000 |
How Each One Actually Identifies a Browser
The mechanism explains everything downstream. A fingerprint computed in the page and one resolved on a server carry different reliability, different maintenance costs and different legal exposure.
FingerprintJS: a hash computed inside the page
You install the library, it runs in the visitor’s browser, and it returns a hash built from whatever that browser exposes. In the v5 line — v5.2.0 was tagged in April 2026 — that means canvas rendering, audio processing, installed fonts, WebGL output, media query results and a registry of roughly forty entropy sources.
Everything happens on the client: no round trip to a Fingerprint endpoint, no account, no per-call bill. The trade-off is structural. The library has no IP address, no TLS signature, no HTTP header order and no behavioural signals — only what a page can ask a browser about itself.
Fingerprint Pro: the same signals resolved server-side
Pro takes the client-side result and resolves the visitor ID on Fingerprint’s servers, layering on network-level signals the library cannot reach. That is how the vendor justifies months to years of identifier lifetime against several weeks for the standalone library. Pro also adds incognito detection, a query API, webhooks, geolocation, a 99.9% uptime SLA and a choice of US, EU or APAC hosting.
If you are mapping the category, our roundup of browser fingerprinting APIs for returning visitors covers how hosted options compare on signal depth. Fingerprint publishes its own library-versus-API breakdown at fingerprint.com/github, which is the fairest source for what the free library does and does not do.
Accuracy: Why a Client-Side Hash Ages Fast
A browser fingerprint is a snapshot of a moving target. Browser updates change canvas output, font lists and WebGL strings, and a single patch release can flip a large share of returning visitors into new hashes. The vendor’s README says it plainly: browser-only accuracy is significantly lower, and the returned values are vulnerable to tampering and reverse engineering.
Tampering is the harder problem to engineer around. Anything a page can read, a determined user can alter, and the library runs in an environment that user fully controls. Server-side resolution narrows that gap without closing it, which is why Pro leans on combining client signals with network ones rather than trusting any single source.
To watch the drift yourself, work through our guide on checking how unique your browser fingerprint is across two browser update cycles. Values you assumed were stable move; values that looked random hold. That churn is the maintenance burden you accept when you self-host.
What Smart Signals Add — and What They Don’t
Smart Signals, available on Pro Plus and Enterprise, are server-computed judgements layered on top of the visitor ID:
- Bot detection — flags automated traffic from behaviour and environment rather than a user-agent string.
- VPN and proxy detection — reports whether the request arrived through a network that obscures origin.
- Tampering detection — catches clients where the JavaScript agent has been modified or blocked.
- Virtual machine detection — identifies browsers running inside a VM.
- Incognito detection — reports private-browsing sessions that otherwise look like first-time visitors.
None of them makes the decision for you. Each is a probability input, and every threshold trades false positives against false negatives. A payments team that blocks every VPN hit turns away legitimate customers on corporate networks; a support team that ignores tampering flags misses the sessions that matter. Plan a review queue for the first month rather than a hard block.
Pricing: $0, $99/mo and the Overage Math
Pricing is where the fingerprintjs vs pro comparison gets concrete. One bills per call and the other does not. Here is the published structure as of late 2026; confirm current tiers on the vendor page before budgeting, because third-party sites disagree on the entry price.
| Plan | Price | Included volume | Notes |
|---|---|---|---|
| FingerprintJS library | $0 | Unlimited self-hosted calls | Business Source License: development use allowed, some production use restricted |
| Fingerprint Free | $0/mo | 1,000 web and iOS calls | Up to 500,000 Android calls a month also free; includes a 14-day Pro Plus trial |
| Fingerprint Pro Plus | $99/mo | 20,000 web and iOS calls | $4 per 1,000 extra calls; annual terms handled through sales |
| Fingerprint Enterprise | Custom | Custom | 99.9% uptime SLA, US/EU/APAC hosting, Smart Signals included |
Run the arithmetic before you commit. A site with one million monthly visitors typically produces three to five IDs per session once you count landing pages, checkout and post-login views — three to five million API calls a month. At $4 per 1,000, a 500,000-call overage alone comes to roughly $2,000 per month. Pro Plus is cheap at 20,000 calls and expensive at 3 million.
