3 entries in this register are declared substitutes for, successors to or predecessors of FingerprintJS, and 1 of them is still shipping at the last field check. FingerprintJS itself reads ACTIVE, and 2 of the candidates carry a state mark other than ACTIVE or SEMI, which is the part a list without check dates cannot tell you. Every row is judged by the same rubric, from the same sweep, on the same fields.
Every row below is judged by the same rule as FingerprintJS itself, from the
same field check. Supersession is only printed where a project or its
author says so — this register does not infer that one tool replaces
another because it is newer.
Read the state column with the licence column. A permissively licensed
project that stopped shipping is not safer than a copyleft one that did
not.
What FingerprintJS does, so you know what you are replacing
The open-source collector maintained by the company that sells the commercial identifier built on top of it, which means the free library is a subset of what the paid product reads and is documented as such.
A substitute has to do that job, not merely occupy the same category. Read it as the reference for what browser-side collection currently reaches for — its component list is the closest thing this field has to a canonical inventory. Do not read the open version as equivalent to the commercial one.
How this register decides what counts as an alternative
FingerprintJS is recorded as the successor to fingerprintjs2 (Valve). Both directions of that edge are stored once and reversed when the index is built, so the graph cannot contradict itself in one direction and agree in the other.
ClientJS, ThumbmarkJS are recorded as substitutes for the same job. The alternative relation is symmetric and carries no ordering at all: it says these things answer the same question, and it says nothing whatsoever about which answers it better.
Nothing on this page is a ranking, a score or a recommendation, and nothing on it is a detection-test result — no entry in this register has been run against any anti-bot system by this register. What the table gives you is four measured columns and one derived one, applied identically to every row.
How to read the comparison above
1 of the 3 candidates read ACTIVE or SEMI and 2 do not. Start by reading the state column, then read the last-push and latest-release columns against each other, because they answer different questions: a push says somebody is there, and a tag says there is something you can pin a dependency to.
Every entry in the table declares a licence, which is less common in this catalogue than it should be — the entries that declare none are grouped separately. Read the licence column beside the state column rather than after it: a permissively licensed project that stopped shipping is not a safer dependency than a copyleft one that did not.
Why WITHDRAWN: The URL answered 301 to https://github.com/fingerprintjs/fingerprintjs. The source moved the entry itself.
Field
Value at this printing
pushed_at
—
archived
false
latest_release
—
license.spdx_id
MIT
stargazers_count
—
http_status
301
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/Valve/fingerprintjs2
Permanent redirect to fingerprintjs/fingerprintjs.
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
A 301 from the source itself is the strongest liveness field there is: it is the maintainer telling you the entry moved. Nothing here is inferred. — ED.
Why DEAD: pushed_at = 2023-01-08 — 1314 days, past the 1095-day outer threshold.
Field
Value at this printing
pushed_at
2023-01-08
archived
false
latest_release
—
license.spdx_id
Apache-2.0
stargazers_count
2200
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/jackspirou/clientjs
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ACTIVE: pushed_at = 2026-07-17 — 28 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-07-17
archived
false
latest_release
v1.10.1 · 2026-07-17
license.spdx_id
MIT
stargazers_count
1100
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/thumbmarkjs/thumbmarkjs
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Answered from the same fields the table above prints, and from no other source.
What is the best alternative to FingerprintJS?
This register does not answer that, because it publishes no ranking and has tested no tool to rank. What it can tell you is which candidates are still shipping: ThumbmarkJS. The rest of the decision is fit, licence and how much of your own stack you are prepared to change.
Are these FingerprintJS alternatives still maintained?
ThumbmarkJS reads ACTIVE. Each of those states is derived from that entry's own measured fields by the rubric in force, at the field check printed in the folio, and the clause that produced it is printed on the entry page.
Why does this list not rank the alternatives?
Because a ranking would be an opinion wearing a number's clothes. Every figure on this site is a date, a count, an SPDX identifier or an HTTP status you can re-fetch from the endpoint named beside it, and there is no honest way to compress those into an ordering without inventing weights nobody published. The rubric sets states; it does not rate them against each other.
Where does the alternatives data for FingerprintJS come from?
From declared edges in the register itself, never inferred. Each edge is stored once and reversed at build time, and every field in the table is read from the same sweep that produced the rest of the catalogue. The whole set is downloadable as CC0 JSON and CSV, including the supersedes, superseded_by and alternative_to columns.
A collector is the clearest possible statement of what the other side is asking your browser, which makes this section the best place to decide what you actually need to answer. Donut Browser answers it in the engine rather than in the page: the Wayfern Chromium fork applies overrides over CDP, so a library reading a value gets it from the browser instead of from a script that patched the getter a moment earlier.