Sense every device.
Keep the decision yours.

A few lines to start

Collect a result and send it with the request you already make. No extra endpoint, no third-party calls.

Not on npm yet: version 0.1.0 is built from source. The API may change before 1.0. Getting started

$ pnpm install && pnpm build   # in the WhiskerJS source folder

import { load } from 'whiskerjs'

const agent = await load()
const device = await agent.collect({ binding: { nonce, timestamp } })
await fetch('/login', { method: 'POST', body: JSON.stringify({ email, password, device }) })

Step 1

Collect in the browser

46 signals run in parallel, each with one second and the whole call with a budget. Signals a browser is known to randomise are left out instead of trusted, and canvas and WebGL are drawn twice to catch noise.

Step 2

Hash, check and bind

Large values become SHA-256 digests in the page. 14 checks look for automation and tampering. The result is versioned and, if you pass your server's nonce, bound to it with a digest so old results cannot be replayed.

Step 3

Decide on your server

Send the result with a request you already make. Match visitorIds, compare structuredIds group by group, weigh the flags and set thresholds in your own code. Your rules stay private.

Inside a result

Built for browsers that fight back

Brave randomises some signals, Firefox's resistFingerprinting mode fakes others, and private windows can add canvas noise. WhiskerJS knows where, draws twice to catch the rest, and gives every signal a status and a reason code, so your server knows what it could not trust.

• Noise-aware canvas and WebGL
• Per-browser exclusion rules
• 14 automation and tamper checks
• Versioned visitorId and structuredId
• Anti-replay binding to your nonce
• Self-hosted, zero dependencies

All 46 signals · All 14 checks

Live demo

See what it returns on your device

The demo runs the real WhiskerJS build (commit 1100e48, signalsVersion 5, idVersion 2) in your browser: the visitorId, the structuredId group by group, every component with its status, and the integrity flags. Run it again later to see whether your id holds, and if not, which group moved. Nothing is sent anywhere.

Open the live demoHow to read the results

Comparison

Feature by feature, with eleven other libraries

Which signals each open-source library collects at a named version, its licence, its own stability and uniqueness claims, and which ones send data home by default. The head-to-head measurement has not run yet, so the page makes no accuracy claim; it is coming.

No telemetry

No network requests of any kind: no usage sampling, no remote scripts.

No prompts, no WebRTC

No permission prompts. No WebRTC addresses, battery, location or media device labels.

Hashed in the browser

Images, audio, font lists and other large values leave only as SHA-256 digests.

Stores nothing

No cookies, localStorage or IndexedDB. Each call starts from nothing.