Fingerprint Technology Check
Find out what type of fingerprinting a website uses. Paste any URL and see the device-fingerprinting SDKs, anti-fraud engines, session-replay tools and tracking scripts the page loads — with the script, cookie or header that gave each one away. Free, no signup.
One profile, one coherent fingerprint
This page fingerprints whatever visits it. Antybrowser gives every account an isolated profile with its own canvas, WebGL, audio, fonts, timezone and proxy — so the same site sees a different, consistent machine.
Fingerprint Technology Check: What Type of Fingerprinting Does a Website Use?
Every site you visit makes a choice about how much it wants to know about you. Some take the IP address and the user-agent and stop there. Others load a commercial device-fingerprinting SDK, a fraud engine, a session-replay recorder and a stack of advertising pixels — and that stack is visible in the page long before you log in. This free fingerprint technology check reads a public page the way a browser does and names the fingerprinting technology it found, with the exact script, cookie or response header that gave it away.
If you have ever searched for “what fingerprinting does this website use”, “website fingerprinting checker”, “how to detect fingerprinting scripts”, “does this site use FingerprintJS” or “canvas fingerprinting test”, this is the tool and this is the guide: what the different fingerprinting methods are, which vendors use them, how to recognise each one, and what to do about it.
What Is Website Fingerprinting?
Website fingerprinting (also called browser fingerprinting, device fingerprinting or a device fingerprint) is any technique that reads stable properties of your device to recognise it again — without cookies and without asking. The classic fingerprinting checks are canvas rendering, WebGL and GPU strings, audio processing, font enumeration, screen and window metrics, timezone and locale, hardware limits, WebRTC candidates and Client Hints.
A fingerprinting script combines several of those into one identifier — a visitor ID or a device hash — and sends it to a server. That ID survives clearing cookies, switching to incognito, and creating a new account in the same browser. It is the reason “clear your cookies” stopped being enough advice, and it is why anti-detect browsers exist.
Fingerprinting is legal in most jurisdictions and extremely common: analytics, fraud prevention, advertising and bot detection all use it. The question is not whether it happens in general — it is what a specific site does, which is what a fingerprint technology check answers.
How to Check What Fingerprint Technology a Website Uses
There are three ways to inspect a site's fingerprinting, and they answer different questions.
1. View the page source and the network tab
Open DevTools, reload the page and filter requests by “Script”. A fingerprinting SDK usually loads from a vendor hostname: cdn.fpjs.io (Fingerprint / FingerprintJS), siftscience.com, online-metrix.net (ThreatMetrix), hcaptcha.com, js.datadome.co, px-cdn.net (HUMAN/PerimeterX). Inline code is harder: bundles are minified, so you look for API names instead — toDataURL, getImageData, WEBGL_debug_renderer_info, AudioContext, fonts.check, getHighEntropyValues.
2. Use this fingerprint technology check
The tool automates that pass from a server-side request: it reads the response headers, the cookies set on the first response and the script bundles the page loads, then matches them against a catalog of known fingerprinting, anti-fraud, session-replay, analytics and advertising vendors. Every detection shows its evidence, so you can confirm it in your own DevTools instead of trusting a label.
3. Test your own browser's fingerprint
A technology check tells you what the site runs. To see what it can read from you right now — canvas hash, WebGL renderer, audio hash, fonts, timezone and consistency findings — run the browser fingerprint checker. The two tools are complementary: one shows the script, the other shows the data.
The Fingerprinting Checks a Site Can Run
Not every site runs every check, but the list is well known and each item is a searchable topic in its own right.
Canvas fingerprinting
The script draws text or shapes on a hidden canvas and reads the pixels back with toDataURL or getImageData. GPU drivers, font rendering and anti-aliasing make the result differ slightly per machine — a stable, cookie-less identifier. Canvas fingerprinting is the most common check in commercial SDKs and the easiest to spot in a bundle.
WebGL and GPU fingerprinting
WebGL exposes the graphics card: unmasked vendor and renderer strings, supported extensions, maximum texture size and precision limits. WEBGL_debug_renderer_info gives a direct GPU name; rendering a 3D scene and hashing the output gives a subtler one. On mobile the same information narrows the device model considerably.
Audio fingerprinting
An AudioContext or OfflineAudioContext processes a generated tone, and the script hashes the output buffer. Audio stacks differ in rounding, sample rate and filter implementation, so the hash separates machines even when everything else matches.
Font enumeration
Text is measured against a list of font families — if the rendered width changes, the font is installed. Installed fonts leak your OS, language packs, design software and sometimes your employer. document.fonts.check and FontFace callbacks make the check cheap and quiet.
