What Is WebGL Fingerprinting?

WebGL (Web Graphics Library) is a JavaScript API that lets browsers render 2D and 3D graphics with your device's GPU. It powers browser games, interactive maps, data visualizations and many modern web apps. A WebGL fingerprint is an identifier built from how your graphics stack answers WebGL calls. For the overview of where WebGL fits into the full picture, see our complete browser fingerprinting guide and the online privacy check hub.

WebGL fingerprinting exploits this rendering capability. By drawing a hidden scene and reading back the pixel data, tracking scripts learn details about your GPU model, graphics driver version and rendering pipeline. Combined with other values, this helps to identify your device. It works alongside canvas fingerprinting, which uses the 2D part of the same canvas element.

Unlike cookies or browser storage, WebGL fingerprints are generated on the fly from your hardware and software. Clearing your browser history, using incognito mode or connecting through a VPN has no effect on your WebGL fingerprint.

How WebGL Fingerprinting Works

The fingerprinting process uses two main techniques: reading values the API reports, and measuring how your GPU renders a test scene.

1. Renderer String Extraction

WebGL offers the WEBGL_debug_renderer_info extension. It reveals the vendor and renderer strings of the graphics driver, for example "NVIDIA GeForce RTX 3080/PCIe/SSE2" or "ANGLE (Apple, ANGLE Metal Renderer: Apple M5 Max)". Such a string often names the exact GPU model. A script can also call getParameter() for values such as MAX_TEXTURE_SIZE, MAX_VIEWPORT_DIMS and the shading language version, and it can read the list of supported WebGL extensions.

2. Pixel-Level Rendering Analysis

A script draws a 3D scene with textures, lights and shaders and reads the resulting pixel values. Vertex and fragment shaders are small programs that run on the graphics processing unit, so each WebGL shader exposes how your GPU and its driver behave. Different GPU models and driver versions process floating-point arithmetic slightly differently, so the WebGL image varies at the pixel level. The script hashes the pixels into a WebGL report hash.

What Information Can a Website Read via WebGL?

Data pointHow it is readExample
GPU vendorUNMASKED_VENDOR_WEBGLNVIDIA, Apple, Intel
GPU model / rendererUNMASKED_RENDERER_WEBGLGeForce RTX 3080
LimitsgetParameter()Maximum texture size, viewport size
Supported extensionsgetSupportedExtensions()List of extension names
Rendered imageDraw a scene, then read pixelsHash of the pixel buffer

How Unique Is a WebGL Fingerprint?

A WebGL fingerprint alone is often shared by many people with the same GPU and driver, so it is not unique on its own. Its strength comes from combining it with other values. Research shows how much it adds:

  • Mowery and Shacham (2012) rendered one WebGL scene on 270 samples and observed 50 distinct results.
  • The AmIUnique study (2016) called its random WebGL test "too brittle and unreliable", according to Cao et al.
  • Cao et al. (2017) used more than 20 controlled rendering tasks with graphics, CPU and installed writing-script features. They identified 99.24% of 1,903 users in one browser.

So WebGL fingerprinting works best when the script controls the scene carefully. Whether it is more reliable than canvas depends on the script.

What Else Goes Into a Full Device Fingerprint?

A WebGL fingerprint is non-unique on its own, so fingerprinting scripts add other data to create a unique profile. Typical companions are:

  • screen resolution and color depth
  • browser version and user agent
  • operating system, language and time zone
  • canvas and audio fingerprints
  • installed fonts (see our font fingerprint test)
  • IP addresses, which a server always sees

This combination of data lets trackers uniquely identify users across the web, even when each single value is common.

What About WebGPU?

WebGPU is the newer graphics API in modern web browsers. It also reports adapter details, such as the GPU vendor and architecture. Brave's 2026 update therefore empties the WebGPU adapter descriptors in addition to the WebGL changes. Expect fingerprinting scripts to read both APIs where they are available.

Why Is WebGL Fingerprinting Particularly Dangerous?

WebGL fingerprinting is risky because parts of it follow your hardware, not your browser. If you use Chrome and then switch to Firefox, both browsers run on the same GPU and driver. Cao et al. (2017) used such GPU, CPU and OS features to recognize users across different browsers on the same machine: 83.24% uniqueness with 91.44% cross-browser stability. The fingerprint is not always identical across browsers, because each browser can mask or translate graphics calls differently.

