Canvas fingerprinting explained (and how to test yours)
Canvas, WebGL and audio hashes are the highest-entropy signals a website can read without a single cookie. This guide shows exactly how they are produced, what they reveal, and how modern anti-fingerprinting defences change the picture.
Updated 23 August 2026
Run the free live testHow a canvas hash is produced
The site creates an off-screen <canvas>, draws a fixed string of text with a specific font stack, adds gradients and blended shapes, then calls toDataURL() and hashes the result. Nothing is displayed to you. The output depends on your GPU and driver, the rasterisation library, sub-pixel anti-aliasing, colour management and which fonts actually resolved — so the same code produces a different string on a different machine.
Our live analyzer computes five separate canvas hashes (text, geometry, blend modes, emoji rendering and a composite) rather than one, because a browser that randomises output will produce inconsistent values across the five, which is itself detectable.
What each surface contributes
- 2D canvas — font rasterisation and anti-aliasing; very high entropy, very stable.
- WebGL — unmasked vendor/renderer strings (e.g. "ANGLE (NVIDIA GeForce RTX 4070)") plus ~40 numeric limits such as max texture size and shader precision.
- AudioContext — an oscillator run through a dynamics compressor; the float sum differs by audio stack and CPU.
- Font metrics — measuring text width per font detects which fonts are installed, which is heavily OS- and locale-dependent.
Why it identifies you without cookies
Individually each value is common. Combined, they usually land in a bucket of one. Clearing cookies, switching to private browsing, or changing your IP does not change the hash — which is why anti-fraud systems trust it more than a cookie, and why trackers like it.
Defences and their side effects
- Randomisation (Brave "farbling", Firefox resistFingerprinting) — adds per-session noise. Tracking breaks, but an unstable hash across reloads flags you as a privacy-hardened user.
- Blocking (Tor Browser) — canvas reads prompt or return blank. Highly effective, but produces a small, recognisable crowd.
- Uniformity (Safari, Tor) — report a generic profile so many users share one hash. Best privacy outcome when the crowd is large.
- Spoofing extensions — often inconsistent (canvas spoofed, WebGL not), which is the easiest defence to detect.
Test your own hashes
Run the free live analyzer to see all five canvas hashes, your WebGL vendor/renderer and limits, the audio hash, resolved font list and the combined entropy estimate — plus whether your browser is randomising anything.
Frequently asked questions
What is canvas fingerprinting?
A site draws text and shapes to a hidden HTML canvas, reads the pixels back, and hashes them. Tiny differences in GPU, driver, font rasteriser and anti-aliasing make that hash stable for one device and different across devices, so it works as an identifier without cookies.
Is canvas fingerprinting legal?
It is widely used for anti-fraud and bot detection. In the EU and UK, using it for tracking or advertising generally needs consent under ePrivacy and GDPR because it stores or accesses information on the user's device equivalent to a cookie.
How do I block canvas fingerprinting?
Tor Browser blocks canvas reads behind a prompt, Brave and Firefox with resistFingerprinting add per-session noise, and extensions can spoof the pixel output. Noise makes the hash unstable, which reduces tracking but can itself be detected as a defence signal.
Does WebGL or audio fingerprinting work the same way?
Yes. WebGL renders a 3D scene and exposes the unmasked GPU vendor and renderer plus dozens of numeric limits, while AudioContext processes an oscillator through a compressor and hashes the float output. Both derive from hardware and driver behaviour, so they correlate strongly with the canvas hash.