Device Fingerprinting
Device fingerprinting combines browser, OS and hardware signals into a unique ID — used in bot detection to spot suspicious devices and returning botnets.
Advanced Device Detection
Secure your platform with intelligent fingerprinting
What is Device Fingerprinting?
Device fingerprinting builds an identifier for a device from the characteristics it reveals: screen dimensions, installed fonts, time zone, GPU model, how it renders a canvas, which browser APIs exist and how they behave. No single value is unique, and the combination frequently is.
It works without cookies, which is both why privacy regulators dislike it and why it is useful for bot detection — a client that clears cookies between requests still has to present a device.
What goes into a fingerprint
| Surface | Examples | Stability |
|---|---|---|
| Display | Resolution, colour depth, pixel ratio | High, until the user changes monitor |
| Rendering | Canvas and WebGL output, which vary by GPU and driver | High, and the most identifying |
| Fonts | Which typefaces resolve, and their metrics | High on desktop, low on mobile |
| Locale | Time zone, language, number formatting | Moderate; changes with travel |
| Browser surface | Which APIs exist, their behaviour and error messages | High, and the richest source of inconsistency |
| Hardware hints | Core count, memory class, audio stack behaviour | Moderate |
For bot detection the fifth row does the real work, and not because it identifies a device. It is where contradictions appear.
Contradiction beats identity
A fingerprint can be edited. Spoofing toolkits exist, they are effective, and treating a fingerprint as an identity to be matched against a blocklist is a losing position — the attacker simply presents a different one next time.
What is much harder is presenting a coherent one. An automated client that claims to be Safari on an iPhone while exposing a Chrome-specific API, reporting a desktop GPU, or returning a V8-shaped error message has not failed to match a known-bad fingerprint; it has contradicted itself. Those contradictions are the durable signal, because fixing all of them means genuinely running the browser being claimed.
This is a real distinction in how products work. A vendor matching fingerprints against a database of known bots is always one rotation behind. A vendor checking internal consistency is asking a question the attacker cannot cheaply satisfy.
The privacy position
Fingerprinting is processing personal data. Under GDPR it needs a lawful basis, and because it works without storage on the device, the cookie-consent rules that cover tracking cookies apply to it differently depending on jurisdiction and purpose. Browser vendors have also been narrowing the surface deliberately for years — reduced user-agent strings, capped screen metrics, noise added to canvas output.
That trend is worth building against rather than around. A product whose detection depends on ever-finer device discrimination gets weaker with every browser release. A product that depends on coherence and behaviour does not, which is why behavioural signals and proof of work age better than fingerprint matching.
Prosopo's use of these signals is bounded: they feed a live verdict about whether a session is automated, not a profile of an individual tracked across sites.