← All articles

Canvas Fingerprinting: How It Identifies You

2026-09-01 · 6 min read

A site draws text and shapes onto an invisible canvas, reads the pixels back, and hashes them. The result is identical every time on the same machine and differs subtly between machines, because rendering depends on the GPU, the graphics driver, the operating system and the installed fonts working together. No permission is required and nothing appears on screen.

How does the technique work?

The page creates a canvas element, draws a short string in a specific font alongside some shapes and gradients, then calls a method that returns the rendered image as data. Hashing that data produces a short string. Two machines with the same GPU model, driver version, operating system and fonts produce the same hash; almost anything different produces another.

The whole operation takes a few milliseconds and leaves no visible trace, which is why it became a standard component of commercial fingerprinting.

Why do the results differ between machines?

Rendering text and curves involves decisions that are not fully standardised. Anti-aliasing, sub-pixel positioning, gradient interpolation and font hinting are all implemented slightly differently across hardware and software combinations, and those differences survive into the pixel values.

Contributing factor	Affects
GPU model	Rasterisation and gradient maths
Graphics driver version	Anti-aliasing behaviour
Operating system	Font hinting and sub-pixel rendering
Installed fonts	Which glyphs are available to draw
Browser engine	Drawing pipeline implementation

How much does it identify on its own?

Less than people assume, and more than enough in combination. Common configurations — a widely sold laptop model running a current operating system — share a canvas hash with a large population. Unusual hardware, unusual driver versions or a large custom font collection narrow that population quickly.

Canvas is powerful because it is stable and cheap to collect, not because it is individually unique. Combined with three or four other signals it usually is.

What happens when you block or randomise it?

Both approaches create new signals. Blocking puts you in the small group of browsers that refuse to return canvas data, which is itself distinctive. Randomising per call means two reads seconds apart return different hashes, which no physical GPU produces and which dedicated tests check for directly.

Approach	Result
Return the real value	Trackable, but ordinary
Block entirely	Rare, therefore distinctive
Randomise per call	Impossible for real hardware, detectable
Stable substituted value	Looks like a different ordinary machine

How widely is it deployed?

Widely enough that assuming its absence is unwise. Canvas reading has been standard in commercial fingerprinting libraries for over 10 years, and it ships inside bot management, fraud scoring and analytics products that most sites install without ever thinking about the technique by name.

Cost explains the reach. Collecting a canvas hash takes 1 hidden element, a few lines of JavaScript and under 50 milliseconds, so there is no performance reason for a site to leave it out once the library is already loaded.

What does a correct implementation look like?

A substituted value that stays byte-identical for the life of the profile and corresponds to a plausible hardware combination. The substitution has to happen deep enough in the rendering path that the returned pixels are internally consistent — intercepting the read method and returning a fixed string fails against tests that compare a canvas result against the WebGL renderer string it should match.

Test it in a minute: load a fingerprint page, note the canvas hash, reload, and compare. Identical is correct. Different is a defect, whatever the tool calls it. Then close the browser, reopen, and check again — stability across restarts is where weaker implementations fail.

Run that 3-step check on all 20 profiles before trusting any of them with an account. Roughly 5 minutes of testing per profile is the cheapest insurance available, because a canvas value that moves between 2 reloads has already told every site the device is being manufactured — and no other setting compensates for that. Do it once at creation and once after every browser update, and nothing else about canvas needs your attention for the rest of the profile's life.