What it measures
The signal reads navigator.platform (e.g., 'MacIntel', 'Win32', 'Linux x86_64') and navigator.maxTouchPoints (the number of simultaneous touch contacts the hardware digitiser supports). These two values are the entire hash input. Additional navigator properties — hardwareConcurrency, deviceMemory, userAgentData.platform, userAgentData.architecture, and languages — are also collected and stored in value.engine for analytics and debug use, but are excluded from the hash.
Collection is synchronous and sub-millisecond.
How it's collected
If globalThis.navigator is absent, the result is absent. Otherwise the collector reads each property via a helper that coerces undefined and null to empty strings (arrays are joined with commas). The hardwareFields array is [platform, maxTouchPoints] (both as strings). These two values are joined with the pipe delimiter and hashed with xxHash64.
The collector then attempts to read navigator.userAgentData (Chrome-only) and navigator.languages in separate try/catch blocks, silently catching failures. The results are placed in value.engine but never influence the hash.
Confidence rules
| Confidence | Trigger |
|---|---|
| normal | globalThis.navigator is present |
| absent | globalThis.navigator is undefined, or any unhandled exception |
Why hardware-bound
navigator.platform has been a consistent cross-browser API for over two decades. All major engines — Blink, Gecko, and WebKit — report the same OS and architecture string on the same device. navigator.maxTouchPoints reflects the hardware touch digitiser and is similarly cross-engine stable. Neither field is spoofed by default privacy settings in Chrome, Safari, or standard Firefox.
hardwareConcurrency and deviceMemory were considered for the hash but excluded because Brave Standard mode farbles both per eTLD+1 session, Firefox resistFingerprinting returns fixed dummy values, and Tor Browser returns hard-coded values. Including them would break the cross-browser hardware-identity guarantee.
Things worth knowing
- iOS Safari reports navigator.platform as 'iPhone' or 'iPad'. maxTouchPoints is typically 5.
- macOS machines with a Magic Trackpad may report maxTouchPoints > 0. On Apple Silicon Macs, iPadOS apps running natively may affect touch point readings.
- When navigator.deviceMemory is not defined (Firefox, Safari), the value.engine field stores '__unsupported__' as a placeholder string instead of a numeric value.
- userAgentData is Chrome-only and therefore excluded from the hash; it is stored in value.engine for callers that run only in Chromium.
