thumbmarkjs/thumbmarkjs

ThumbmarkJS is a free, open-source JavaScript browser fingerprinting library. Use it to identify returning visitors, detect fraud and bots, and more — all client-side, with no backend required.

MIT-licensed and commercially usable, it is used on 60,000+ websites, generating over a billion fingerprints every month.

Try it now

Visit the live demo → to see your browser's fingerprint and the individual components that make it up.

Or paste this into your browser's developer console to get your fingerprint hash and component breakdown directly:

import('https://cdn.jsdelivr.net/npm/@thumbmarkjs/thumbmarkjs/dist/thumbmark.umd.js')
  .then(() => {
    const tm = new ThumbmarkJS.Thumbmark();
    tm.get().then((res) => console.log(res));
  })

Performance

The client library achieves ~80% uniqueness across general browser populations. Mac/Safari users can show higher collision rates or higher noise depending on the audience.

Need higher accuracy? Try the ThumbmarkJS API

The open-source library is great for many use cases, but if you need production-grade accuracy for fraud prevention or user identification, the ThumbmarkJS API takes it significantly further. A free tier is available.

The API combines the client-side signals with server-side analysis — including TLS handshake details, HTTP headers, and connection-level data — to produce fingerprints with over 99% uniqueness. It also adds smart signals: bot detection, VPN and TOR detection, datacenter traffic identification, and a threat level score per visitor.

Learn more at thumbmarkjs.com →

Installation

NPM

npm install @thumbmarkjs/thumbmarkjs

⚠️ ThumbmarkJS runs in the browser. It requires browser APIs to compute fingerprint components and cannot run server-side.

See the NPM usage guide →

CDN (jsDelivr)

Transpiled bundles are available on jsDelivr:

Format	URL
UMD	https://cdn.jsdelivr.net/npm/@thumbmarkjs/thumbmarkjs/dist/thumbmark.umd.js
CommonJS	https://cdn.jsdelivr.net/npm/@thumbmarkjs/thumbmarkjs/dist/thumbmark.cjs.js
ESM	https://cdn.jsdelivr.net/npm/@thumbmarkjs/thumbmarkjs/dist/thumbmark.esm.js

Documentation

Full documentation at docs.thumbmarkjs.com — including installation, configuration, integrations, and the API reference.

Configuration

Options are passed to the Thumbmark constructor:

const tm = new ThumbmarkJS.Thumbmark({
  option_key: option_value
})

Option	Type	Default	Description
api_key	string	—	API key from thumbmarkjs.com. Enables server-side signals and visitorId.
exclude	string[]	—	Components to exclude from the fingerprint hash. Excluding a top-level component also improves performance.
include	string[]	—	Only include these components. exclude still applies.
permissions_to_check	string[]	—	Limit which browser permissions are checked. Permissions are the slowest component to resolve.
timeout	integer	5000	Component timeout in milliseconds.
logging	boolean	true	At most 0.01% of runs collect anonymous logs to improve the library. Has no effect on users.
performance	boolean	false	When true, includes per-component resolution time in milliseconds.
stabilize	string[]	['private', 'iframe']	Preset exclusion list for stability across private browsing and iframes.
metadata	varies	—	Passed to webhooks. Does not affect the fingerprint.

See the configuration reference →

Integrations

React, Vue, Angular, and Preact integration plugins are available. See the integrations docs →

Fingerprint components

ThumbmarkJS combines multiple browser fingerprinting techniques to maximise uniqueness. The following signals are collected client-side:

• Audio fingerprinting
• Canvas fingerprinting
• WebGL fingerprinting and GPU info
• Available fonts and rendering behaviour
• Hardware details
• Browser languages and timezone
• Math precision characteristics
• Browser permissions
• Installed plugins
• Screen details and media queries
• Speech synthesis voices
• System and browser details
• WebRTC fingerprinting

The following are available via the API only:

• TLS handshake details
• HTTP headers
• Connection and IP details

See the full components reference →

Custom components

Add your own signals to the fingerprint with includeComponent(key, fn):

tm.includeComponent('my_signal', () => 'custom_value');

The function can return a string, number, or object. See the custom components docs →

Technical details

The library is intentionally simple to build, extend, and audit. See technical_details.md for an overview of the architecture.

Using ThumbmarkJS?

We'd love to hear about your use case. Share your experience →

Community & support

• 💬 Discord — questions, ideas, and discussion
• 📧 contact@thumbmarkjs.com
• 📖 Documentation