What is browser fingerprinting?
Browser fingerprinting combines groups of browser and device-environment signals into a technical description. A service can use that context to understand the environment behind a visit, recognize continuity between visits, and identify inconsistencies that deserve further review.
Signals that form a browser fingerprint
Browsers expose several categories of information required for normal website operation. Examples include browser and operating-system versions, screen and hardware characteristics, language and timezone, graphics and audio capabilities, fonts, public network egress, and real-time communication paths. One value is often common. A group of signals can describe the environment with greater distinction.
EchoScan evaluates these groups while keeping detector-level findings, internal weights, and bypass conditions outside the public product surface.
Why browser fingerprints change
A browser fingerprint is not a permanent identifier. Browser upgrades, extensions, operating-system updates, permissions, graphics drivers, displays, networks, and privacy tools can change individual signals.
Practical device recognition accounts for that movement. It evaluates the current environment, continuity over time, and the resulting risk status together. One exact match or one visible difference needs context before it becomes useful.
A technical environment is not a real-world identity
A browser fingerprint describes a technical environment and cannot prove who a person is. Several people may share a device. One person may use several devices, browser profiles, or remote environments.
This makes fingerprinting useful as access-risk and device-continuity context. Account ownership, transaction intent, and final identity decisions still depend on the customer’s authentication and business data.
Browser Verifier and the server-side Report
Browser Verifier collects the environment on a customer site and submits the detection request. A successful run returns only the server-issued { imprint }. The formal risk result stays out of the browser response.
The customer sends the Imprint to its own backend and queries Report API v1 with a Secret API Key. Lite supplies core device and risk results. Pro adds risk reasons, continuity timestamps, network detail, recent activity, and History. This boundary protects server credentials and gives the customer a place to combine its own business context.
Public Scan and the Browser Fingerprint API
The public Scan serves ordinary visitors. It presents an interactive first-party view of the current browser environment and requires no login.
Browser Verifier serves production integrations. It runs inside a customer site, uses a Browser Environment with exact Allowed Origins, and connects the customer backend to Report API through an Imprint. The two experiences draw on related browser-environment capabilities while serving different user journeys and data boundaries.
Using the result responsibly
Combine browser fingerprint context with accounts, request velocity, entitlements, payments, network changes, and verification outcomes. Medium risk usually calls for added verification or review. Higher risk still needs a policy that reflects the value of the protected action and the evidence already available.
Run the public Scan to inspect the current environment. Read the Browser Verifier documentation when you are ready to integrate.
Common questions
Why do some results change after a browser refresh or upgrade?
A browser fingerprint describes the environment at a point in time. Browser versions, extensions, permissions, graphics paths, network conditions, and device settings can change individual signals. A useful system evaluates the group of signals and their continuity over time.
Does private browsing hide every fingerprinting signal?
No. Private browsing mainly limits local history and storage persistence. The browser still exposes many runtime, rendering, device, and network characteristics required for websites to function.
How is the public Scan different from the Browser Verifier API?
The public Scan is an interactive first-party view for visitors and does not require an account. Browser Verifier runs inside a customer site, returns a server-issued imprint, and supports a server-side Report API integration.