Device fingerprinting, explained
How modern device fingerprinting identifies a returning visitor without cookies — the signals it uses, why it survives incognito, and how to do it accurately and privately.
What is device fingerprinting?
Device fingerprinting is the practice of identifying a browser or device from the many signals it exposes — rendering behavior, hardware characteristics, installed fonts, network properties — rather than from a cookie you set. Because those signals are inherent to the device, the resulting visitorId persists across cookie clears, incognito windows and cache resets, which is exactly why it’s the backbone of modern fraud prevention, bot detection and account-takeover defense.
A good fingerprinting system does three things well: it collects high-entropy signals, it fuses them server-side into a single stable identity, and it attaches a confidence score so you can make risk decisions instead of guessing. Prynt does all three, and ships the identity, confidence and risk signals that competitors gate behind a paywall.
The signals a fingerprint is built from
Canvas & WebGL
How a device renders text, emoji and 3D graphics differs by GPU, driver and OS. Prynt uses a perceptual hash so minor driver changes don’t break the match.
Audio & fonts
The AudioContext DSP output and installed-font metrics are highly device-specific and stable over time.
Hardware & math
CPU core count, device memory, screen geometry and transcendental-function (FPU) results narrow the device down further.
Network layer
IP intelligence, ASN, and the JA4 TLS fingerprint captured at the edge add signals a browser can’t patch.
Storage reconciliation
Cookie + localStorage + IndexedDB are fused so a cleared store alone never creates a new identity.
Confidence scoring
Every match ships a calibrated 0–100% score so you decide how much to trust it per action.
Why it survives incognito and cookie clears
Cookies are per-browser storage you set; a user can wipe them in one click. A fingerprint is derived from the device itself — the GPU that draws a canvas, the CPU that computes a math result, the fonts installed, the screen geometry. None of that changes when someone opens a private window or clears their cache, so the same person maps to the same visitorId. Prynt additionally reconciles cookie, localStorage and IndexedDB, and detects incognito mode as its own Smart Signal.
Fingerprinting vs. bot & fraud detection
A fingerprint answers who is here; fraud detection answers whether to trust them. Prynt layers bot detection, VPN/proxy/Tor/datacenter and residential-proxy detection, behavioral biometrics (mouse and keystroke dynamics), and a privacy-preserving reputation network on top of the identity — so a device that’s been flagged anywhere is flagged the instant it arrives.
Doing it privately (and self-hosted)
Fingerprinting for security and fraud prevention is broadly permitted, but you should minimize data and honor user choices. Prynt honors GPC / Do-Not-Track, minimizes IP addresses, supports right-to-erasure, and — uniquely — can be fully self-hosted so raw visitor data never leaves your infrastructure. It’s open source and MIT-licensed.
Related
Bot detection · Account-takeover prevention · Prynt vs FingerprintJS · Glossary · SDKs