What Is Canvas Fingerprinting?

Canvas fingerprinting is one of the most precise and widely used browser tracking techniques. It uses the HTML5 Canvas API, a standard web technology for drawing graphics in the browser, to generate a hidden image and then read back the pixel data. Graphics rendering differs slightly between devices because of the GPU, graphics drivers, the rendering engine, the operating system and its font rendering. So the rendered canvas image differs on many devices. A hash of this image becomes a digital fingerprint of the user's browser: your canvas fingerprint. For the wider context, see our complete browser fingerprinting guide and the online privacy check overview.

Unlike cookies, canvas fingerprints are not stored on your device. The same JavaScript recreates them on every page visit. Clearing your browser history, deleting cookies, switching to incognito mode or even reinstalling your browser has no effect on your canvas fingerprint.

How Does Canvas Fingerprinting Work? Step by Step

A script draws the same content on every device and compares the pixel result. These are the steps:

  • Create a hidden canvas element. JavaScript creates a canvas element that the user does not see.
  • Draw text and shapes. The script draws a specific font, text, shapes and gradients onto the canvas. Scripts often use font fallback to create more differences between devices.
  • Read the pixel data. The rendered canvas is read back using canvas.toDataURL() or getImageData().
  • Hash the result. The pixel string is hashed. The resulting hash is a compact fingerprint value.
  • Send to tracking server. The canvas hash goes to the tracking service and is linked to your browsing session.

Details such as anti-aliasing, sub-pixel hinting and font fallback change single pixels. Your eye cannot see the difference, but a different hash comes out.

How Unique Is a Canvas Fingerprint?

A canvas fingerprint alone is only relatively unique, but it makes a browser much more identifiable. In the first study on the method, Mowery and Shacham (2012) found 50 distinct renderings of one text test in 300 samples. The 2016 AmIUnique study, as summarized in a 2019 survey, rated canvas as one of the strongest attributes. Combined with screen resolution, time zone and user agent, it often produces a unique fingerprint.

Why Do Websites Use Canvas Fingerprinting?

Websites use canvas fingerprinting for online tracking without cookies and for fraud detection. A 2016 Princeton crawl of the top 1 million websites found canvas fingerprinting scripts on 14,371 sites. The researchers also saw that more third parties used the method, but on fewer sites than in their 2014 study.

How Is Canvas Fingerprinting Different from WebGL Fingerprinting?

Canvas fingerprinting uses the 2D drawing API, while WebGL fingerprinting uses the 3D graphics API and can also read the GPU name. Both are canvas-based fingerprinting techniques. Your graphics card and drivers shape the result of each. More on the 3D method: WebGL fingerprint test.

How to Protect Against Canvas Fingerprinting

To prevent canvas fingerprinting, you can block canvas requests, spoof them with noise, or use web browsers that make all users look alike. Each approach has trade-offs.

Brave randomizes canvas output with a seed that changes per site and per session. This makes cross-site tracking with one canvas hash much harder. Verify the setting at brave://settings/shields.

Use Firefox with ResistFingerprinting

Type about:config, search for privacy.resistFingerprinting, and set it to true. The browser then returns noise when a site extracts canvas image data. Mozilla notes that this setting can break some websites and recommends the lighter Fingerprinting Protection for most users.

Use CanvasBlocker Extension (Firefox)

This browser extension offers fine-grained control. Fake mode returns slightly randomized data. Fake mode is recommended over Block mode, because blocking the API can break websites. Use only one tool for canvas protection, since the add-on page warns that stacked protections can cause performance problems.

Use Tor Browser or Safari

Tor Browser returns blank (white) image data unless you allow canvas access for a site. Safari 26 (2025) prevents known fingerprinting scripts from reliably reading 2D canvas data.

How Can I Test My Canvas Fingerprint?

You can run the SpeedIQ test and open the "Browser FP" check. It works like a small fingerprinting script:

  1. It creates a hidden 2D canvas.
  2. It draws the word "SpeedIQ" in 14px Arial.
  3. It reads the image with toDataURL() and turns it into a short hash.
  4. It shows the hash only in your browser. Nothing is sent to a server.

How to read the result:

What you seeWhat it means
Same hash in every sessionYour canvas output is stable and can be used to track you
Hash changes after a browser restartYour browser randomizes canvas output (for example Brave)
Error, or the same hash as on other devicesCanvas reads are blocked or return a blank image (for example Tor Browser or a blocker extension)

The SpeedIQ check draws a simple text only. Real trackers draw more complex scenes, so their fingerprints carry more detail.

Summary

Canvas fingerprinting is a precise, invisible tracking technique that creates an identifier from how your browser renders graphics. Cookies, VPNs, incognito mode or clearing your browser data do not change it. Use SpeedIQ's canvas fingerprint test to see your current hash and to verify whether your browser's protection works.

→ Try it free: You can test your canvas fingerprint directly at SpeedIQ — no account, no ads.

FAQ

Is canvas fingerprinting legal?

It depends on where and how it is used. In the EU, the Article 29 Working Party stated in 2014 that the ePrivacy consent rule applies to device fingerprinting, so tracking with a canvas hash usually needs consent.

Can canvas fingerprinting be completely prevented?

Not completely without side effects. Blocking canvas reads stops the method but can break websites. Randomizing the output, as Brave does, keeps sites working and makes the hash useless across sites.

How do I turn off canvas fingerprinting?

Use a browser with built-in protection, such as Brave, Tor Browser or Safari 26, or set privacy.resistFingerprinting to true in Firefox. In Firefox you can also use CanvasBlocker in Fake mode.

Does a VPN stop canvas fingerprinting?

No. A VPN changes your IP address, but the canvas hash comes from your graphics hardware and software. It stays the same with or without a VPN.

How can I test my canvas fingerprint?

Open the Browser FP check on the SpeedIQ start page. It draws a short text on a hidden canvas and shows the hash in your browser.

Sources