How FingerprintJS builds a visitor ID
The library reads a long list of entropy sources - canvas and audio rendering output, installed fonts, screen resolution and colour depth, user-agent and platform, language and timezone, hardware hints such as CPU core count and device memory, and WebGL/GPU details - and hashes the combination into one identifier. Each source on its own is weak, but together they are distinctive enough to recognise a returning device. The library's own documentation is candid about the limits: because everything runs in the browser, the identifier is open to spoofing and reverse engineering, and it cannot tell apart two devices with identical hardware, OS and browser, since every JavaScript-visible signal is the same.
Open source vs. Fingerprint Pro
There are two distinct products. The open-source library runs entirely client-side and produces a plain fingerprint hash. Fingerprint Pro (Fingerprint Identification) collects the browser signals but processes them server-side, adds network-level data such as IP and machine-learning models, and returns a stable visitor ID plus a per-request confidence score. The vendor markets Pro at 99.5% identification accuracy - a figure to attribute to Fingerprint rather than treat as an independent benchmark - and describes the open-source library only as significantly less accurate, without publishing a number. The conceptual line is between a plain fingerprint (a technical snapshot of the browser) and identification (resolving an actual returning visitor using client and server signals together).
BotD and the bot-detection sibling
BotD is a separate, free, MIT-licensed library from the same company, focused on detecting automation rather than identifying visitors. It runs in the browser and flags headless browsers, virtual machines and automation frameworks - the open-source edition recognises headless Chrome and Firefox, Selenium, Playwright, PhantomJS, Electron and others. The commercial bot-detection tier adds a verdict structure (for example, a result such as bad or good plus a detected bot type), distinguishes legitimate crawlers from unwanted ones, and folds in server-side signals such as TLS and IP analysis. For a scraper, the practical takeaway is that FingerprintJS and BotD represent two of the most common client-side checks a site can deploy, and both look hardest at headless-browser signatures and at attributes that disagree with one another.