Fingerprint Pro v4

The agent, taken apart

Deobfuscated bundle, a map of all 143 signals, the source of every collector, and a page that runs them against your own browser.

What the Fingerprint Pro v4 browser agent measures, how it hides it, and what the server does with the result. One pinned build, taken apart offline: the deobfuscated bundle, a map of all 143 signals, the source of every collector, and a page that runs those collectors against your own browser.

Live

Signal explorer Run the agent's collectors here and read what each one measured, under readable names.

Guide

How the agent works Modules, stages, worker, the two protection layers, the wire format, identity.

Reference

The signal map One row per wire id: the surfaces it touches, the codes it can return, the value shape.

Source

Collector sources 140 files, one per collector, each with the helpers only that collector reaches.

The pinned build#

Everything here describes jsl/4.0.0, sha256 250c7dfe…, fetched 2026-08-07. The tenant ships new builds and the paths rotate, so a map generated today will not match a bundle pulled next month. npm run fetch checks the pin and npm run diff says what changed between two builds.

What the analysis found#

Both protection layers come apart offline Property names are CRC32 constants over DOM identifiers, which a dictionary resolves. The four string tables that key off live browser state key off property names, which the same dictionary already recovers.

The agent names its own signals Each module registers a sources table mapping the wire id to the collector, so the map is the agent's own labels, not assigned ones. 143 ids, 4 of them scheduled first because they are slow.

The wire format is JSON over bytes Deflate-raw over 1024 bytes, then framed with a key that ships inside the frame.

s56 is a bearer token The blob the server issues over the GET leg and the client replays. Any payload carrying a bound one answers as that visitor whatever the device reports.

58 of 143 signals differ across browsers on one machine The remaining 85 are identical between Chrome, Firefox and Safari. The static read and the captures disagree nowhere.

Everything the analysis does not establish is written down in not determined.

Where to start#

Read the architecture first if you want the shape of the program, or go straight to what the agent collects if you only care about the signals. The wire format covers the codec and the envelope, and identity covers what the visitor id is actually a function of.

To reproduce any of it, reproducing lists the pinned target and every command, and toolchain documents each tool flag by flag.

Scope#

The shipped bundle is not redistributed. The deobfuscated agent is derived work: the same program with the obfuscation removed and every binding renamed, published alongside the hash of the original so anyone can fetch it and check. The captures and evidence files are runs against Fingerprint's own public demo tenant with its public API key, with third-party storage entries, proxy sessions and IP addresses stripped before anything lands in the tree.

The explorer on this site collects locally and sends nothing: no API key ships in the page, no request leaves it, no visitor id is minted.

→ Signal explorer