Device Signals

Device fingerprinting creates a unique identifier for each device visiting your site.

How It Works

The SDK collects multiple signals and combines them into a stable fingerprint:

Canvas + WebGL + Audio + Fonts + Browser → SHA-256 → Fingerprint

Collecting Device Signals

const simplr = new SimplrFraud();
const device = await simplr.collectDeviceSignals();

console.log(device.fingerprint);       // "fp_a1b2c3d4e5..."
console.log(device.is_headless);       // false
console.log(device.canvas_blocked);    // false

Signal Components

Canvas Fingerprinting

Draws invisible graphics and hashes the pixel data:

device.fingerprint_components.canvas // "canvas_abc123..."

• Varies by GPU, drivers, and browser
• Blocked by some privacy extensions
• Falls back gracefully if blocked

WebGL Fingerprinting

Collects GPU vendor and renderer information:

device.fingerprint_components.webgl // "webgl_xyz789..."
device.webgl_vendor   // "Google Inc."
device.webgl_renderer // "ANGLE (Apple, Apple M1 Pro, OpenGL 4.1)"

Audio Fingerprinting

Uses Web Audio API to create a unique fingerprint:

device.fingerprint_components.audio // "audio_def456..."

• Based on audio processing characteristics
• Very stable across sessions

Font Detection

Detects installed fonts by measuring text rendering:

device.fonts // ["Arial", "Helvetica", "Times New Roman", ...]
device.fingerprint_components.fonts // "fonts_ghi012..."

Bot Detection

Headless Browser Detection

Detects headless Chrome, Firefox, and other automated browsers:

device.is_headless // true if headless browser detected

// Detection signals:
// - Missing plugins
// - Specific user agent patterns
// - Missing browser features
// - Automation-specific properties

WebDriver Detection

Detects Selenium, Puppeteer, and Playwright:

device.is_webdriver // true if webdriver detected

// Detection signals:
// - navigator.webdriver property
// - Automation-specific Chrome flags
// - Missing human-like behaviors

Canvas Blocking Detection

Detects if canvas fingerprinting is blocked:

device.canvas_blocked // true if canvas is being spoofed/blocked

Full Response Structure

interface DeviceSignals {
  // Combined fingerprint
  fingerprint: string;

  // Individual component hashes
  fingerprint_components: {
    canvas: string;
    webgl: string;
    audio: string;
    fonts: string;
    browser: string;
  };

  // Persistent device ID (stored in localStorage)
  device_id: string;
  device_id_created_at: string;

  // Platform info
  platform: string;           // "MacIntel", "Win32", "Linux x86_64"
  os: string;                 // "macOS", "Windows", "Linux"
  os_version: string;         // "14.2.1", "11", "6.5.0"
  browser: string;            // "Chrome", "Firefox", "Safari"
  browser_version: string;    // "120.0.0"

  // Hardware
  screen_resolution: string;  // "2560x1440"
  color_depth: number;        // 24
  device_pixel_ratio: number; // 2
  hardware_concurrency: number; // 8 (CPU cores)
  device_memory: number;      // 8 (GB, if available)

  // Locale
  timezone: string;           // "America/New_York"
  timezone_offset: number;    // -300 (minutes from UTC)
  language: string;           // "en-US"
  languages: string[];        // ["en-US", "en"]

  // Bot detection
  is_headless: boolean;
  is_webdriver: boolean;
  canvas_blocked: boolean;
  has_plugins: boolean;

  // Touch support
  touch_support: boolean;
  max_touch_points: number;

  // WebGL details
  webgl_vendor: string;
  webgl_renderer: string;

  // Detected fonts
  fonts: string[];
}

Fingerprint Stability

Factor	Impact
Browser updates	May change fingerprint
OS updates	May change fingerprint
GPU driver updates	May change fingerprint
New fonts installed	Changes font component
Privacy extensions	May block some signals
Incognito mode	Usually same fingerprint
Different browser	Different fingerprint

Privacy Considerations

• No PII is collected
• Fingerprints are hashed (one-way)
• Users can clear localStorage to reset device_id
• Compliant with GDPR when properly disclosed

Best Practices

1. Combine with other signals - Don't rely solely on fingerprinting
2. Handle blocked cases - Some users block fingerprinting
3. Use device_id for tracking - More stable than fingerprint
4. Monitor for spoofing - Watch for canvas_blocked and unusual patterns