Canvas Fingerprinting

Canvas fingerprinting is a tracking technique that identifies a device by how it draws graphics. A site quietly asks your browser to render some text or shapes onto an invisible <canvas> element, reads back the exact pixels produced, and turns them into a short identifying hash.

The trick is that the same drawing instructions do not produce byte-identical results everywhere. Your graphics card, driver version, operating system, installed fonts, and anti-aliasing settings all nudge the output. Those differences are invisible to you but perfectly measurable in code.

How it works, step by step

1. The page creates a canvas element that is never displayed on screen.
2. It draws something deliberately awkward to render — overlapping text in an unusual font, curves, gradients, sometimes an emoji.
3. It calls toDataURL() to read back the finished image as raw data.
4. That data is hashed into a compact string such as a3f9c2....
5. The hash becomes your identifier, and it stays the same every time you return.

The whole thing takes milliseconds and produces no visible sign that it happened.

Why trackers like it so much

• No storage is involved. Nothing is saved on your device, so there is nothing to delete.
• Clearing cookies achieves nothing, because the fingerprint is recalculated from your hardware each time.
• Private browsing does not help. Incognito mode uses the same GPU and fonts as a normal window.
• It works across sites, letting different companies recognise the same visitor.
• There is no consent prompt, because no data is being stored in the sense cookie rules describe.

On its own a canvas hash is rarely unique. Combined with your screen size, timezone, language, WebGL and audio fingerprints, and installed fonts, it becomes precise enough to single out one device among millions.

The defence paradox

Here is what trips people up: blocking canvas fingerprinting can make you easier to track, not harder. If your browser returns a blank canvas while virtually nobody else does, that refusal is itself a distinctive signal. You have swapped one identifier for another, rarer one.

The two defences that actually work take opposite approaches. Randomisation adds slight noise so your fingerprint differs on every visit and cannot be used to link sessions — the approach Brave takes. Uniformity makes everyone look identical, which is what the Tor Browser does by making all users share one fingerprint. Anti-detect browsers use a third variant: they present a consistent, believable fingerprint per profile, so each profile looks like a different ordinary person rather than like someone hiding.

It is not only used for tracking

Fraud prevention relies on the same technique. Banks and payment processors use canvas fingerprints to spot when a login arrives from an unfamiliar device, and anti-bot systems use them to detect automation tools whose fingerprints look synthetic or repeat identically across thousands of sessions. The technology is neutral; how it is applied is not.