▒ fingerprint

Zero-prompt device identity

Fingerprint the device.
No browser prompts.

A hybrid identity layer for Cloudflare Workers: passive edge signals, silent browser fingerprinting, a first-party anchor, and calibrated fuzzy matching. No WebAuthn dialog, no permission popups. The Rust/WASM hardware probe is opt-in and separate. The demo itself still asks for legal consent before it runs.

Cloudflare Workers TypeScript Rust / WASM Drizzle + D1 Apache-2.0
Run the demo View source ← yasogan.dev

01 / How it works

Four layers, one identity graph.

01

Passive edge

The Worker reads TLS/HTTP stack, header order, Client Hints, ASN/geo, and RTT from every request. No client cooperation.

request.cf · requestHeaderNames
02

Silent browser

A same-origin page collects canvas, WebGL, audio, fonts, media queries, CSS supports, screen, and optional passive behavior. No permission prompts.

canvas · WebGL · audio · fonts
03

First-party anchor

A cookie, ETag, and stateless HMAC nonce give continuity. The fingerprint is the recovery path when the anchor is missing.

fp_id cookie · ETag · HMAC nonce
04

Decision layer

A hard bucket plus weighted similarity and D1/Drizzle storage returns a visitor ID, confidence, and a tri-state decision.

bucket · score · confidence
Opt-in hardware WASM. The separate @yasogan/fingerprint/hardware entry runs a Rust/WASM cache/SIMD/scalar probe plus WebGL/WebGPU/audio/timer telemetry. It is a timing side channel, so it is not part of the core bundle and only runs after consent.

02 / Live demo

Consent first. Then run both probes.

What is stored: identity runs store a visitor and observation in D1, keyed by the fp_id cookie. Hardware runs stay in the browser and are not posted. No IP address is stored.

This page is a demonstration. Fingerprinting is regulated; use a lawful basis, disclosure, minimization, retention limits, and a DPIA where required.