Canvas fingerprinting identifies a browser by asking it to draw a picture and looking at the exact pixels it produces. Nothing visible happens: the drawing is hidden, and the website only reads the result.
How it works
HTML has a canvas element that scripts can draw on. A fingerprinting script draws some text, often a sentence in several fonts with emoji and overlapping coloured shapes, then converts the image to data and computes a hash. The same code on two devices usually gives different results, because the final pixels depend on the graphics hardware, the driver, the operating system's font rendering and anti-aliasing and the fonts installed. Two identical laptops with identical software will match; most real devices will not.
Why it is so effective
It needs no permission, no cookie and no storage, and it is stable from one visit to the next. A canvas hash on its own is shared by a fairly large group, but combined with other signals such as the screen size, languages, time zone and the WebGL graphics card string it narrows the field quickly. Research that measured it in the wild found it on thousands of popular sites, mostly through third-party advertising and anti-fraud scripts.
Who uses it
- Advertising and analytics networks that want to recognise visitors who block cookies.
- Fraud and bot detection services that spot account takeover when a known account appears on an unknown device.
- Some malicious scripts, which use it to profile victims.
The same technique serves security and tracking, which is why blocking it is a trade-off.
How browsers defend against it
Tor Browser asks before allowing canvas reads and returns a blank image if you refuse. Brave adds tiny random changes to the pixels, so the hash changes between sites and sessions. Firefox can do similar with resist-fingerprinting enabled, and Safari limits what it exposes. Our fingerprint test draws the canvas twice, and if the two results differ it tells you your browser is adding noise.
What you can do
Use a browser with canvas protection, block third-party trackers and avoid extensions that only spoof values, since inconsistent values can make you more distinctive. The step-by-step options are in how to prevent browser fingerprinting.