Canvas fingerprint

How this test works

Web pages can draw on a canvas element: text, lines, curves, gradients and images, all rendered by the browser using the operating system's font engine and, in most cases, the graphics card. The page can then read the rendered pixels back as data. Nothing about that is unusual; charts, games and image editors rely on it. Fingerprinting uses the fact that the rendering is not identical everywhere.

This page performs the standard version of the technique in your browser and shows you what is normally hidden:

1. The script draws a fixed scene onto a 300 by 80 pixel canvas: text in more than one font, so font substitution and rasterization show up, overlapping shapes with partial transparency so colors blend, and curves with antialiased edges.
2. It exports the canvas as an image data string, the same call a tracking script makes.
3. It hashes that string and prints the hash, together with the length of the data string, which is a rough indicator of how complex the rendered image is.
4. The drawn canvas is displayed on the page rather than hidden, so you can see exactly what was hashed.
5. The run button repeats the whole process so you can check whether the hash is stable.

The hash is computed from the pixels, not from any description of your device, which is why two browsers that report the same user agent can produce different hashes: they rendered the text differently. On the same machine and browser version, the result is the same every time unless something deliberately changes it.

How to read your result

The data length is a secondary clue. A much shorter string than another device of the same class means a simpler rendering, for example no color emoji support or a software renderer; a changed length between runs while the drawing is the same points to noise being added.

For checking a login setup, the result you want is the first row, in the profile you will use, with the same hash every time you open this page. For anonymous browsing, the second row is what a privacy-oriented browser produces by design.

How to fix it

To stop canvas tracking in everyday browsing:

1. Firefox: open about:config and set privacy.resistFingerprinting to true. Sites that try to read a canvas get a blank result unless you grant permission from the icon in the address bar.
2. Brave: canvas is randomized per site by default under Shields, with the fingerprinting setting at its standard level. Set it to strict for stronger protection, at the cost of some sites misbehaving.
3. Chrome, Edge and other Chromium browsers: there is no built-in setting. An extension that adds canvas noise, such as CanvasBlocker-style tools, does the job; prefer one that adds noise rather than blocking outright, which is more conspicuous.
4. Safari: there is no user switch for canvas specifically. Its tracking protection targets other techniques; use a different browser if canvas protection is a requirement.
5. Reload this page and run twice. A changing hash confirms the protection is active.

To keep the hash stable for an account you log into through a proxy or VPN:

1. Use a dedicated browser profile for that account, with canvas noise off in that profile. In Firefox, leave privacy.resistFingerprinting at false there. In Brave, allow fingerprinting for the site or use a profile with Shields relaxed. Remove canvas extensions from that profile.
2. Do not change the browser version, display scaling or installed fonts on that machine more than you have to; each of those changes the hash, and a changed hash looks like a new device.
3. Run this page twice from the profile before logging in. Same image, same hash, both times.
4. Then run the browser fingerprint test for the other signals, and the anonymity score for the IP-side checks.

In antidetect browsers:

1. The canvas setting usually offers off, noise or block. Noise generates a consistent per-profile distortion so that each profile gets a different but stable hash; that is the mode to use when several profiles run on one machine and must look like separate devices.
2. Verify here that the hash is stable within a profile and different between profiles. Two profiles with the same hash on this page will look like the same device to any site that reads the canvas.
3. Avoid block mode for logins; an unreadable canvas is a rarer trait than any particular hash.

Limits of this test

• No population to compare against. We show your hash; we do not know how many other machines produce it, and we will not guess. Uniqueness claims require a database of visitors that this page does not keep.
• One drawing. Tracking scripts use their own drawings, so your hash here differs from your hash on any other site. The property that carries over is stability: if the hash is stable here, it is stable for other drawings too, and if it is randomized here, it is randomized everywhere.
• Noise detection is a heuristic. The page compares runs; a browser that randomizes only once per session, or per site, will look stable here while still defeating cross-site tracking. That is a good outcome for privacy and a confusing one for this test.
• Canvas is one signal. WebGL, audio, fonts, screen and the passive headers remain readable when canvas is blocked. See the full fingerprint test for the rest.
• What you see is after any extension has acted. The page cannot tell a genuinely rendered image from one modified by an extension; it can only tell you whether the result changes.

Why the same drawing produces different pixels

Text rendering is the main source. Each operating system has its own font rasterizer and its own rules for hinting and subpixel antialiasing, and the exact set of installed fonts decides which glyphs are used when a requested font is missing. Graphics hardware is the second source: when the browser accelerates canvas drawing with the GPU, the driver decides how edges are smoothed and how colors are blended, and different cards and driver versions round differently. The third source is the browser itself, since each engine draws curves and composites transparency slightly differently and changes those details between versions. Any one of these differences shifts a few pixels, and a hash of the whole image changes completely when a single pixel does. The canvas fingerprint glossary entry has a longer explanation of the rendering pipeline.

How websites use the canvas hash

By itself the hash identifies a rendering stack: a machine model, operating system, browser version and font set. Combined with a handful of other values it narrows down to a small group of devices, and combined with an IP address, a time zone and a login it narrows down to one person's setup. Trackers use it to recognize a browser across sites where cookies are blocked. Fraud and account-security systems use it the other way around: they store the hash seen at signup and at past logins, and treat a login with a different hash from a different address as a new device that deserves a challenge. That is the reason the advice differs by goal. For privacy from trackers, make the hash change. For a trusted login, make it never change.

Canvas noise: when it helps and when it hurts

Noise helps when you want to be unrecognizable across sites, and the cost is small: a few sites that use canvas for real work may misrender, and scripts that look for randomization will know you use it. Noise hurts when a service already knows your browser and expects to see it again, because every visit then arrives as a new device, which invites verification emails, two-factor prompts and, on strict platforms, reviews. The clean solution is separation: a privacy browser with noise for general browsing, and a stable, unremarkable profile for the accounts that matter, tested here before use.