Skip to content
All fingerprint checksRender & GPU

a WebGL framebuffer reads back the same through readPixels and toDataURL

Check id webgl-readpixels-vs-todataurl

What an ordinary browser yields

Every channel identical between readPixels and the decoded PNG (severity: warn).

What a detector infers

readPixels and toDataURL both read the drawing buffer of one WebGL canvas, and PNG is lossless, so decoding the data URL has to reproduce the bytes readPixels already returned. The only adjustment is orientation -- readPixels is bottom-up while the canvas is top-down, so rows are flipped before comparing -- and no reference image exists anywhere in the comparison. It earns a place beside webgl-readback-flat-uniform because that row reads readPixels only, and WebGL fingerprinting scripts overwhelmingly hash canvas.toDataURL() after rendering rather than calling readPixels. A build that perturbs the export path while leaving readPixels honest therefore satisfies every existing WebGL pixel check, which is exactly the gap 2D canvas had until its dual-exit row. Measured on a clean browser across all three alpha configurations -- alpha off, alpha with premultiplication, and alpha without -- zero differing channels of 4096 in every one. Premultiplication was the confound worth checking and it does not bite, because the browser applies the same conversion to both exits.

How to resolve it

readPixels and toDataURL read the same drawing buffer, so a lossless encode has to reproduce what readPixels returned. Perturbing only the export path leaves readPixels-based checks satisfied while the two exits disagree with each other. Perturb both identically, or neither.

What is canvas fingerprinting?

Nearby checks in Render & GPU

See all 32 checks in Render & GPU
Who builds this test

Clearcote is a browser built for fingerprint coherence

It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.

This audit takes no position on how Clearcote scores on Render & GPU checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.

See the other checks in Render & GPU — the family webgl-readpixels-vs-todataurl belongs to.