# What is device fingerprinting?

> What device and browser fingerprinting are, how web and mobile differ, how a Fingerly visitor ID relates to a fingerprint, and what fingerprinting cannot do.

Last updated: 2026-11-12

**Device fingerprinting** recognises a device from characteristics it already exposes, such as properties of its browser and operating system, instead of an identifier stored on it. **Browser fingerprinting** is the same idea for a web browser. The result is a stable identifier for the device, which Fingerly calls the **visitor ID**.

Developers use it where a cookie is not enough: spotting a returning device after its storage was cleared, limiting accounts or redemptions per device, and noticing when one device suddenly looks like many. It supports fraud prevention, and it is evidence for your own rules rather than a verdict.

## How device fingerprinting works

- A script or SDK on the device reads characteristics within a short time budget. Nothing is asked of the visitor.
- The characteristics go to a server, which compares them with what it has seen before.
- The server answers with an identifier, and how sure it is of the match. The same device gets the same identifier on its next visit.

Because the identifier is worked out from the device rather than read back from storage, clearing cookies or storage does not on its own make a returning device look new.

## How a Fingerly visitor ID relates to a fingerprint

A Fingerly [visitor ID](https://docs.fingerly.io/docs/visitor-identification) is the identifier the server resolves for a device. It is twenty letters and digits, issued by Fingerly and never derived from the device's data, so the ID itself reveals nothing about the device. It is scoped to your organization: the same device on another customer's site has a different one.

- `visitor_id` is the identifier, and `visitor_confidence`, from 0 to 100, says how the ID was reached.
- `visitor_is_new` tells you whether your organization has seen the device before.
- `identifiable: false` means the device gave too little to identify anyone. It gets a fresh visitor ID, is still scored, and is free.

Fingerly goes further than an identifier. The same identification returns a [suspect score](https://docs.fingerly.io/docs/suspect-score) and, to your backend, the [signals](https://docs.fingerly.io/docs/signals) behind it, so you also learn how suspicious the session looks.

## Web and native apps

Fingerprinting a browser and recognising an app are not the same, and Fingerly treats them differently.

| Where | What recognises the device | After cookies or storage are cleared | After a reinstall |
| --- | --- | --- | --- |
| Browser ([JavaScript SDK](https://docs.fingerly.io/docs/sdks/javascript) and framework bindings) | The server resolves the visitor ID from the signals the SDK sends. The SDK sets no cookies and keeps nothing in the browser. | The same device keeps its visitor ID. | Not applicable. |
| iOS ([Swift SDK](https://docs.fingerly.io/docs/sdks/ios)) | A random install ID the SDK keeps in the Keychain. Device signals feed the integrity checks and the score, never the identity. | Not applicable. | The same visitor ID, because the Keychain record survives deleting the app. |
| Android ([Kotlin SDK](https://docs.fingerly.io/docs/sdks/android)) | A random install ID the SDK keeps in a file excluded from backups. Device signals feed the integrity checks and the score, never the identity. | Not applicable. | A new visitor ID, because the record is removed with the app. |

[React Native](https://docs.fingerly.io/docs/sdks/react-native), [Flutter](https://docs.fingerly.io/docs/sdks/flutter) and [Lynx](https://docs.fingerly.io/docs/sdks/lynx) call the native SDKs, so they follow the iOS and Android rows. To pick one, see [choosing an SDK](https://docs.fingerly.io/docs/sdks).

> **Warning:** Do not run a web SDK inside an app's web view. It collects nothing there, the answer has `identifiable: false`, and the event records the `embedded_web_view` signal. Use a mobile SDK. See [browser and device support](https://docs.fingerly.io/docs/browser-and-device-support#in-app-web-views).

## What device fingerprinting cannot do

- **Identify a person.** A visitor ID identifies a device. Several people can share one device, and one person can use several.
- **Follow someone across companies.** Visitor IDs are scoped to your organization, and Fingerly does not link them across customers.
- **Recognise every device.** Some browsers and clients give away almost nothing, whether through hardened privacy settings or deliberately. They come back as `identifiable: false`, and you should not count them as returning or unique.
- **Be a login.** A visitor ID is a signal for your own rules, not a credential. Keep authenticating people the way you do now.
- **Protect a decision made in the browser.** A page or an app can be modified, so decide on your backend, from the stored event read with a secret key. See [server-side verification](https://docs.fingerly.io/docs/server-side-verification).

## Privacy and consent

Every Fingerly SDK takes a `consent` option and collects nothing until it is `granted`. Whether you need consent, and for what, depends on your lawful basis and where your visitors are. See [privacy and consent](https://docs.fingerly.io/docs/privacy-and-consent) for what is collected and what never is.

## Try it

```ts login.ts
import { load } from '@fingerly/web-js'

// consent: 'granted' only once you have consent (or another lawful basis)
const fingerly = await load({ apiKey: 'fly_pk_development_…', consent: 'granted' })

const { visitorId, visitorConfidence, requestId } = await fingerly.identify({ tag: 'login' })
```

Send `requestId` to your backend, which reads the event with a secret key. The [quick start](https://docs.fingerly.io/docs/quick-start) walks through the whole round trip.

- [Quick start](https://docs.fingerly.io/docs/quick-start): Get a visitor ID in the browser and verify it on your server.
- [Choosing an SDK](https://docs.fingerly.io/docs/sdks): Web, iOS, Android, cross-platform and server SDKs.
- [Visitor identification](https://docs.fingerly.io/docs/visitor-identification): Visitor IDs, confidence and returning visitors.
- [Device fingerprinting vs cookies](https://docs.fingerly.io/docs/device-fingerprinting-vs-cookies): When a cookie is enough and when it is not.