Short answers to the questions developers ask about device fingerprinting and Fingerly, grouped by topic. Each links to the page that has the detail. New to the idea? Start with what device fingerprinting is.
The basics
What is device fingerprinting?
Device fingerprinting recognises a device from characteristics it already exposes, such as properties of its browser and operating system, instead of an identifier stored on it. A script or SDK reads the characteristics, a server compares them with what it has seen before, and the same device gets the same identifier on its next visit. See what device fingerprinting is.
What is browser fingerprinting?
Browser fingerprinting is device fingerprinting for a web browser. Fingerly's JavaScript SDK sends what it reads to the server, which resolves a visitor ID, and nothing is stored in the browser. See device fingerprinting vs cookies.
What is a visitor ID?
A visitor ID is the stable identifier Fingerly issues for a device: twenty letters and digits, scoped to your organization. It is issued by Fingerly and never derived from the device's data, so it reveals nothing about the device. See visitor identification.
What is the difference between a device ID and a visitor ID?
"Device ID" is the everyday name for an identifier of a device. Fingerly's is the visitor ID. It is not a hardware identifier: apps are recognised by a random install ID the SDK keeps, and SDKs never read identifiers such as the advertising identifier or ANDROID_ID.
What is device intelligence?
Device intelligence is what you learn about a device and session from one identification: a stable visitor ID, a suspect score and level, network context such as country and anonymising networks, and, on your backend, the signals behind the score. See how Fingerly works.
What is a suspect score?
The suspect score is the sum of the weights of the signals that fired in a session, such as a Tor connection or an automated browser. It is not a percentage and has no maximum. Compared with your threshold, it gives a level of low, medium or high. See suspect score.
How long does an identification take?
In a browser, identify() typically resolves within a few hundred milliseconds. The initial collection is capped at 300 ms, and slower signals follow for up to 1,200 ms more as a deferred report that never changes the answer. The mobile SDKs collect within a default budget of 1,200 ms.
Accuracy and limits
Is device fingerprinting accurate?
Fingerly reports how sure each match is rather than a single accuracy figure. visitor_confidence runs from 0 to 100: 100 means this exact device was seen before, 85 to 99 that it was recognised after it changed, and 0 that nothing matched. Treat every answer as evidence for your own rules, not a verdict. See visitor identification.
Can device fingerprinting be spoofed?
A determined attacker who controls a browser or a device can change what it sends. Fingerly raises signals when a runtime has been modified or claims to be something it is not, and on mobile, hardware attestation raises the cost of forging a report. Neither makes forgery impossible, which is why you decide on your server and tune the response. See mobile app attestation.
Does device fingerprinting work in incognito or private mode?
The browser SDK keeps nothing in the browser, so it does not depend on cookies or storage that a private window starts empty. A private window is also reported as the incognito_mode signal, which adds to the score. How well a given browser can be matched depends on what it exposes, and a browser that gives too little comes back identifiable: false.
Does device fingerprinting work on mobile apps?
Yes, with the iOS and Android SDKs, not the browser SDK. In apps the device is recognised by a random install ID the SDK keeps, and device signals feed the integrity checks and the score. On iOS the ID survives a reinstall, and on Android a reinstall gets a new visitor ID. See what device fingerprinting is.
Can device fingerprinting identify a person?
No. A visitor ID identifies a device. Several people can share one device, and one person can use several. Visitor IDs are also scoped to your organization, so Fingerly does not link them across customers.
What happens when a device cannot be identified?
The response has identifiable: false, the device gets a fresh visitor ID each time, the fingerprint_suppressed signal fires, and the request is still scored and is free. Do not count these as returning or unique visitors.
Does a VPN change the visitor ID?
A VPN changes the network, not the device, and the browser visitor ID is designed to survive travel between networks. A VPN is reported separately, in anonymity_network and the vpn signal group.
Privacy and legal
Is device fingerprinting legal?
It depends on where your visitors are, what you use it for and your lawful basis, and nothing in these docs is legal advice. Fingerly collects nothing until you pass consent: granted, so you can gate it behind your consent flow. See privacy and consent.
Do I need consent to use Fingerly?
Whether you need consent, and for what, depends on your lawful basis and where your visitors are. Every SDK takes a consent option that defaults to pending, and until it is granted the SDK reads and sends nothing. See consent tools for wiring it to a consent banner.
Does Fingerly use cookies?
No. The browser SDK sets no cookies and keeps nothing in the browser beyond one test value it writes to check that storage works and removes at once. Requests are sent without credentials, and responses set none.
What data does Fingerly collect?
Characteristics of the device, operating system and browser or app, the visitor's IP address for an approximate location and network checks, your tag and the time of the request, and on iOS and Android a random install ID. It never collects page content, anything a visitor types, keystrokes or anything behind a permission prompt. See privacy and consent.
Does Fingerly track people across websites?
No. A visitor ID is scoped to your organization, so the same device has a different visitor ID on another customer's site. Fingerly does not link visitors across organizations or use visitor data for advertising.
How long is data kept, and how do I erase it?
Events are readable with a secret key for 30 days. To erase an app's stored identity, call deleteStoredIdentity() in the SDK, and to erase a visitor use the management API. See data retention.
