Canvas fingerprinting
A fingerprinting technique that has your browser draw an image and reads back the tiny hardware-specific differences in how it rendered.
Canvas fingerprinting is the single most cited example of how hardware leaks identity, and the mechanism is elegantly simple. A script asks your browser to draw text and shapes onto an off-screen canvas element, then reads the resulting pixels back as data. The instruction is identical for everyone; the output is not, because the exact rendering depends on your GPU, your graphics drivers and your font rasterisation, and those combinations are diverse and stable enough that the pixel data is a strong identifier.
What makes it powerful is that nothing about it was designed to identify anyone, and there is no obvious thing to disable. The canvas API exists for legitimate graphics; the fingerprint is a side effect of hardware variation that the API faithfully exposes. So unlike a cookie there is nothing to clear, and unlike an address there is nothing to change: the same machine produces the same canvas result across sessions, across cleared cookies, and across a thousand rotated IP addresses.
That last point is why it belongs in a proxy glossary rather than only a privacy one. Canvas fingerprinting sits entirely above the network, so rotating addresses does nothing to it, and a site correlating the canvas result across your requests sees one machine wearing many IPs, which is a stronger signal than staying on one would have been. It is a specific, concrete instance of the general fingerprinting trap that catches proxy users who fixed the address and nothing else.
Defending against it is harder than it looks and is the reason antidetect browsers exist. Blocking the canvas API outright is itself rare and therefore identifying; the better approaches add controlled noise so the result is consistent within a session but differs from the real hardware, or present a genuinely different but plausible profile. Randomising it per request, the naive instinct, backfires, because a canvas result that changes between page loads describes something no real device does.
Frequently asked questions
Can I stop canvas fingerprinting by changing my IP?
No. Canvas fingerprinting reads how your hardware renders an image, which is entirely above the network layer, so the address is irrelevant to it. Rotating through many IPs while producing the same canvas result actually makes things worse: a site correlating the two sees one machine wearing many addresses, a stronger signal than never rotating.
How does canvas fingerprinting work?
A script has your browser draw text and shapes to an off-screen canvas, then reads the pixels back. The drawing instructions are the same for everyone, but the exact output varies with your GPU, drivers and font rendering, and those differences are stable enough to identify you. It exploits hardware variation that the graphics API exposes as an unintended side effect.
How do I defend against canvas fingerprinting?
Not by blocking the canvas API, which is itself rare and identifying, or by randomising it per request, which describes a device that cannot exist. The workable approaches, which antidetect browsers implement, add controlled noise that stays consistent within a session or present a plausible alternative profile, so the result is stable and ordinary rather than either absent or impossibly variable.
Back to the full glossary.