Screen, hardware and timezone
Screen resolution, device pixel ratio, colour depth, CPU core count, device memory, touch points, battery status and timezone are readable without any permission prompt. Individually weak, together they narrow a device to a small set.
WebRTC and network fingerprinting
RTCPeerConnection can expose local and public IP addresses in some configurations. Connection type, downlink and RTT (Network Information API) add context. This overlaps the WebRTC & DNS leak test, which shows the same surface from your side.
Client Hints
Chromium's NavigatorUAData exposes brands, platform version, architecture, bitness, model and full version — but only after a site asks for them with Accept-CH. A site that requests high-entropy Client Hints is deliberately collecting device detail; the HTTP header checker shows the Accept-CH request your browser received.
Behavioural signals
Mouse movement, typing cadence, scroll patterns, focus changes and touch pressure are collected by anti-fraud vendors and bot-detection scripts. They are not a device fingerprint in the strict sense, but they are used the same way: to decide whether two sessions are one person — or one script.
Known Fingerprinting and Anti-Fraud Vendors (and How to Spot Them)
These are the names people search for most often, with the signals the tool matches. A detection needs at least one of these; high confidence means several agree.
Fingerprint / FingerprintJS (and open-source FingerprintJS)
The best-known commercial device-fingerprinting API. Look for cdn.fpjs.io or fpjscdn.net script loads, the FingerprintJS global, visitorId calls, and _fpjs cookies. The open-source FingerprintJS library is the same idea, self-hosted — harder to attribute, but the API calls in the bundle are the same.
ThreatMetrix (LexisNexis)
A fraud and device-intelligence platform used by banks and e-commerce. Signature: online-metrix.net, h.online-metrix.net/fp/tags.js, a tmx_ session, and the _tmx global. It is usually loaded on login and checkout pages rather than the homepage.
Sift, Forter, Riskified, Signifyd, SEON, Sardine, Kount, Ravelin
The anti-fraud family: risk scoring for payments, account creation and refunds. Each loads from its own hostname (siftscience.com, forter.com, riskified.com, signifyd.com, seon.io, sardine.ai, kount.com, ravelin.com) and typically appears on checkout, not the home page. If a site loads one of these, it is deciding whether to trust the order — often before you finish typing.
BioCatch, BehavioSec, TypingDNA, NeuroID
Behavioural biometrics: how you type, move the mouse and hold the device. Mostly found in banking and fintech onboarding. Detection is by script host and vendor global; the payload is behavioural, not a canvas hash.
FullStory, Hotjar, Microsoft Clarity, Contentsquare, Smartlook, Mouseflow
Session replay and experience analytics. These record the session itself — clicks, scrolls, form interactions — and often reconstruct the page. From a privacy perspective they are the most invasive scripts on a normal site, and the easiest to spot: fullstory.com, hotjar.com, clarity.ms, contentsquare.net, smartlook.com, mouseflow.com.
Google Analytics, Adobe Analytics, Segment, Mixpanel, Amplitude, PostHog
Product analytics. They identify a browser through first-party cookies and, with cross-device graphs, through the logged-in account. Google Analytics is on the majority of the web; the tool reports it together with Tag Manager, Adobe Experience Cloud, Segment, Mixpanel, Amplitude, Heap, PostHog, Matomo, Plausible and the rest of the analytics stack.
Meta Pixel, Google Ads, TikTok, LinkedIn, Criteo and friends
Advertising and attribution pixels. They do not usually fingerprint the device, but they build identity graphs and follow you across sites. The tool lists the ones present so you can tell “analytics” apart from “surveillance”.
Bot-detection SDKs that are fingerprinting too
Cloudflare, DataDome, HUMAN/PerimeterX, Kasada and Akamai all run client-side fingerprinting to decide whether you are a browser or a script. The same page names them under bot management; the bot protection check reports the protection verdict.
Does Incognito Mode Stop Fingerprinting?
No. Incognito clears cookies, storage and history when you close the window — it does not change your canvas, GPU, fonts, screen, audio stack or timezone. A fingerprinting script that saw you in a normal window can match the same identifier in incognito, and vice versa. Private browsing is useful against shared-computer snooping; it is close to useless against device fingerprinting.
The same is true of clearing cookies, switching profiles inside one browser install (same device signals), and many VPNs (they change the IP but nothing about the device). A complete fix needs the device surface itself to be consistent per identity — which is what an anti-detect browser does, and what the fingerprint checker verifies.
