Fingerprinting · Browser Tests
Canvas Fingerprint Test
See the canvas hash your graphics stack produces, and what about your setup changes it.
Text, arcs and a multiply blend are painted to a hidden 300 by 64 canvas, then read back pixel by pixel.
Your canvas hash
The exact pixels behind that hash
Rendering detail
The canvas is created, drawn and hashed inside this tab and never uploaded. A canvas hash is a stable label for your graphics and font stack, not an image of your screen.
On this page
What a canvas fingerprint actually is
A canvas fingerprint is a short string derived from the pixels a browser paints onto an HTML canvas. The page draws a scene you never see, reads the pixels back and hashes them. Because the exact pixels depend on the browser, the font rasteriser and the graphics driver, the resulting hash is often stable enough to recognise the same machine again.
The technique has been documented since 2012 and is now one of the most common signals in commercial fingerprinting libraries. It needs no permission, no cookie and no storage, which is precisely what makes it attractive. The drawing happens in memory the moment the page runs, and the only thing a site keeps is the hash, not the image.
It is a hash, not a picture
The widget renders the actual 300 by 64 canvas so you can see the scene, but the value a tracker stores is the hash below it. The image itself never leaves your browser.
How the canvas hash is drawn
The scene above is deliberately fiddly. It sets textBaseline to top, then paints a 16-pixel Arial string twice: once in solid blue, then again in translucent indigo offset by two pixels. The overlap forces the browser to blend two colours, and different rasterisers resolve that blend differently. A filled orange rectangle sits behind the text, and a stroked arc is drawn at (50, 32) with a radius of 20.
The final step is the one that matters most. A circle is filled in green with globalCompositeOperation set to multiply, so every overlapping pixel is recomputed through a blend equation. The browser then serialises the canvas with toDataURL('image/png'). That base64 string is what gets hashed, and its length alone varies between browsers because their PNG encoders make different compression choices.
Nothing here is random. Every difference comes from anti-aliasing rules, font hinting, sub-pixel coverage and the colour profile the browser applies, all of which are decided by software outside the page's control.
Why the same pixels come back every visit
The reason canvas fingerprinting works at all is determinism. Given the same browser build, the same fonts, the same driver and the same zoom level, the rasteriser will round the same edge the same way every single time. Close the tab, reopen it next week, and the hash usually comes back identical. The stability figure in the widget measures exactly that: it redraws the scene five times in a row and counts how many hashes match the first.
That stability is also the signal's weak point. Anything that changes the paint path changes the hash. A browser update that ships a new anti-aliasing routine, a graphics driver update, or simply zooming the page to 110 percent can all produce a different value. A tracker that watches this sees the hash drift over time, which is why it is treated as one input among many rather than a permanent identity.
The device pixel ratio test shows the scaling factor that sits behind some of that drift.
Where canvas fingerprinting breaks down
Canvas reads are easy to interfere with, and several browsers now do so by default. Firefox's fingerprinting protection can block or prompt on canvas reads, and Brave adds small per-site, per-session noise to the pixels so the same scene yields a different hash to each site and on each visit. Tor Browser goes further and asks before any page may read canvas data at all.
There are honest limits on the other side too. A canvas hash identifies a configuration, not a person: two identical laptops bought in the same month hash identically. It also says nothing about who you are, and a site that only stores the hash cannot tell whether the value belongs to one visitor or to a million. The signal's value is in the combination, which is what the browser fingerprint test demonstrates.
Finally, cross-origin images taint a canvas and block reads entirely, so the technique only works on a scene the page drew itself.
What you can do about it
The practical options are narrow and each has a cost. A browser or extension that blocks canvas reads stops this signal completely, but it also breaks any legitimate use of canvas, from photo croppers to in-browser maps. Per-site noise, as Brave does it, keeps those features working while making the hash useless for cross-site matching. Firefox lets you choose between blocking and being asked.
Simply spoofing one value rarely helps. If your canvas hash claims to be an iPhone while your WebGL renderer and audio fingerprint say Windows desktop, the contradiction is itself distinctive. Reducing how many signals you emit, rather than editing them one by one, is usually the better trade. The font detection test shows a related signal that is also driven by the same rasteriser.