Two commercial details matter as much as the headline price. The open-source library moved to a Business Source License, which permits development use but restricts some production use — read it before you ship it inside a commercial product. Fingerprint also applies two-level surge protection and waives API charges during a DDoS attack, which matters if traffic spikes are part of your risk model. Verify the figures on Fingerprint’s pricing page rather than a comparison blog; several of those pages sell a competing product.
GDPR and ePrivacy: When Fingerprinting Needs Consent
Both products process personal data in the EU, and the rule that bites is Article 5(3) of the ePrivacy Directive, amended in 2009. It requires prior informed consent before storing or accessing information on a user’s terminal equipment, with a narrow exception for what is strictly necessary to deliver a service the user requested.
The EDPB removed the ambiguity in Guidelines 2/2023, adopted on 7 October 2024: fingerprinting falls within Article 5(3), and consent is required. The surrounding law is still moving — the ePrivacy Regulation proposal was withdrawn with effect from 6 October 2025, and a November 2025 Digital Omnibus draft would fold cookie rules into GDPR Articles 88a and 88b. The Directive governs today, so design for it today.
What counts as strictly necessary
The carve-out is real but narrow. It generally covers anti-fraud and service-security work: account takeover detection, bot mitigation at login and payment endpoints, rate limiting against credential stuffing.
- Covered in practice: fingerprinting at the login endpoint to spot a credential-stuffing pattern, or at checkout to flag a card-testing run.
- Not covered: fingerprinting every visitor on every page to build behavioural profiles, measure funnels or attribute campaigns.
If Neither Fits: Three Alternatives
The market between “free library” and “enterprise platform” is not empty. Each of these fills a gap the two Fingerprint products leave open.
- ThumbmarkJS — an MIT-licensed per-browser hash library with a hosted API free to 1,000 calls a month and a Pro tier at €15/mo for 15,000 calls. The permissive licence is the draw; tamper resistance in the free version is limited.
- SEON — a commercial fraud platform with server-side device IDs and a much wider data set. One vendor comparison puts entry pricing from $699/mo, so it is a different budget bracket entirely.
- DataDome — bot protection that includes device fingerprinting inside a broader traffic-filtering product. Custom pricing, aimed at sites defending against automated abuse rather than building their own signals.
How Send.win Helps With Fingerprintjs Vs Pro
Send.win is a browser profile manager for professionals and teams: every account gets its own isolated browser profile.
- Isolated profiles – separate cookies, storage and sessions per profile
- Fingerprint protection – each profile keeps its own consistent browser fingerprint, so profiles never share one browser identity
- Desktop app + cloud browser – native app for Windows, macOS and Linux, or run profiles in the cloud with no install
- Residential proxies included – on Pro and Team, with timezone and locale matched to the proxy
- Team sharing – share a signed-in profile with a teammate without sharing the password
Try the free cloud demo — no install — or download the desktop app. Paid plans start at $19/month, and your first card purchase is covered by a 7-day money-back guarantee (see pricing).
For a wider spread of options and a note on where each one’s numbers come from, see our open-source vs paid FingerprintJS alternatives comparison. Treat vendor-published accuracy percentages sceptically — much of that material is written by companies selling a rival product.
Which Should You Pick?
There is no universal answer to fingerprintjs vs pro. The decision follows three facts you already know: how much traffic hits your decision endpoints, who on your team has to maintain the integration, and what legal basis you can document.
You are prototyping, or data cannot leave your servers
Start with the open-source library. You will have a hash in an afternoon, no procurement, and full control of the data. Budget for the work you are taking on: browser updates churn your IDs, so you will need your own fuzzy matching to stitch old hashes onto new ones. If that maintenance never pays off, you have spent nothing finding out.
You run signup, login or payments on your own site
Go to Pro. The signals that catch account takeover — IP, TLS, header order, behavioural patterns — are exactly the ones the library cannot see. Start on the free tier at 1,000 calls a month, put the call only on decision endpoints, then move to Pro Plus at $99/mo. If you expect six-figure call volume, model the overage before you sign.
You serve an EU audience
Either product works, but consent design comes first. Document the purpose, confirm the strictly-necessary argument genuinely applies, and keep fingerprinting off any page where it is really analytics in disguise. If the carve-out does not hold, collect consent — and make the banner honest about what it enables.
