# samyk/evercookie

Produces persistent, respawning "super" cookies in a browser, abusing over a dozen techniques. Its goal is to identify users after they've removed standard cookies and other privacy data such as Flash cookies (LSOs), HTML5 storage, SilverLight storage, and others.

Repository: https://github.com/samyk/evercookie
Canonical: https://ross.abutalabs.com/products/evercookie
Homepage: https://samy.pl/evercookie/
Language: JavaScript
License Family: other
Last push: 2025-04-16T20:26:58+00:00

## Health v2 (maintenance only)
Score: 39/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 16, release rhythm 35, longevity 100
- inputs: {"age_days": 5824, "days_push": 504, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 4726, forks 657 (observed 2026-08-28T04:08:57.593285+00:00)

## What it is
Evercookie is a JavaScript API that creates extremely persistent, respawning 'super' cookies by storing identifiers across a dozen-plus browser storage mechanisms (HTTP cookies, Flash LSOs, HTML5 storage, ETags, HSTS pinning, canvas, and more). It aggressively recreates deleted cookie data as long as any one storage mechanism remains intact, and can even propagate cookies between browsers on the same machine.

## Use cases
- demonstrate how persistent browser tracking works
- test how well privacy tools and browsers resist respawning cookies
- research browser storage mechanisms used for user identification
- educate users on why clearing cookies isn't enough for anonymity
- evaluate anti-tracking extensions against supercookie techniques

## When to choose
- you need a well-known reference implementation of persistent-cookie techniques for research or education
- you want to audit privacy software against a wide range of storage-based tracking vectors
- you're demonstrating tracking risks to non-technical audiences

## When to avoid
- you want to actually track users in production - many mechanisms (Flash, Silverlight, Java, IE userData) are obsolete and it's ethically and often legally problematic
- you need a supported, licensed dependency - the repo has no license
- you're building privacy-respecting analytics or consent-compliant identification
- you need modern browser support - several techniques no longer work in current browsers

## Facets
- artifact type: library
- maturity: maintenance
- function: security, privacy, http-client, middleware
- domain: privacy, security, web-development, browser-extensions
- platform: browser
- tags: tracking, cookies, fingerprinting, demonstration, privacy-research, persistent-identification, javascript, web-server

## Member repositories
- samyk/evercookie (main) score 39

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:57.593285+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:19:04.082647+00:00, confidence not recorded.
  - readme: https://github.com/samyk/evercookie (fetched 2026-08-28T04:08:57.593285+00:00, sha 1d1de9832903)
  - homepage: https://samy.pl/evercookie/ (fetched 2026-08-29T09:03:02.441115+00:00, sha cb3b03b79bf4)
- Data as of 2026-08-30T08:39:29.467469+00:00.