How to identify a user without cookies and registration

Imagine a situation: a user visits your site in incognito mode, clears the cache, changes their IP via proxy, but you still need to figure out that it's the same person. Why? For example, to prevent an attacker from endlessly brute-forcing passwords or to avoid showing a welcome discount for the tenth time to the same "new" customer.

Traditional methods like LocalStorage or Cookies fail here — they can be erased with a single click. This is exactly the problem that FingerprintJS solves. It's a library that collects dozens of indirect browser and device signals to create a unique visitor identifier.

What is it and how does it work

FingerprintJS is an open-source tool for browser fingerprinting. Simply put, the library queries the browser: "What fonts do you have installed? What's your screen resolution? How do you render graphics through Canvas?"

Individually, this data doesn't mean much. Millions of people use Chrome on Windows with a resolution of 1920x1080. But when you combine the engine version, list of available languages, timezone, audio stack parameters, and specific font rendering characteristics, you get a combination that's unique for almost every device. All this data is hashed, and you get a short string — visitorId.

How to quickly set up a project

Integration is extremely developer-friendly. You can install via npm:

npm install @fingerprintjs/fingerprintjs

And launch in just a few lines of code:

import FingerprintJS from '@fingerprintjs/fingerprintjs'

async function initFingerprint() {
  // Инициализируем агент при запуске приложения
  const fpPromise = FingerprintJS.load()
  
  const fp = await fpPromise
  const result = await fp.get()

  // Вот он, наш уникальный ID
  console.log(result.visitorId)
}

initFingerprint()

If you don't want to deal with bundlers, the library is available via CDN. But there's a catch: some aggressive ad blockers or browsers like Brave may block loading scripts from external domains. In such cases, the authors recommend using the npm package and bundling the code into your own bundle.

Where this will really come in handy

In my experience, such tools most often come up in security and analytics tasks.

First, fraud prevention. If someone tries to register 50 accounts to boost referral bonuses, FingerprintJS will highlight that all these "different" people are sitting behind the same laptop.

Second, access restriction. You can limit the number of free content views (as major media outlets do) without forcing the user to log in.

Third, protection against password brute-forcing. If login attempts from one device are using different usernames, that's a reason to block access for that specific "fingerprint" without affecting other users on the same IP (for example, in an office building).

What you should know in advance

The library is great, but it's not a "silver bullet". The open-source version has its limitations, which the developers honestly write about in the README.

The free version's accuracy is lower than their commercial cloud product. Since all computations happen on the client side, an advanced user can spoof some browser parameters to change their ID.

Additionally, if a user updates their browser or operating system, their fingerprint will likely change. It's not a permanent identifier, but rather a very reliable temporary marker.

FingerprintJS is an excellent choice if you need to add a layer of security or basic analytics without using cookies. The project is active, has a huge community (almost 28 thousand stars on GitHub) and clear documentation.

Is it right for you? If the goal is to filter out 90% of bots and amateur fraudsters, then definitely yes. For banking systems with critical security requirements, you may need to look at their paid solutions with server-side validation, but for most web projects, the MIT version's capabilities are more than enough.

You can try the library in action on their demo page — open it in normal mode, then in incognito, and you'll see that the magic works.