The collectors themselves: the libraries that read a browser and turn it into an identifier. Read these to know what is actually being asked of you, because a collector is the clearest possible statement of what the other side considers worth collecting — and unlike a vendor's documentation, it is code you can run line by line.
The collectors themselves — the code that reads a browser. Read these to know what is being asked of you.
Why ACTIVE: pushed_at = 2026-08-09 — 5 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-09
archived
false
latest_release
v5.2.0 · 2026-04-07
license.spdx_id
MIT
stargazers_count
28300
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/fingerprintjs/fingerprintjs
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why WITHDRAWN: The URL answered 301 to https://github.com/fingerprintjs/fingerprintjs. The source moved the entry itself.
Field
Value at this printing
pushed_at
—
archived
false
latest_release
—
license.spdx_id
MIT
stargazers_count
—
http_status
301
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/Valve/fingerprintjs2
Permanent redirect to fingerprintjs/fingerprintjs.
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
A 301 from the source itself is the strongest liveness field there is: it is the maintainer telling you the entry moved. Nothing here is inferred. — ED.
Why ACTIVE: pushed_at = 2026-08-11 — 3 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-11
archived
false
latest_release
—
license.spdx_id
MIT
stargazers_count
1400
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/fingerprintjs/BotD
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ACTIVE: pushed_at = 2026-07-17 — 28 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-07-17
archived
false
latest_release
v1.10.1 · 2026-07-17
license.spdx_id
MIT
stargazers_count
1100
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/thumbmarkjs/thumbmarkjs
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why DEAD: pushed_at = 2023-01-08 — 1314 days, past the 1095-day outer threshold.
Field
Value at this printing
pushed_at
2023-01-08
archived
false
latest_release
—
license.spdx_id
Apache-2.0
stargazers_count
2200
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/jackspirou/clientjs
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ACTIVE: pushed_at = 2026-06-11 — 64 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-06-11
archived
false
latest_release
—
license.spdx_id
MIT
stargazers_count
2500
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/abrahamjuliot/creepjs
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ACTIVE: pushed_at = 2026-08-09 — 5 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-09
archived
false
latest_release
—
license.spdx_id
MIT
stargazers_count
554
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/Joe12387/detectIncognito
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why SEMI: pushed_at = 2026-04-25 — 111 days, inside the 90–365 day SEMI band.
Field
Value at this printing
pushed_at
2026-04-25
archived
false
latest_release
—
license.spdx_id
MIT
stargazers_count
602
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/Rajesh-Royal/Broprint.js
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
A collector is a specification of the attack surface
Every entry in this section is, in effect, a published list of the surfaces that currently carry signal: which canvas operations, which audio graph, which font enumeration, which storage quirk. The larger libraries maintain that list against browser changes, which makes their component inventories the closest thing this field has to a current specification of what is readable.
That is why this section is worth reading even if you never ship a collector. The defence you build is bounded by the surfaces you know about, and no defensive project publishes as complete an inventory as an offensive one has to.
Open collector, commercial identifier, and the gap between them
Several entries here are the open-source component of a commercial product, and the relationship is worth stating plainly: the free library is a subset of what the paid service reads, and the vendors document it as such. Reading the open version tells you a great deal about the technique and rather less about the product built on it, which typically adds server-side signals, network characteristics and a history the library has no access to.
The other pattern in this section is decay. A general-purpose fingerprinting library from the era when the technique was being popularised is measuring the browser of another decade, and it is still linked from tutorials written long after it stopped moving. Those entries are kept here with their dates attached rather than removed, because that is the whole point of a dated register.
WITHDRAWN — The source itself says this moved.
1 here
DEAD — Unreachable, or untouched past the outer threshold.
1 here
Questions about fingerprinting libraries
Answered from the fields printed above, and from nothing this register has not checked.
What does a browser fingerprinting library actually collect?
Varies by library, and the ones worth reading publish a component breakdown. Common ground: canvas and WebGL rendering output, audio processing output, font enumeration, screen and hardware metrics, timezone and locale, and a set of behavioural quirks that differ between engines. The component lists in this section are the current answer.
Is the open-source version the same as the commercial product?
No. Where an entry here is the open component of a commercial identifier, the vendor documents the paid product as reading more — including signals no browser-side library can reach. This register records that relationship and does not treat the two as equivalent.
Can I use these libraries to test my own anti-detect setup?
Yes, and it is one of the more useful things in this catalogue to do. Running a collector you can read against your own build tells you which surfaces your defence actually covers, rather than which surfaces a hosted test page happened to check.
Donut Browser is filed in section 01 of this same catalogue, under the
same rubric, with the same fields printed against it and no exemption:
an open-source anti-detect browser under AGPL-3.0 whose Wayfern Chromium
fork applies fingerprint overrides at engine level over CDP rather than
by patching page JavaScript, with a local REST API and MCP server on your
own machine, self-hostable sync, zero telemetry, and a pre-launch gate
that refuses to start a profile when the proxy's exit geography
contradicts the profile's fingerprint. It is judged here the same way
everything in this section is judged.