Anti-detect browsers fake a User-Agent in milliseconds. Evenstamp correlates TCP SYN TTL and MSS wire telemetry, WebGPU silicon and shader timing, canvas integrity traps, and Polars kinematic biometrics into one device identity across Chrome, Firefox, and Safari.
import { EvenstampAgent } from '@evenstamp/sdk';
// 1. Load the WASM + behavioral collectors.
const stamp = await EvenstampAgent.load({
endpoint: '/api/v1', // first-party proxy, not a blocked third party
});
// 2. Resolve the cross-browser device and risk verdict.
const verdict = await stamp.identify();
// => { deviceId: "dev_7c44a912-…", riskScore: 3, anomalies: [] }Mode 1 probes this browser locally with real collectors. Modes 2–3 are deterministic attack simulations. TCP/JA4 wire values are resolved server-side, not fabricated in JavaScript.
Evenstamp does not compete on the number of JavaScript attributes it collects. It competes on the cost of keeping every layer mutually consistent while a session is live.
A zero-dependency AF_PACKET listener with a kernel cBPF filter copies only the 60-byte TCP SYN. It infers the client OS from the initial TTL and reads the MSS option to catch WireGuard, OpenVPN, and IPsec encapsulation before user space wakes up.
A 120-iteration fragment shader, a WGSL atomic-contention kernel, and a compiled Rust libm loop measure the physical GPU. A spoofed renderer string cannot fake shader latency, subgroup width, or hypervisor steal-time jitter.
Pointer, keystroke, wheel, and touch events stream into a vectorized Polars LazyFrame. Third-order jerk, path collinearity, dwell and flight distributions, scroll inertia, and touch pressure separate human motor control from scripted curves.
Every envelope is sealed with ECDH P-256 and AES-256-GCM against a single-use challenge consumed by DELETE … RETURNING. Devices, browser identities, and sessions live in one SQLite file. No Redis, no Postgres, no cluster.
BrowserID is exact per browser family. DeviceID is a fuzzy match across the physical machine. A candidate must clear 0.85 similarity and the session must stay below a 70 risk score before the engine auto-links it. High-risk sessions are recorded, never merged.
Anti-detect browsers patch surface APIs. These probes target the subsystems underneath: kernel packet headers, GPU scheduling, graphics readback paths, inspector serializers, OS voice inventories, and human motor control.
A backconnect residential proxy terminates the SYN at a home gateway but forwards the TLS handshake through its superproxy. Timestamping both handshakes exposes a 100–300 ms split before a byte of HTML is served. MSS inspection catches WireGuard, OpenVPN, and IPsec encapsulation at the same time.
A kernel cBPF filter drops everything except the 60-byte TCP SYN. The initial TTL (64 on Unix, 128 on Windows) is compared with the OS the client claims. A Windows 11 profile on a Linux container, or an iPhone profile on a Windows anti-detect host, cannot hide the contradiction.
An axis-aligned integer fill must read back byte-exact on every GPU. Separately, a 2D canvas is uploaded into a WebGL texture and read back through a framebuffer. Hooks that poison getImageData or toDataURL cannot poison the C++ graphics upload path.
Subgroup widths separate NVIDIA warps (32) from AMD wavefronts (32/64) and Apple/Intel variable SIMD. A 16k-atomic WGSL shader serializes on the L1 cache; CPU-emulated adapters finish one to two orders of magnitude slower than a physical GPU.
Playwright and stealth plugins patch navigator.webdriver, but an attached Runtime domain still formats console objects. A side-effecting stack getter fires only when an inspector listens. Injected preload scripts also leave anonymous :1 CallSite frames.
Apple voices never ship on Windows and Microsoft SAPI voices never ship on macOS. The CSS status-bar system font resolves through the window manager, not the User-Agent. A claimed MacBook Pro without a P3 display is another contradiction.
Stealth patches frequently reach the main window but miss SharedWorker, ServiceWorker, or a sandboxed iframe realm. Comparing userAgent, platform, hardwareConcurrency, timezone, and languages across realms exposes partial patches.
A physical trackpad emits a decaying momentum curve with variable deltas and inter-event jitter. Scripted scrollBy loops emit identical deltas on a fixed timer. Genuine fingers vary contact pressure; mobile emulators often report a constant 0.5.
A single compiled Rust binary backed by SQLite and in-memory Polars removes the managed-cluster overhead that incumbent pricing carries.
Published list pricing, normalized to the same unit. Evenstamp overage is $0.50 per 10k on Scale and $0.80 per 10k on Growth, with no punitive platform fee.
Comparison reflects public pricing and documented capabilities as of Q4 2026. Verify with each vendor.
