How we compare device fingerprinting APIs
The same 42 criteria in seven categories organize every product assessment. Read the scope, complete rubric, evidence rules and editorial policies behind the scores.
Which products belong here?
We compare products that make device or browser identification useful to application code: dedicated hosted identification APIs, device capabilities in broader fraud platforms and a self-hosted client-library alternative. The review identifies the collection and commercial model for each.
Reusable identity, backend access, returning-visit behavior and account context matter to signup, login, recovery and checkout teams. Network-device classifiers, mobile advertising attribution and CDN-only mitigation are different purchase categories. A specific device product or API must be evaluated on its own output and entitlement.
Scoring rubric: 42 criteria in seven categories
Persistence leads at 28 percent and tamper resistance at 20 percent. The complete criterion descriptions below keep the same standard visible for every product.
| Category | Weight | Criteria scored |
|---|---|---|
| Identifier persistence and accuracy7 criteria | 28 percent | recognition after cookies and local storage are cleared; recognition in incognito and private windows; stability across IP changes, VPN exits, and network switches; stability across browser and operating-system updates; a low collision rate, so two similar devices are not merged into one; sane handling of a genuinely new device instead of a forced false match; and identification accuracy on returning visitors, measured on live traffic rather than taken from a vendor page. |
| Tamper resistance and anti-evasion7 criteria | 20 percent | server-side computation or corroboration rather than a pure client-side hash; protection against replayed or forged identifiers; headless browser and automation-framework detection; virtual machine and emulator detection; anti-detect browser, spoofed user-agent, and tampered-attribute detection; collection that keeps working under ad blockers and privacy extensions; and resilience to browser privacy changes such as tracking prevention, storage partitioning, and entropy reduction. |
| Risk signals shipped with the identifier7 criteria | 16 percent | VPN, datacenter proxy, residential proxy, and Tor detection; incognito and privacy-mode flags; bot and automation signals; IP and connection-type intelligence; cross-session and cross-account linking for multi-accounting; account-level abuse context such as account takeover, account sharing, and impossible travel; and a graded risk score with named reasons instead of a bare hash. |
| API and developer experience5 criteria | 8 percent | public documentation readable without a sales call; a drop-in JavaScript snippet plus a server-side API; client and server SDKs with framework wrappers; time from signup to the first identifier; and webhooks and event retrieval by request ID. |
| Production coverage and reliability3 criteria | 6 percent | time to verdict at login and checkout; reliability, versioning, and rate-limit shape; and coverage of the surfaces the buyer runs, from web pages and mobile web to server-side checks. |
| Scope fit, privacy, and evidence6 criteria | 10 percent | identification as the core product rather than a byproduct of a broader fraud verdict; a first-party, site-specific identifier rather than a cross-site advertising ID; consent, retention, and data-minimization controls; active maintenance as browsers change; a disclosed accuracy methodology rather than a bare percentage; and a free path to test results on your own traffic before buying. |
| Pricing and commercial fit7 criteria | 10 percent | a permanent free tier rather than a time-limited trial; a free quota large enough to evaluate, with no card required; transparent public pricing and self-serve signup; effective cost per identification at production volume; predictable billing without surprise overage charges; no minimum contract or procurement cycle; and licensing plus self-hosting cost counted honestly for open-source options. |
Category weights total 98 percent. The remaining 2 percent is an evidence-quality tie-break within the editorial assessment.
What counts as evidence?
Product facts link to the relevant vendor page, documentation, pricing or technical guide and carry a checked date. We distinguish an identification call, risk event, fraud check and monthly-user allowance. A public demo establishes an evaluation route; production access must be checked against the plan.
A numerical editorial score is a judgment of product fit under the rubric. It is separate from a provider’s identification-confidence or fraud-risk score. Product-specific conditions and limitations remain in the full reviews.
The source directory explains what each source supports. A reader can follow the evidence for a feature, price or integration rather than relying on a byline alone.
Use a labeled pilot for your own deployment
Define whether the identifier should recognize a browser profile, app installation or another documented scope. Include repeat visits, cookie and storage resets, private browsing, network changes and ordinary updates. Add genuinely different similar devices and legitimate shared machines.
Keep false merges, missed matches, collection failures, latency and application outcomes separate. Bind verified results to the protected action and retain the event reference needed to investigate a dispute. The accuracy guide explains the labels and denominators.
How to read a figure on this site
| Marking | Meaning |
|---|---|
| Published value | Linked to a current vendor product page, pricing or documentation, with its unit and period. |
| Third-party figure | Identified as a third-party source where used; not substituted for a vendor’s published plan. |
| Not publicly listed | No numerical value established by the cited public material; never a zero or an invented estimate. |
| Different scopes | The product, plan, SDK or API field differs; inspect both conditions before comparing. |
Editorial standards
Pages are produced and maintained by the Device ID Review editorial team, with Yana Sokolova credited as the author of this coverage. The purpose is a practical B2B comparison that a developer or fraud team can check against public sources.
Zero paid placements is the publication’s standing rule: a provider cannot buy a ranking position, score or Editor’s Choice. The award adds no points to the numerical rating. Commercial inquiries and factual corrections use separate contact channels.
A vendor link alone is not evidence of an affiliate relationship. Any specific commercial relationship must be described accurately where it applies. Read About and editorial standards for the scope of this publication.
Corrections and review dates
Send the page URL, disputed passage, product/plan and a current supporting source through the editorial channel. Confirmed corrections update the relevant text and checked date. Changes to a score must be explained against the rubric.
Pricing and API entitlements can change independently. Check the linked source and the exact product before purchasing. A vendor request does not purchase a score change or removal of a limitation.
Reviews covered by this method
- ShieldLabs — 9.4 out of 10
- Fingerprint — 9.2 out of 10
- SEON — 8.6 out of 10
- Castle — 8.4 out of 10
- IPQualityScore — 8.2 out of 10
- Verisoul — 8.0 out of 10
- LexisNexis ThreatMetrix — 7.9 out of 10
- Sift — 7.7 out of 10
- Incognia — 7.6 out of 10
- FingerprintJS (open source) — 7.4 out of 10