Why not just hash all device signals together into one identifier?

Because a single combined hash changes the moment any input changes, and browser signals change routinely, so a returning device would constantly appear new. That breaks the repeat recognition fraud prevention depends on and is easy for attackers to exploit with minor tweaks. Separating signals into stability tiers lets the identifier absorb expected drift while still distinguishing genuinely different devices.

How does the algorithm handle a browser update that changes signals?

It relies on the stable tiers, chiefly hardware signals like GPU and screen, to anchor identity, while treating volatile session signals such as the user-agent as weaker evidence. When an update changes only the volatile tier, the stable tiers still match, so the device is recognized with somewhat lower confidence rather than counted as new. This tolerance for expected change is the whole point of the tiered design.

Risk & Detection

Identification Algorithm

An identification algorithm is the method that turns raw device signals into a stable visitor identifier by separating signals into stability tiers, hashing each tier, and combining them with weighted confidence. It is engineered to recognize the same device over time despite the routine drift of individual signals.

Start Free Book a Demo

How it works

How Identification Algorithm works

The core insight is that not all signals are equally stable. The algorithm sorts them into tiers: hardware signals such as GPU and screen characteristics change rarely; software signals such as installed fonts and plugins change occasionally; and session signals such as user-agent string and timezone change often. Treating these tiers separately prevents a volatile signal from breaking recognition of an otherwise unchanged device.

Each tier is hashed independently so it can be compared on its own. When a visitor returns, the algorithm matches tier by tier: the stable hardware hash anchoring identity, the software hash confirming it, and the session hash providing weaker corroboration. This layered comparison means a browser update that changes the user-agent does not by itself sever the link to the device.

The per-tier matches are then combined into a single identifier and a confidence score using weights that reflect each tier's reliability. High-stability agreement yields high confidence; disagreement in volatile tiers alone lowers confidence modestly rather than declaring a new device. This is fuzzy matching by design, tolerant of expected change while still distinguishing genuinely different devices.

Why it matters

Why Identification Algorithm matters for fraud prevention

A naive fingerprint that concatenates all signals and hashes them once is brittle: any change, and browsers change constantly, produces a different hash and makes a returning device look brand new. That fragility is fatal for fraud prevention, because it lets attackers reset their identity with trivial tweaks and it fragments the history of legitimate users. A tiered, weighted algorithm is what makes an identifier stable enough to anchor velocity checks, device graphs, and repeat-abuse detection.

With TRACIO

How TRACIO handles it

TRACIO's Identification product is built on this tiered, weighted approach across 130+ device signals, which is how it sustains 99.5% accuracy on internal benchmarks and keeps visitor IDs stable through browser updates, incognito mode, and cookie clearing. Every identification is returned with a confidence score so integrators can see how strongly the tiers agreed and calibrate their own thresholds.

Explore further

Identification Identification docs Signal stability across updates

FAQ

Frequently asked questions

Identify every device with confidence

Start with a free plan of 2,500 API calls per month. No credit card required.