FPScanner

v0.9.4 beta

A lightweight, self-hosted browser fingerprinting and bot detection library. Designed with real-world constraints in mind: anti-replay, payload encryption, optional obfuscation, and strong, low-noise signals.

Try the Live Demo GitHub npm

Fast Bot Detection

Client-side detection of strong automation signals: navigator.webdriver, CDP markers, Playwright artifacts, Selenium properties, and more.

Browser Fingerprinting

Short-lived fingerprint designed for attack detection, clustering, and session correlation. JA4-inspired structured fingerprint ID.

Encrypted Payloads

Optional payload encryption to prevent trivial forgery. The encryption key is injected at build time, not shipped in plaintext.

Code Obfuscation

Optional obfuscation to raise the cost of reverse-engineering and make it harder to forge valid fingerprints without executing the code.

Cross-Context Validation

Detects inconsistencies across JavaScript execution contexts: main page, iframes, and web workers.

Anti-Replay

Built-in timestamp and nonce to prevent captured fingerprints from being replayed at scale.

Quick Start

            // Install

            npm install fpscanner

            // Build with your encryption key + obfuscation

            npx fpscanner build --key=your-secret-key

            // Client-side: collect fingerprint

            import FingerprintScanner from 'fpscanner';

            const scanner = new FingerprintScanner();

            const payload = await scanner.collectFingerprint();

            // Send to your server for decryption and analysis

            await fetch('/api/fingerprint', {

              method: 'POST',

              body: JSON.stringify({ fingerprint: payload }),

              headers: { 'Content-Type': 'application/json' }

            });

What It Detects

Detection	Signal	Frameworks
hasWebdriver	navigator.webdriver === true	Selenium, Puppeteer, Playwright
hasWebdriverWritable	webdriver property descriptor	Puppeteer, Playwright
hasSeleniumProperty	document.$cdc_, $wdc_	Selenium WebDriver
hasCDP	CDP runtime markers	Chrome DevTools Protocol
hasPlaywright	__playwright, __pw_*	Playwright
hasWebdriverIframe	webdriver in iframe context	Cross-context bots
hasWebdriverWorker	webdriver in web worker	Cross-context bots

Fingerprint ID (fsid)

The fsid is a JA4-inspired, locality-preserving fingerprint identifier. Unlike a simple hash, it is structured into semantic sections, making it both human-readable and useful for partial matching, similarity detection, and clustering.

FS1_<det>_<auto>_<dev>_<brw>_<gfx>_<cod>_<loc>_<ctx>

Try It Now

See FPScanner in action. The demo collects your browser fingerprint, sends the encrypted payload to the server for decryption, and displays the full results.

Run the Live Demo