It also requires no storage, so there is nothing to delete. VPNs, private browsing and cookie deletion have no effect. Even if you use a VPN and switch to another browser, the GPU underneath stays the same, and you do not see when a site reads it.

Why Do Websites Use WebGL Fingerprinting?

Websites use WebGL data for tracking, for fraud detection and, rarely, for real graphics tuning. When Brave crawled popular websites in 2026, it found that most sites used the WebGL renderer and GPU queries exclusively for browser fingerprinting. MDN, the reference for web developers, says the driver information should only be used in edge cases, such as to debug GPU problems.

How Is WebGL Fingerprinting Different from Canvas Fingerprinting?

WebGL fingerprinting uses the 3D graphics API and can read the GPU name directly, while canvas fingerprinting uses the 2D API and only measures the drawn pixels. Both are generated inside the browser from the same graphics hardware, and trackers often combine them with audio and font tests. See our audio fingerprint test guide for the sound-based method.

How to Reduce Your WebGL Fingerprint

The most effective approach is to use the Tor Browser. Firefox offers partial protection via the privacy.resistFingerprinting setting. Browser extensions like CanvasBlocker can block or randomize WebGL output. The details:

  • Tor Browser: its design blocks WebGL until you allow it for a site (click-to-play) and hides driver details.
  • Brave: since version 1.93 (2026) it reports one generic vendor and renderer string for all users and randomizes the WebGL extension list per site and session. WebGL itself keeps working.
  • Firefox: with privacy.resistFingerprinting set to true, the WEBGL_debug_renderer_info extension is disabled, so sites cannot read the GPU name this way.
  • CanvasBlocker (Firefox): protects the WebGL API by default and returns altered values in Fake mode.
  • Disable WebGL: in Firefox, setting webgl.disabled to true in about:config turns WebGL off. Disabling WebGL entirely removes this data source, but 3D maps, games and some websites stop working.

Can WebGL Fingerprints Be Spoofed?

Yes, but spoofing is hard to do well. Anti-detect browsers and extensions can spoof WebGL vendor strings or add noise to the rendered image. If only the renderer string changes while the image still comes from your real GPU, the values no longer fit together. Such a mismatch is itself a signal, so a consistent, common profile usually protects better than a random fake one.

How Can I Check My WebGL Fingerprint?

You can check the renderer string yourself in the browser console. Paste these lines, based on the MDN example, into the developer console:

  • const gl = document.createElement("canvas").getContext("webgl");
  • const ext = gl.getExtension("WEBGL_debug_renderer_info");
  • console.log(gl.getParameter(ext.UNMASKED_RENDERER_WEBGL));

If the result names your exact GPU, sites can read it too. If ext is null or the string is generic, your browser hides it.

The SpeedIQ checks do not run a WebGL test yet. You can run the SpeedIQ test to see related fingerprint values: the canvas hash, screen, hardware (CPU cores, memory), language, time zone and user agent. The results stay in your browser.

Summary

WebGL fingerprinting is one of the stronger passive fingerprinting techniques, because it reads your GPU and measures how it renders. Check your renderer string, then pick a browser that hides or standardizes it.

→ Try it free: You can check your browser fingerprint values directly at SpeedIQ — no account, no ads.

FAQ

Is WebGL safe to use?

Yes, WebGL is a standard browser API for 3D graphics. The privacy risk is that sites can read your GPU details and rendering output and use them as a fingerprint.

Is device fingerprinting legal?

In the EU, the Article 29 Working Party stated in 2014 that the ePrivacy consent rule applies to device fingerprinting. Trackers therefore usually need your consent.

Does a VPN hide my WebGL fingerprint?

No. A VPN only changes your IP address. The WebGL fingerprint comes from your graphics card and driver, which stay the same.

How do I disable WebGL fingerprinting?

Use Tor Browser, Brave or Firefox with privacy.resistFingerprinting, or add CanvasBlocker. Disabling WebGL entirely also works, but breaks 3D content.

Is a WebGL fingerprint the same in Chrome and Firefox?

Often similar, but not always identical. Hardware-level features stay the same, while each browser may mask the GPU name or render calls differently.

Sources