Drop one script tag on your signup page to get a stable device id that survives incognito and cleared storage, because it uses no cookie and writes nothing to the device.
What it detects
- Repeat devices across accounts
- Headless browsers and automation frameworks
- Bot probability, scored separately from risk
- Timezone that disagrees with the IP's country
- Device abuse history across the network
- Selenium, Puppeteer and Playwright markers
When to use it
The signal that catches the same person on their fortieth fake account.
Questions
Does fingerprinting need a cookie or user consent banner?
No cookie is set and nothing is written to the device — that is why the id survives incognito and cleared storage. It is still a form of identification, so document it in your privacy policy and rely on a legitimate-interest basis for fraud prevention, as you would for any anti-abuse measure.
What stops a bot from simply faking the signals?
Automation markers are collected but deliberately not hashed into the device id. So a bot that patches navigator.webdriver hides that one flag — and keeps the same identity, along with all the abuse reputation attached to it. Server-side User-Agent analysis runs independently of anything the client claims.
Why is bot probability separate from the risk score?
Because “this is a script” and “this is dangerous” are different questions. Plenty of automated traffic is legitimate — monitoring, integrations, accessibility tooling. Collapsing them into one number would force you to choose between blocking honest automation and ignoring real bots.
How to do this
Step-by-step, with the trade-offs named.