fingerprint-pro-internals

Fingerprint Pro v4, deobfuscated and documented

143 signals named. The bundle unpacked. The wire format decoded.

Run it on your browser · Read the docs · Signal map · Collector sources

The site

The whole repository is published at proofofbots.github.io/fingerprint-pro-internals: the guide, every generated map as a filterable table, all 143 collector sources syntax highlighted, and the live explorer. npm run site builds it into docs/, which is what GitHub Pages serves from main. Open docs/index.html over HTTP to preview a build locally.

Quickstart

npm install
npm run fetch      # download the pinned bundle, verify its hash
npm run all        # deobfuscate, verify, regenerate every map
npm run site       # rebuild the documentation site into docs/
npm run capture    # serve the capture page, open it once per browser

To read rather than run, start at the signal map for the inventory and the collector sources for the code behind any single signal.

To watch the agent on a live site, paste spy/fpspy.js into DevTools.

To run the collectors with no agent and no network, open the explorer, or serve the repository and open collector/index.html for the raw table.

Everything here describes one pinned build: jsl/4.0.0, sha256 250c7dfe…, fetched 2026-08-07. The tenant ships new builds and the paths rotate. npm run fetch checks the pin and npm run diff says what changed.

Layout

What the analysis found

• Both protection layers come apart offline. Property names are CRC32 constants over DOM identifiers, which a dictionary resolves; the four string tables that key off live browser state key off property names, which the same dictionary already recovers. 02-obfuscation
• The agent names its own signals. Each module registers a sources table mapping the wire id to the collector, so the map is the agent's labels, not assigned ones. 143 ids, 4 of them scheduled first because they are slow. 01-architecture, 04-collection
• The wire format is JSON over bytes, deflate-raw over 1024 bytes, then framed with a key that ships inside the frame. 03-wire-format
• s56, the blob the server issues over the GET leg and the client replays, is a bearer token. Any payload carrying a bound one answers as that visitor whatever the device reports. With it empty, seven fields break the identity match on their own, and the rest hold until six groups of them move at once. 06-identity
• Across Chrome, Firefox and Safari on one machine, 58 of the 143 signals report a different value and the remaining 85 are identical. The static read and the captures disagree nowhere. 04-collection

Docs

1. Architecture — modules, stages, worker, request legs, symbol table
2. Protection layers — CRC32 names, encrypted tables, what the passes do
3. Wire format — codec, frame, envelope, request path
4. What the agent collects — the signal inventory and how to read it
5. Status codes — the 11 codes and what they mean
6. Identity — what visitor_id is a function of
7. Reproducing — the pinned target and every command
8. Not determined — the limits of all of the above
9. Toolchain — every tool, flag by flag

Scope

The shipped bundle is not redistributed here. agent/agent.clean.js is derived work: the same program with the obfuscation removed and every binding renamed. agent/pin.json carries the hash of the original so anyone can fetch it and check.

The captures and evidence files are runs against Fingerprint's own public demo tenant with its public API key. Third-party storage entries, proxy sessions and IP addresses are stripped before anything lands in the tree, and the stored frames are rebuilt from the published payloads rather than kept as sent.

License and contact

Public domain, Unlicense. Use it however you like, anywhere, commercially or not, with no attribution required.

"Fingerprint" and the fingerprint mark are trademarks of Fingerprint. This project is unofficial and not affiliated with, endorsed by or supported by them, and the logo above is a derivative of their mark used to identify what is documented here.

Contact, including takedown and legal enquiries: [email protected]