Start free at 25,000 identifications. Scale without a platform fee. Move the entire engine into your own VPC when regulatory or residency requirements demand it.
Estimates use published overage rates. Annual billing discounts the base plan; overage remains usage-based. Taxes excluded.
Full cross-browser identification for side projects, staging, and proofs of concept.
Five times the volume of the incumbent entry tier at less than half the price.
The full wire-to-kinematics stack for fintech, e-commerce, and high-traffic platforms.
Run the entire Rust + Polars + SQLite + AF_PACKET engine inside your own VPC.
Cloud plans include first-party proxy routes, ECDH P-256 envelopes, single-use nonces, and 99.9% uptime. Sovereign includes a 99.99% SLA and deployment review.
Run the managed edge, or put the entire Rust binary inside your own VPC. The wire contract, anomaly engine, and identity graph are identical in both.
Next.js route handler → Rust engine
Privacy extensions block third-party fingerprinting domains. Routing through your own origin bypasses those blocklists without weakening the ECDH envelope or the single-use nonce.
// app/api/v1/ingest/route.ts — first-party, not a blocked third party
import { NextRequest, NextResponse } from 'next/server';
const ENGINE = process.env.RUST_BACKEND_INTERNAL_URL!;
export async function POST(req: NextRequest) {
const upstream = await fetch(`${ENGINE}/api/v1/ingest`, {
method: 'POST',
headers: {
'content-type': 'application/json',
'x-forwarded-for': req.headers.get('x-forwarded-for') ?? '',
// Wire headers are forwarded only when a trusted edge sets them.
},
body: await req.text(),
cache: 'no-store',
});
return NextResponse.json(await upstream.json(), {
status: upstream.status,
});
}Docker, bare metal, or your own VPC
No external database, queue, or managed cluster. Raw telemetry never leaves your network. SQLite runs in WAL mode; nonces are consumed atomically with DELETE … RETURNING.
# One binary, one SQLite file, no external services.
export FP_MASTER_SECRET="$(openssl rand -base64 32)"
docker run -p 8080:8080 \
-e FP_MASTER_SECRET \
-e FP_DATABASE_URL=sqlite:///data/evenstamp.db \
-e FP_TRUSTED_PROXIES=172.16.0.0/12 \
-v evenstamp-data:/data \
ghcr.io/evenstamp/engine:latestHeaders are honored only when the TCP peer is inside FP_TRUSTED_PROXIES. Never use 0.0.0.0/0.
Device fingerprinting is personal data in most jurisdictions. The architecture treats that as a design constraint, not an afterthought.
The identity database stores only a /24 or /48 network prefix, never the full client IP; ephemeral challenges bind to a one-way HMAC of the IP. Raw keystrokes are never collected; behavior uses key classes and timing. Full payload retention is off unless you explicitly enable it.
The sovereign binary runs inside your VPC with zero telemetry egress. SQLite is a local file. You control backups, retention windows, and deletion. Managed cloud is available when you want no operations burden.
Evenstamp is built for fraud prevention, account security, and bot mitigation. Deploy it with a lawful basis, a privacy notice, and a deletion path. It is not a tool for surveillance or discriminatory pricing.
If yours is not here, send it to engineering@evenstamp.com. A systems engineer answers, not a sales sequence.
No cookies are required, and Evenstamp does not sell or broker identity graphs. The identity database stores a /24 or /48 network prefix, not the full client IP; ephemeral challenges bind to a one-way HMAC of the IP. Raw payload storage is off by default. You remain the data controller; the sovereign deployment never sends telemetry to us.
The first-party route pattern is the answer. Your Next.js app proxies /api/v1/challenge and /api/v1/ingest through your own origin, so domain blocklists never see a third-party fingerprinting host. The SDK also degrades to a partial verdict instead of failing the request.
Identity scoring weights GPU profile 0.30, OS/display/fonts 0.25, WASM math invariants 0.15, behavioral biometrics 0.15, and ASN 0.15. A candidate must clear a 0.85 similarity threshold and the session must stay below a 70 risk score before the engine auto-links it to an existing device.
Yes. Nginx supplies JA4, HTTP/2, ASN, client port, and forwarded IP headers. TCP TTL and MSS come from either the edge header contract or the built-in AF_PACKET listener when Rust terminates the client handshake directly. The backend trusts edge headers only from CIDRs listed in FP_TRUSTED_PROXIES.
One statically linked Rust binary and one SQLite file in WAL mode. No Redis, no Postgres, no JVM, no managed cluster. A 4 vCPU node handles the included Sovereign quota; extra nodes are licensed per node.
Start with the free developer tier, run the integration tests against the real engine, then decide whether the managed edge or the sovereign binary fits your architecture.