How we compare device fingerprinting tools
The 41-criterion framework separates recognition, environment integrity, risk, evidence and operating fit.
What this ranking covers
Included tools return a reusable browser/device identifier or expose device identity within a supported risk product. The comparison includes hosted identification, fraud platforms, consortium reputation and one self-hosted library. Pure IP feeds, one-shot diagnostic pages and edge blocks without reusable identity are outside the core scope.
Scoring rubric: 41 criteria in seven categories
Each criterion is assessed on a 0–10 editorial scale. Relative category weights total 98 points; coverage across the categories guides the overall score. The remaining two evidence-quality points in the original framework are reserved for tie-breaking, rather than a separate eighth category.
| Category | Weight points | Criteria | Questions applied |
|---|---|---|---|
| Cross-session persistence and collision control | 24 | 7 | recognition after cookies and local storage are cleared; recognition in incognito and private browsing; stability across IP changes and VPN exits; stability across browser and operating-system updates; collision avoidance, so two people on one shared device are never merged; uniqueness not mistaken for identity; and identification accuracy on returning devices, measured on live traffic. |
| Anti-spoofing and server-side corroboration | 20 | 7 | server-side derivation or corroboration instead of a browser-computed hash; protection against replayed or forged identifiers; anti-detect browser and tampered-attribute detection; virtual machine and emulator detection; headless browser and automation-framework detection; consistency checks across signals that should agree, such as timezone and network; and behavior under ad blockers and privacy tools, where interference is reported rather than producing a silent new identity. |
| Risk context and use-case coverage | 18 | 7 | signal breadth across canvas, graphics, audio, fonts, engine capabilities, and network, not headers alone; VPN, residential and datacenter proxy, Tor, and connection-type detection; a graded risk score with per-signal reasons instead of a bare hash or one opaque number; device-to-account linking for multi-accounting and account sharing; account takeover and impossible-travel context; real-time scoring that can drive an allow, challenge, or block; and identification as a reusable core output rather than one input inside a broader verdict. |
| Evidence, privacy, and maintenance | 12 | 7 | a published accuracy method and test population, with headline figures discounted until reproduced; a free path to a buyer-run bake-off on your own traffic; active maintenance against browser privacy changes such as cookie-lifetime caps and attribute randomization; security use rather than ad tracking, with a site-specific identifier; documented collection that needs no personal data; data provenance, meaning signals observed on your own traffic rather than a pooled consortium verdict; and raw-signal access for checking scores against confirmed outcomes. |
| Pricing and self-serve access | 10 | 6 | self-serve signup without a sales call; a free tier with a working API and no card; transparent public pricing; per-identification pricing rather than per-MAU or quote-only contracts; no minimum contract or procurement cycle; and effective cost at production volume. |
| Integration and developer experience | 8 | 4 | public documentation readable without a sales call; an install snippet and a short path from signup to the first identifier; client and server SDKs; and a predictable JSON response schema. |
| Latency and real-time delivery | 6 | 3 | real-time delivery over API and webhooks, with lookup by request ID; time to verdict at login and checkout; and coverage of the surfaces the buyer runs, from desktop and mobile web to server-side checks. |
Persistence and anti-spoofing together carry 44 of the 98 category weight points. Evaluate collision avoidance within the product’s identity scope: separate people on a shared computer can share a Device ID while their accounts must remain distinct. Uniqueness, device recognition and verified personal identity are different measures.
Category boundaries and additional candidates
Network hardware classification, pure IP enrichment and a one-shot browser test answer different questions from reusable visitor/device identity. Fingerbank is an example of network-device classification. WAF/CDN or managed bot decisions should be evaluated on whether the particular contracted product actually exposes reusable identity, rather than excluded simply because it runs at the edge.
SHIELD and other sales-assisted device-risk products can be additional candidates outside this eleven-product coverage. Absence from the scored set is not a zero score. Products without a sufficiently inspectable identity scope and commercial route are not assigned an invented assessment.
What counts as evidence
Product capabilities and access come from current official product pages, documentation, repository terms and pricing. A vendor percentage is kept with its product context rather than treated as a comparable cross-vendor test. A free API count does not establish entitlement to every device or risk field.
Review the complete source directory. Dated examples explain an evaluation method; they do not add points to a product.
Earlier study record · September 2026
The September 2026 edition reported an earlier study of 1.5 million scored device samples over 45 days. Its stated conditions included cleared cookies, private windows, IP changes, browser updates, altered environments and repeat visits. These were earlier runs, completed before the original publication.
That edition reported 99.7 percent matching against session labels and, separately, 97 percent re-identification after cookie removal and IP rotation. Those figures describe different endpoints; neither is an editorial score. The October 23 update refreshes product capabilities, access and sources rather than presenting the earlier run as a new benchmark.
How to evaluate matching on your own traffic
- Define the matching unit: browser profile, device/browser scope, app installation or another documented entity.
- Label known same and known different devices independently of the detector.
- Test cookie removal, incognito, IP changes, updates and shared hardware separately.
- Count correct returns, false merges, split identities and unavailable assessments with explicit denominators.
- Measure successful assessment delivery and p50/p95 end-to-end time.
- Assess fraud outcomes and legitimate-user friction separately from identity matching.
Use the worked measurement guide and the vendor’s actual integration.
Editorial standards
Pages are produced and maintained by the Device Fieldnotes editorial team, with Nathan Brooks credited for the reviews and guides. Sources and the rubric make product claims and score context inspectable. Zero paid placements: scores, positions and Editor’s Choice are not sold. The award is a contextual recommendation and adds no score points.
Corrections
Send the page URL, exact passage, current primary source and its date to editor@bestdevicefingerprinting.com. Product facts and access can change. Corrections are assessed from evidence separately from commercial inquiries.