Download websites that use FingerprintJS

About FingerprintJS

Browser fingerprinting answers a question cookies stopped answering reliably. Given a request with no login and no usable identifier, can the site still tell whether this browser has been here before? FingerprintJS builds a stable visitor identifier out of dozens of browser and device signals, and a site that loads it has decided that recognising returning visitors matters enough to spend engineering effort on the problem.

The reasons are usually defensive. Fraud scoring, account takeover protection, bot filtering, trial and coupon abuse, and rate limiting are the common ones, with personalisation and paywall enforcement behind them. So its presence marks a site with something worth stealing or abusing, which is a far narrower and more interesting population than sites that merely have a security header set.

As of October 2026 we detect the library on 11,856 sites in the Browser fingerprinting category, 4,266 of them in United States and .com the dominant suffix. Geography is not a footnote here, because fingerprinting sits inside an active regulatory argument about consent and tracking, and the jurisdiction a site operates in changes what it is allowed to do with an identifier that survives cookie deletion.

The project has an unusual history that complicates every count of it. Created in 2012 as an open-source library under MIT and later built into a commercial product by Fingerprint Inc., the technology now exists as both a free client-side library anyone can embed and a paid service with server-side identification and higher accuracy. A crawler sees a script, not a contract, so distinguishing a hobby install from an enterprise deployment is not always possible from the page alone.

Version data reflects that split. 40 versions appear in the dataset and 2 is the release line we see most often, which is what happens when a free library keeps working indefinitely and nothing forces an upgrade, while paying customers move on a different schedule under a different distribution model.

The undercount runs in a predictable direction and should be stated. Commercial deployments are frequently proxied through the customer's own subdomain precisely so that blockers and privacy extensions do not recognise the request, and that arrangement also makes attribution from the outside harder. Bundled and self-hosted builds are similarly opaque. The visible population therefore leans toward plain library embeds, and the true footprint of the technique is larger than any list of sites loading a recognisable script.

Within those limits the extract answers questions a per-domain lookup cannot. Vendors selling fraud, identity and bot mitigation want a map of who has already bought into the approach and who has not, since the two groups need different pitches. Privacy researchers and regulators want a measurable population rather than anecdotes about a practice that is hard to observe at scale. Security teams auditing supply chains want to know which third-party scripts are collecting device signals across the sites they depend on. All three need the whole set, segmented by country and suffix and comparable between releases, and a single domain check gives none of that.