Heretic and FingerprintJS

FingerprintJS and Fingerprint

The open-source FingerprintJS library hashes browser properties into a visitor ID. The commercial Fingerprint service adds server-side identification and other signals. The project's own comparison distinguishes the two products.

A visitor ID supports recognition across sessions. Heretic adds findings about the session itself, such as a replaced browser getter or an operating-system claim that conflicts with the observed TCP signature.

Browser inputs can change

Fingerprints use values such as screen size, timezone, fonts, and rendered output. Anti-detect profiles can change them. Browser updates and privacy settings can also change them, while distinct devices with the same configuration can produce matching values.

These constraints apply to Heretic's browser-derived identifiers too. Connection and integrity findings give your backend additional evidence for interpreting a session.

What Heretic checks

The sensor records TCP, TLS, and HTTP observations independently of page JavaScript. Compute and graphics measurements still come from the browser. Performance findings are conditional; they do not establish a hardware model or physical core count.

Heretic's identifiers

The machine identifier uses normalized display, platform, timezone, and core-count inputs. The instance identifier adds rendering and fonts. A separate rendering signature compares stable Canvas and WebGL output without timezone or display declarations.

Each identifier is scoped to your site key and versioned. Store both with the value and compare only within the same scope and version. A hash match establishes matching inputs; it does not certify a unique device.

Evaluate the result you need

For returning-visitor recognition, measure identifier stability and collisions on your own traffic. Heretic does not claim a measured identification advantage over Fingerprint's commercial service.

Use Heretic when your account policy also needs named contradiction findings or a phone challenge. The challenge returns its outcome and device records with a passkey signature over the browser-supplied measurements. It does not provide hardware attestation.