How to Avoid Being Fingerprinted
There is no single switch. The practical options, from weakest to strongest:
Block the scripts
A content blocker that stops third-party fingerprinting and session-replay scripts works on sites that load them from vendor domains. It does not help with first-party, server-side or anti-fraud fingerprinting — and on sites that require those scripts, blocking them can break login or checkout.
Reduce surface area
Firefox's resistFingerprinting and Brave's farbling randomise or normalise canvas, audio and screen values. That genuinely helps casual tracking; it also makes the browser statistically unusual, which is itself detectable. Fingerprinting scripts flag “protected” browsers as a group.
Use a coherent isolated profile per identity
For work that depends on not being linked — multiple accounts, marketplaces, ad accounts — the standard approach is one profile per identity with its own fingerprint and its own proxy, coherent across canvas, WebGL, audio, fonts, timezone, languages and IP country. Antybrowser does that per profile; the fingerprint technology check tells you what the target site reads, and the fingerprint checker tells you whether your profile answers consistently.
What This Fingerprint Technology Check Cannot See
The scan is a single page request without JavaScript execution, so it sees the technology a site ships to anonymous visitors. Code that only loads after login, inside a cross-origin iframe, or in a first-party bundle with no vendor signature may not be attributable. Server-side fingerprinting (TLS, header order, timing) is invisible to anything that only reads the page, and a datacenter request can be served a challenge page instead of the real one — the report states when that happened.
Those limits are printed in every report rather than hidden. The value is what the scan does show: the vendors a site loads, with evidence you can check yourself.
Fingerprinting technology is not hidden — it is loaded into the page and shipped to every visitor. Once you know which family a site uses, you know what it cares about: device identity (Fingerprint), fraud history (ThreatMetrix, Sift), behaviour (BioCatch, FullStory) or attribution (the pixel stack). Run the check on the pages that matter — login, checkout, signup — read the evidence, and treat the stack as the requirement it is.
Related tools
See what type of bot protection the same website uses.
Browser fingerprint checker →Check what your own browser exposes, with a coherence score.
HTTP header checker →Inspect the request headers your browser sends right now.
Download Antybrowser →One coherent identity per profile, with its own fingerprint and proxy.
Frequently asked questions
What does this fingerprint technology check show?
What type of fingerprinting a website uses: the device-fingerprinting SDKs, anti-fraud and behavioural-biometrics vendors, session-replay tools, analytics and ad pixels, CAPTCHA widgets and bot-detection scripts the page loads. Every detection comes with the script, cookie or header that identified it.
How do I check what fingerprinting a website uses?
Paste the URL above. The check fetches the page once from our server, reads the response headers and cookies and scans the script bundles the page loads for known fingerprinting vendors and APIs. You can confirm any detection in DevTools → Network (script hosts like cdn.fpjs.io) or with a “toDataURL / getImageData / AudioContext” search in the bundles.
How can it detect fingerprinting without running the page's JavaScript?
The scanner reads what the page ships to every visitor: response headers, the cookies set on the first response, and the script bundles the page loads. That covers the technology a site deploys before login. Code that only executes after you sign in, or that ships inside a first-party bundle with no vendor signature, can be missed — the report says so.
Does incognito mode stop fingerprinting?
No. Incognito clears cookies and history when you close the window, but your canvas, GPU, fonts, audio stack, screen and timezone do not change — so a fingerprinting script can match the same identifier in and out of incognito. Clearing cookies and switching VPNs does not change those signals either.
What do the confidence levels mean?
High means several independent signals agree (for example a vendor script host plus its cookie plus its global variable). Medium means one strong signal or several weak ones. Low means a single weak hint. The evidence list under each detection is the reason it is there.
Why is nothing detected on the site I scanned?
Either the site loads no known fingerprinting SDK, the SDK only loads on a login or checkout page, or our datacenter request got a challenge page instead of the real one. The report states when that happened — scan the specific page where the account actually lives for the best result.
What are canvas, WebGL and audio fingerprinting?
They are device-fingerprinting techniques. Canvas fingerprinting draws hidden text and reads the pixels back (toDataURL / getImageData); WebGL fingerprinting reads the GPU name, extensions and render limits; audio fingerprinting processes a tone through AudioContext and hashes the output. Driver and hardware differences make each result stable per machine — which is why they identify you without cookies.
Is scanning a website legal, and what do you store?
The tool makes one page request from our server, exactly like a browser or a monitoring service — it does not log in, submit forms or crawl. Only the report (detections, evidence lines and target facts) is stored for 30 days so share links work; the page HTML, cookies and request headers are never stored or returned.