Product review
Castle browser fingerprinting review
Castle uses device and behavioral evidence around account actions. Its API returns risk and policy context for signup, login and account-abuse workflows, with different billing units for Risk API calls and IP lookups.
Editorial score
Browser/device signals for account security
Free access
5 US dollars API usage/month: up to 1,000 Risk API calls
Paid entry
Pro: 200 US dollars/month, including 40,000 Risk API calls
Key facts
- Identity and matching scope
- Castle uses device and behavioral evidence around account actions. Its API returns risk and policy context for signup, login and account-abuse workflows, with different billing units for Risk API calls and IP lookups. Vendor page ↗
- Result to inspect
- Device evidence, risk scores and policy outcomes Vendor page ↗
- Access and pricing
- 5 US dollars API usage/month: up to 1,000 Risk API calls. Pro: 200 US dollars/month, including 40,000 Risk API calls. Compare the actual plan, product and usage unit. Vendor page ↗
- Developer evaluation
- Evaluate known repeat visits and different browsers separately. Include cleared storage, privacy settings, browser upgrades, shared devices, missing collection and delayed results. Inspect the returned identifiers and reasons before connecting them to an account action. Vendor page ↗
Strengths
- Risk, automation and account signals are relevant to protected account events.
- Free usage supports a controlled API evaluation.
- Public documentation explains signals, metrics and policy integration.
Limitations
- IP-lookup allowances should not be counted as Risk API calls.
- History, operational tooling and throughput depend on the plan.
Who it fits
Developer-led account-security teams that need device context and configurable action policies.
Use the alternatives by evidence need to compare overlapping device, identity, behavior and automation capabilities.
What the score means
The 8.4 out of 10 score is an editorial assessment under the same 40-criterion, seven-category framework. It weighs identity persistence, evasion resistance, risk evidence, response contracts, developer experience, maintenance and fit.
Editor’s Choice is a separate recommendation. Read all criteria and relative weights and evaluate the entitled product on the product flow you protect.
How to evaluate it
Evaluate known repeat visits and different browsers separately. Include cleared storage, privacy settings, browser upgrades, shared devices, missing collection and delayed results. Inspect the returned identifiers and reasons before connecting them to an account action.
Free API allowance
Use the free allowance for a controlled Risk API evaluation; confirm retention and throughput before a larger pilot.
Open evaluation routeSources and further reading
- Product and detection approach · checked October 22, 2026
- Pricing and access · checked October 22, 2026
- Integration and result documentation · checked October 22, 2026
- Vendor guide or technical reading · checked October 22, 2026
FAQ
What does Castle return?
Device evidence, risk scores and policy outcomes. Castle uses device and behavioral evidence around account actions. Its API returns risk and policy context for signup, login and account-abuse workflows, with different billing units for Risk API calls and IP lookups.
Who should evaluate Castle?
Developer-led account-security teams that need device context and configurable action policies.
How can I try Castle?
Use the free allowance for a controlled Risk API evaluation; confirm retention and throughput before a larger pilot. 5 US dollars API usage/month: up to 1,000 Risk API calls. Pro: 200 US dollars/month, including 40,000 Risk API calls.
Explore checkers, demos and evaluation routes →