Canvas fingerprint test
The image your browser draws for a canvas fingerprinting script, its hash, and whether that hash stays the same between reads, in a worker and through a PNG export.
Draws the image below 3 times on fresh canvases, once more in a worker, and compares them. Everything runs in this tab; nothing is sent to a server.
Drawing…
How canvas fingerprinting works
A script creates a canvas the visitor never sees, draws on it, and reads the result back. The drawing here is the classic kind: a pangram in Arial and in Times New Roman with an emoji, overlapping circles blended with multiply, and a gradient. Each of those passes through a part of the system that differs between machines: which font file answers to "Arial", how the operating system rasterizes and anti-aliases text, which emoji font is installed, and how blending is rounded.
The pixels are then hashed. Most scripts hash the PNG from toDataURL(); some hash the raw pixels from getImageData(). This page shows both. Two browsers with the same hash drew identical images; that usually means the same operating system, fonts and browser engine, not the same person.
Stable or randomized
Drawing the same commands twice gives the same pixels. That is why the test above reads the canvas several times: an unprotected browser returns one hash, and a browser that adds noise returns a new one each time. Both are informative. A stable hash can be tracked; a hash that changes says that something is altering the canvas, and on a browser that otherwise looks like stock Chrome, that is a contradiction a detection script can see.
The other rows look for the marks noise leaves. Pixels that were drawn fully transparent must read back as (0, 0, 0, 0), because the canvas stores premultiplied colour. A drawing made only in shades of grey must read back with equal red, green and blue. A worker's OffscreenCanvas drawing the same commands must produce the same pixels as the page, which catches protections that only patch the page. These checks come from the browser fingerprint test, which runs them alongside a few hundred others.
The other rendering surfaces
Canvas is one of several surfaces that describe the machine rather than the browser's settings. WebGL names the GPU outright, WebGPU describes the adapter, the audio fingerprint measures the audio stack, and the font test lists the fonts that the canvas text above was drawn with. For background, see what canvas fingerprinting is.
FAQ
What is a canvas fingerprint?
A hash of an image the browser draws off-screen. A script draws text and shapes on a <canvas>, reads the pixels back with toDataURL() or getImageData(), and hashes them. The drawing commands are the same everywhere, but the pixels are not: fonts, font rendering, anti-aliasing and the graphics stack differ between machines, so the hash differs too.
Is my canvas fingerprint unique?
Usually not on its own. Machines with the same operating system, fonts and browser version tend to draw the same image, so a canvas hash sorts browsers into groups rather than naming one. It becomes identifying in combination with the other surfaces a script reads, such as the GPU, the fonts and the screen.
Why does my canvas hash change every time?
Because something alters the pixels when they are read back. Brave, Firefox with its fingerprinting protection on, and Safari with Advanced Fingerprinting Protection all change canvas readback, and so do some extensions; depending on the browser and setting the change is fixed per site or new on every read. A real canvas does not change between two identical drawings, so a hash that changes on every read tells a site that protection is active.
Does the canvas fingerprint depend on the GPU?
Less than people expect for 2D canvas. A canvas created for frequent reading (willReadFrequently) is drawn on the CPU in Chrome, and on our Chrome 155 Windows 11 test machine this page's image hashed the same with GPU acceleration on and off. Fonts and the operating system's text rendering matter more. WebGL, which does run on the GPU, is the surface that names it: see the WebGL test.
Can a website see this image?
A website can draw and read a canvas exactly as this page does, without asking. This page does not send anything anywhere: the image, the hashes and the comparisons stay in your tab.
How do I block canvas fingerprinting?
Blocking readback entirely breaks sites that use canvas legitimately, and random noise on every read is itself detectable. Browsers that take it seriously either add noise that stays the same per site (Brave) or reduce what a page can learn. For automation, the question is not hiding the canvas but making it agree with the rest of the browser, which is what Clearcote's fingerprint control is built around.
Related free tools
WebGL test and fingerprint
Whether WebGL works, the GPU it reports, its extensions and limits, and their hash.
Font fingerprint test
Which fonts a page can detect, and which operating system they point to.
Audio fingerprint test
The AudioContext value scripts compute, and whether it changes between renders.
Browser fingerprint test
A few hundred coherence checks on the browser you open it in.
Clearcote puts this into practice
An open-source Chromium with fingerprint control compiled into the engine. A drop-in for Playwright & Puppeteer.
Free for one browser with GitHub. No card.