Browser fingerprinting API methodology
The full 40-criterion, seven-category framework behind the ten editorial scores. Inspect identification, evasion resistance and the response contract.
Scope and product boundaries
This comparison covers browser and device identity APIs, relevant risk platforms and open-source collection libraries. They expose different outputs: a local fingerprint, hosted identity, account-risk result or request-path decision. Reviews make those boundaries explicit so adjacent protection layers are not mistaken for interchangeable APIs.
Pure geolocation feeds, standalone challenges and cross-site advertising identity are outside the intended first-party security comparison. Research demonstrations can help explain entropy but do not automatically qualify as maintained production APIs. An absent self-serve evaluation is an access condition, not proof that a capability is absent.
Scoring rubric: 40 criteria in 7 categories
| Category | Criteria | Weight | What is assessed |
|---|---|---|---|
| Identification quality and persistence | 8 | 24 percent | persistence across cleared cookies and storage; recognition in incognito; stability across browser upgrades and device changes; persistence across IP changes and proxies; false-merge avoidance over raw attribute count; entropy depth (canvas, WebGL, audio, fonts, hardware, Client Hints); telling near-identical devices apart, since uniqueness is not identity; and server-side matching tolerant of attribute drift. |
| Evasion, tamper, and spoof resistance | 7 | 18 percent | spoofed user-agent and platform values; anti-detect browsers and fingerprint randomization; headless automation (Puppeteer, Playwright, Selenium); virtual machines and emulators; detection of contradictory signals and patched browser APIs; server-side corroboration against replayed or forged hashes; and how public the bypass surface is. |
| Risk signals and fraud intelligence shipped with the ID | 5 | 17 percent | VPN, proxy, Tor, residential proxy, and datacenter flags returned with the ID; incognito, virtual machine, tamper, and bot flags; an explainable scored output with reasons, not one opaque number; ready detections for multi-accounting, account sharing, impossible travel, and account takeover; and device history such as accounts per device. |
| Response contract: latency, schema, and failure handling | 4 | 9 percent | a genuine server-side API with a request ID, not a client-only library; real-time latency and uptime at login and checkout; a stable, versioned JSON schema; and failure behavior when collection is blocked. |
| Integration and developer experience | 4 | 6 percent | public docs and time to first call without a sales gate; a sandbox key and SDKs with framework examples; webhooks and an event model; and raw per-signal data to join with confirmed outcomes. |
| Coverage, reliability, and maintenance | 5 | 12 percent | behavior under Safari ITP, Brave, and Firefox protections; resilience when ad blockers interfere with collection; browser and OS spread; maintenance against each new browser privacy change, and who carries it; and validation on production traffic rather than synthetic samples. |
| Privacy, pricing, and fit | 7 | 12 percent | first-party security use, not cross-site tracking; consent, retention, and residency controls; treating the fingerprint as personal data under GDPR and CCPA; published per-identification pricing, not per-MAU or quote-only; a self-serve free tier with a real API; fit for the job, from identification to fraud decisioning or owning the code; and procurement burden, managed or self-hosted. |
Scores, weights and Editor’s Choice
Editorial scores use a scale from 0 to 10. The published category weights total 98 points; the rubric reserves the remaining two points for evidence quality and vendor responsiveness as a tie-breaker. Identity persistence and evasion resistance carry the greatest category weights. A score expresses product fit across this framework.
Editor’s Choice highlights ShieldLabs for accessible browser identity with current device/network intelligence, explainable risk context and ready-made account-abuse detection. The award does not raise its score. A self-hosted library, dedicated hosted identifier or edge protection system can fit another requirement.
Evaluate persistence, mistakes and coverage
- Define whether the target is a returning browser profile, device relationship or account action. Keep that label independent of the detector.
- Collect permitted known repeats and distinct-browser observations. Include privacy settings, storage resets, browser upgrades and normal network changes.
- Record collection availability, component changes, identity result and the protected action’s event reference.
- Measure correct re-links, false merges and false splits with explicit denominators. Keep unavailable results separate.
- Test trusted retrieval, delayed results, webhook retries, missing fields and the legitimate-user recovery path.
Read the false-merge and false-split guide. A uniqueness demonstration and long-term recognition answer different questions.
What counts as evidence
Primary product pages establish published scope. Documentation explains identifiers, response fields and integration. Pricing pages establish the named plan, unit and period. Vendor guides contribute context and further reading; they do not independently validate comparative accuracy.
When a plan redirects to a demo or requires a quote, the comparison says so. A free lookup quota does not establish free access to every product. No price is invented for an unpublished entitlement.
How to read a figure
| Marking | Meaning |
|---|---|
| Published value | The linked vendor page supplies the number and access conditions. |
| Custom quote or confirm entitlement | A comparable public price or feature allowance is not established for the requested product. |
| Illustrative evaluation | A proposed procedure or defined measure, not a claimed customer result. |
| Open source / hosted | Different products or architectures under a related brand; their capabilities are assessed separately. |
Product facts were checked October 22, 2026. A reading date establishes the source check; it does not imply a new comparative benchmark.
Editorial policy
Divya Kulkarni and the Browser Identity Review editorial team maintain the publication. Sources are linked so readers can inspect the basis for a feature, plan or integration claim. No provider can purchase a score, ranking position or Editor’s Choice. Commercial inquiries are handled separately from factual corrections.
Corrections
Send the page URL, precise passage and a dated primary source through Contact. Identify the product, version or plan involved. A source-backed correction can change coverage without a commercial arrangement.