A hidden canvas drawing can recognise your browser without permission or stored files. Here is how the pixels are read, hashed and turned into an identifier.
On this page
The mechanism, step by step
A page draws something you will never look at. Then it reads the drawing back and turns it into a number.
Canvas fingerprinting is usually named first when someone asks how a website can recognise them without cookies. It sounds exotic, but the mechanism is ordinary: a page asks your browser to draw a short piece of text and a colour gradient into an area you never see, reads the finished image back pixel by pixel, and turns it into a number that tends to stay the same for your machine on every visit, and to differ from almost everyone else’s.
The whole thing runs through a standard feature of the web called the canvas element. Sites use it for legitimate work all the time — charts, image editing, games — which is why it needs no special permission.
The page makes a canvas in memory, positioned off-screen or hidden, so nothing appears on your monitor. It then draws something specific: a short string of text in a chosen font, a filled rectangle, a curved shape, a gradient. The same instructions go to every visitor, so any difference in the result comes from the machine, not the drawing.
To finish, the page calls toDataURL() for a base64 image or getImageData() for the raw colour values, and passes the pixel data through a hash function. That produces a short fixed-length string, and that string is the canvas fingerprint. From this single operation the site learns nothing readable about you, yet it obtains a value remarkably stable for your combination of hardware and software.
Why two machines draw the same text differently
If every browser followed the drawing instructions identically, the image would be the same everywhere and the technique would be useless. In practice no two setups render identically, because the instructions pass through deep layers of the system.
The graphics hardware and its driver decide how shapes and gradients are rasterised, the process of turning vector instructions into actual pixels. Anti-aliasing, the smoothing applied to curved and diagonal edges, differs between rendering engines and driver settings, shifting the exact shade of pixels along an edge. Text is rasterised by the operating system’s font engine, which handles hinting and sub-pixel rendering differently on Windows, macOS and Linux. Small differences in how colour values are rounded, and how the image is encoded, add variation on top.
None of these differences is visible to your eye; a smear of colour at the edge of a letter is a fraction of a shade off, and that is enough. Fingerprinting needs only a difference a computer can measure.
No permission and no prompt
One of the two surprises is that there is no prompt. Because the canvas element is a normal part of the web, drawing to it and reading it back raises no dialogue, requests no permission, and usually happens before the page has finished loading.
There is no consent step to catch and nothing to review in a settings page; the technique runs before the page is ready, so the reading is taken before you look at the content. You can watch the mechanics on your own machine with the canvas fingerprint test.
Nothing stored on your device
The second surprise is that nothing is stored on your device. There is no cookie, no file, no entry in local storage that you could inspect or delete; the fingerprint is calculated from scratch on each visit, and the site keeps the resulting hash on its own servers.
That single detail explains why clearing your browser data does nothing to it: there is nothing on your machine to clear, so the usual instinct — emptying cookies, wiping the cache — leaves the value where it was.
What actually changes the hash
Because the value comes from your system rather than a stored file, it changes only when the underlying signals change, which makes some privacy actions useless and others effective.
| Change | Effect on the canvas hash |
|---|---|
| Clearing cookies or browsing data | None |
| Opening a private or incognito window | Usually none |
| Installing a different browser | Often different |
| Adding fonts or a font pack | Sometimes different |
| Updating your graphics driver or OS | Often different |
| Using a browser that randomises canvas | Different on every read |
The private-window row is the one that catches people out. Private mode hides your history and cookies from the next person at the keyboard; it does nothing to change how your machine renders pixels, so the fingerprint follows you into the window.
How it combines with WebGL and the rest
On its own, a canvas hash is a strong signal. In a full browser fingerprint it is one row among many, sitting alongside a WebGL fingerprint that pulls the same trick with 3D rendering and reports your graphics hardware by name. We look at that signal separately in WebGL fingerprinting and your GPU.
When several stable signals agree, a tracker can recognise you even if one of them is blocked, and that is the real reason the technique has proved so durable.
Where this leaves the trade-off
You cannot delete a canvas fingerprint, because there is nothing on your device to delete. What you can do is change what your browser returns. A browser that adds random noise to each canvas read, or blocks canvas reads altogether, breaks the method, but at the cost of marking you as an unusual visitor, which is its own signal. The honest position is that this is a trade-off, not a free win.
That trade-off runs through every rendering signal. Read how to reduce your browser fingerprint for what is worth changing and what quietly makes you stand out more, then decide how much of it to take.