FingerprintJS alternatives, and the free one nobody mentions

First, the confusion, because it sends people to the wrong page.

FingerprintJS is a free library. MIT licensed. It runs inside your own code, reads a few dozen browser settings, and hands you a hash.

Fingerprint Pro is the paid product built on that idea. It is much better at telling returning browsers apart, and it runs on their servers, not yours.

Same name, different products, opposite trade-offs. This is about the free one.

The free one beats every paid vendor at one thing#

Including us. So let us get it out of the way first.

Every hosted fingerprinting service loads a script from their own domain. That script has to run before anything happens. And ad blockers know exactly which domains those are:

EasyPrivacy    ||fpjs.io^$third-party
EasyList       ||fpnpmcdn.net^

Browsers like Brave and Mullvad ship uBlock Origin, which uses both lists by default.

We ran Pro's script and our own side by side across privacy browsers. Pro's script did not run at all on 21 of 24 sessions. Not a weak answer. No answer, because it never loaded.

The free library does not have this problem. It lives in your own bundle, served from your own domain, indistinguishable from the rest of your code. There is no outside request to block.

That advantage belongs to the free option, not the paid one. Our collector is hosted too, so the same thing applies to us. We are not on those lists yet only because nobody has added us.

What you give up#

Accuracy. And the gap is real.

A fingerprint is a hash of browser settings. Identical settings make identical hashes. A default iPhone really is identical to another default iPhone.

On our own live traffic, one iPhone fingerprint covered 2.31 different people.

The library cannot fix that, because fixing it needs something the browser does not have: either a token you saved earlier, or a view of everyone else's fingerprints. Pro sells the second one.

So the real choice is not free versus paid. It is "a hash of settings" versus "an identity", and which you need depends on what you do next.

What a raw fingerprint is good enough for#

Fine: remembering a setting, counting free article views, linking analytics sessions, spotting one browser opening forty accounts in an hour.

Not fine: refusing a payout, banning an account, or anything where being wrong costs you a real customer.

At 2.31 people per fingerprint you are not banning a fraudster. You are banning everyone who owns the same phone.

That line does not move based on which library you pick.

Making it safer, cheaply#

If you stay with a free library and still want to act on repeats, two things help more than a better fingerprint.

Remember instead of guessing. Give the browser your own signed cookie and read it back next visit. Now you are not guessing the identity, you are recalling it. That takes our collision risk from 0.21 on iPhones down to about 0.01, and it is just a cookie your server sets.

Check the network too. Two accounts sharing a fingerprint on different networks is usually a coincidence. On the same network it is a much stronger case. That is one extra column in your own database.

The alternatives#

ThumbmarkJS. Newer, free, same shape, more current code. Worth testing against FingerprintJS on your own traffic rather than assuming either wins.

ClientJS. Older and simpler. More a bag of browser properties than an identity library. Good if you want the raw values and will build your own key.

Write your own. Canvas, WebGL, audio, fonts, screen size and timezone hashed together is a weekend of work and gets you most of the way. Worth knowing, so you can judge whether a library is really saving you anything.

Fingerprint Pro. If telling returning browsers apart is your product, and ad blockers are not much of your traffic, buy it. A decade of focused work is not something a weekend replaces, and we do not claim to beat them at it.

Where we fit#

We are not a fingerprinting library. We return a decision, not an identifier: allow, review or block, with the reasons attached.

If you already collect a device id and just want the decision, the two work together. Nothing needs the id to come from us:

import FingerprintJS from "@fingerprintjs/fingerprintjs";

const fp = await (await FingerprintJS.load()).get();

const { verdict, reasons } = await kaidn.score({
  event: "signup",
  user_id: user.id,
  ip,
  email: user.email,
  device_id: fp.visitorId,   // self-hosted, ad-blocker proof
});

You keep the part that made the free library attractive, and you add the things a fingerprint cannot know: what the email really is, what kind of network it came from, and how fast the same pattern is repeating across other accounts.