Fraud, bots and networks
How do I detect bots?
Read visitor_kind on the stored event, which is human, ai_bot, automation or search_crawler, and check whether the bot signal group fired. Both come from the same identification as the visitor ID. See bot, VPN and Tor detection.
How do I detect VPN, proxy and Tor users?
anonymity_network on the stored event is tor, vpn, proxy or hosting, and it is omitted for an ordinary connection. The asn, asn_name and country_code fields say whose network it is, and the tor, vpn, datacenter_proxy and residential_proxy groups appear in triggers.
Should I block VPN traffic?
A VPN is not evidence of fraud by itself, because many customers use one for ordinary reasons. Fingerly gives it a modest default weight, and you set what it is worth with risk weights. Combine it with other signals and the level, and add friction before you refuse.
How do I detect multiple accounts?
Identify at sign-up, store the visitor ID with each account, and count accounts per visitor ID in your own database. See detect multiple accounts.
How do I stop fake signups and promo abuse?
Limit accounts and redemptions per device rather than per email address, and send automated or farmed sign-ups to verification or review. See sign-up abuse and prevent promo abuse.
How do I prevent account takeover and credential stuffing?
Refuse automation, count failed logins and accounts per visitor ID, and challenge logins from devices an account has never used. See prevent account takeover.
How do I detect emulators, rooted and jailbroken devices?
The iOS and Android SDKs collect raw input and the server derives signals such as android_emulator, ios_simulator, rooted_device and jailbroken_device, which you read on the stored event. See detect emulators, rooted and jailbroken devices.
Is device fingerprinting a CAPTCHA alternative?
It is a way to decide who needs one. Fingerly runs no challenge and shows the visitor nothing. It scores the session, so you can add a CAPTCHA or a second factor only for medium sessions and let the rest through.
How is device fingerprinting different from an IP address?
An address says which network a request came from, and it changes with a VPN, a mobile network or a proxy. A visitor ID says which device it is, and it is designed to survive changes of network. Fingerly reports both, and you can count per device where an address limit would be bypassed.
Is a visitor ID a replacement for authentication?
No. A visitor ID is a signal for your own rules, not a credential. Keep authenticating people the way you do now, and use the visitor ID to decide how much friction a login or a payment gets.
Integration
How do I implement device fingerprinting?
Create a public and a secret key, add an SDK to your page or app, call identify() with a tag at the moments that matter, send the request ID to your server, and read the stored event with the secret key. The quick start takes about five steps.
Which frameworks and languages are supported?
For the web: JavaScript, React, Next.js, Vue, Nuxt, Svelte and Angular. For apps: iOS (Swift), Android (Kotlin), React Native, Flutter and Lynx. On the server: Node.js, Python, Go, Java, .NET, PHP, Ruby and Rust, and any other language through the HTTP API. See choosing an SDK.
Why must I verify the result on my server?
Anything a browser or an app returns can be edited by whoever controls it. Your backend reads the stored event with a secret key and checks that it exists, belongs to this action, is recent and passes your policy. See server-side verification.
What is a request ID?
A request ID is the ID of one identification, a UUIDv7. The client sends it to your server with the action, and your server reads the stored event with it. See the glossary.
Do ad blockers affect it?
Content blockers refuse requests to third-party hosts and to paths they know. A first-party proxy serves the SDK's submissions from your own domain at a random path that is unique to it, which gets past them. See proxy integrations.
What happens if the SDK cannot identify a visitor?
Let the visitor continue. Your server receives no request ID and treats that as missing evidence, for example by asking for verification, rather than as proof of fraud or of innocence. Never make an identification failure fatal.
Can I try it without paying?
Yes. Development and staging keys run the same detection as production and cost nothing, and new accounts start with $1 of credit. See API keys and environments.
Can I get results pushed to my server?
Yes. Webhooks send every identification, high-risk visitors, refusals and billing changes as signed HTTPS requests, so you can keep your own copy and react without polling.
Is there an OpenAPI description or a Postman collection?
Yes. See OpenAPI and Postman. The documentation is also available as Markdown, and as llms.txt and llms-full.txt for AI assistants.
Should I build device fingerprinting myself or buy it?
Building means collecting across browsers and operating systems, resolving identities on a server, scoring, network intelligence, attestation on mobile, and keeping up as browsers change. Buying means paying per request instead. Decide on how much of that you want to own, and note that Fingerly has no plans or minimums to commit to.
Pricing
How much does device fingerprinting cost with Fingerly?
A production identification costs $0.0025 per request, graduated by volume: $0.0025 for the first 250,000 in a month, $0.0020 from 250,000 to 1,000,000, and $0.0015 beyond. Fingerly is prepaid, with no plans, minimums, monthly fees or seat charges. See billing and usage.
What is free?
Requests with a development or staging key, production requests that could not identify a device, requests Fingerly refuses, requests whose network lookup could not run, deferred reports, attestation challenges, reading events and webhooks. Only identifiable production checks are charged.
What happens when my credit runs out?
Identification continues below zero up to a tolerance, and then production requests are refused with 402 no_credit until you add funds. Turn on auto top-up to add a fixed amount by card when the balance falls below a threshold. Watch the identification.refused webhook so it never stops unnoticed.