When You Are Not Identifying Visitors at All
Some readers land on this comparison from the other direction: not running a website, but operating a stack of client, brand or storefront accounts in a browser. Send.win does not identify visitors on your site and produces no visitor IDs for it, so as a Fingerprint Pro replacement it is the wrong tool. It has no API, SDK, headless mode or automation interface on any plan, and the local Automation API was retired on 12 October 2026.
What it does is manage browser profiles. Each profile keeps its own consistent browser fingerprint alongside its own cookies, storage and sessions, so profiles do not share one browser identity, and fingerprint handling is a privacy feature built into the Chromium-based engine rather than a tracking mechanism. Timezone, locale, WebRTC and geolocation follow the proxy’s exit IP automatically. You run it as a desktop app on Windows, macOS or Linux, or in Send.win’s cloud browser hosted in Helsinki, Finland.
There is one genuine overlap. If you are building a Fingerprint integration, you need to see what your own code collects from a fresh browser, a returning one, a different region and a corporate network. Separate profiles with their own proxies let you test those cases without wiping your real browser each time. Our explainer on residential proxy software covers why the exit IP changes what a fingerprint script reports.
🏆 Send.win Verdict
Send.win does not compete with FingerprintJS or Fingerprint Pro on visitor identification, and this comparison would be dishonest if it pretended otherwise. It covers the other half of the workflow: when your day is spent inside client accounts, storefronts and test users rather than one website you own, you need separate, consistent browser profiles — own cookies, storage, sessions, fingerprint settings and proxy — instead of carrying one browser identity across every login. Up to 50 profiles open at once, residential proxies included on both plans, and flat per-seat pricing suit a team far better than per-call billing.
See Send.win plans — Pro at $19/mo or $83.88/yr, Team at $49/mo or $251.88/yr, both with residential proxies and a 7-day money-back guarantee on your first card purchase, or start with the free cloud demo.
Frequently Asked Questions
Is FingerprintJS free to use commercially?
The library costs nothing to download and run, but it moved to a Business Source License that allows development use while restricting some production use. Check the current licence text against your deployment model before shipping it inside a commercial product. If your use falls outside the allowance, Fingerprint Pro or a permissively licensed alternative is the cleaner route.
What is the difference between FingerprintJS and Fingerprint Pro?
FingerprintJS is a self-hosted library that computes a browser hash on the client. Fingerprint Pro is a hosted API that resolves the visitor ID on Fingerprint’s servers, adding IP, TLS, HTTP header order and behavioural signals on top of the client-side data. The vendor puts identifier lifetime at several weeks for the library and months to years for Pro.
How much does Fingerprint Pro cost per month?
The free plan covers 1,000 web and iOS calls a month, plus up to 500,000 Android calls. Pro Plus is listed at $99/mo for 20,000 web and iOS calls, with $4 per 1,000 extra; annual terms go through sales. Enterprise pricing is custom and includes the 99.9% uptime SLA.
Can FingerprintJS track the same user across browsers?
Not on its own. The library produces a per-browser hash, so Chrome and Safari on the same laptop return different values. Pro improves the odds with network-level signals, but no fingerprinting method links two browsers with certainty — treat cross-browser identity as a probability, not a fact.
Is browser fingerprinting GDPR compliant?
It can be, with the right legal basis. The EDPB’s Guidelines 2/2023, adopted on 7 October 2024, confirm that fingerprinting falls under ePrivacy Article 5(3) and needs prior informed consent, with a narrow exception for what is strictly necessary. Anti-fraud work at login and payment endpoints usually qualifies for that exception; analytics and cross-site tracking do not.
Do ad blockers and privacy browsers break FingerprintJS?
They can degrade it. Content blockers may interfere with the script, and privacy-focused browsers apply their own fingerprint protection, which changes or randomises the values a page reads. That is a legitimate user choice rather than a bug to defeat, so make your fraud logic degrade gracefully instead of hard-blocking those visitors.
Can Send.win replace FingerprintJS or Fingerprint Pro?
No. Send.win is a browser profile manager, not an identification service — it produces no visitor IDs for your website. It is the tool for people operating many owned or client accounts in isolated profiles, which is a different job from detecting fraud on a site you run.