Canvas fingerprinting uses the HTML5 canvas element to render text or graphics and reads back the resulting pixel data. Different combinations of GPU, GPU driver, OS, anti-aliasing settings, font-rendering libraries, and browser version produce subtly different output for identical input. The hash of the rendered output becomes a near-unique identifier of the device-browser combination, persistent across cookie clears and across sites that use the same fingerprinting library.
What it means in practice
Canvas fingerprinting is one of the highest-entropy contributors to browser fingerprints because the variation across devices is large. A single canvas test can distinguish among millions of user-agent-similar browsers. Combined with audio fingerprinting (similar technique using the Web Audio API), WebGL fingerprinting, and the dozens of other signals, the resulting identifier is stable and unique. The defenses: Tor Browser and Mullvad Browser explicitly normalize canvas output (the rendered result is identical across users, defeating the fingerprint at the cost of some site features that depend on canvas accuracy). Firefox with Resist Fingerprinting enabled does similar normalization. Brave applies “farbling” that adds small random noise per session, making the fingerprint different each time.
Where it shows up
Deployed by: every major commercial fingerprinting library (FingerprintJS, Iovation, ThreatMetrix, Sift), every advertising network using fingerprint-augmented identity graphs, fraud-detection services where the canvas test is a stable cross-device check, and the long tail of trackers embedded in CDN and analytics SDKs. The detection is opaque: the canvas operations happen on a hidden element, the user sees nothing, the network request that exfiltrates the hash is one of dozens running in parallel. The user’s only visibility into the leak is to inspect the fingerprint via tooling like coveryourtracks.eff.org or amiunique.org.
What you can change today
Switch to a browser that handles canvas fingerprinting structurally. Mullvad Browser: ships with Tor-Browser-grade anti-fingerprinting on canvas, audio, WebGL, and font enumeration, no Tor network. Tor Browser: same defenses plus Tor routing. Firefox with Resist Fingerprinting (about:config, privacy.resistFingerprinting=true) provides intermediate normalization. uBlock Origin with the EasyPrivacy filter list blocks many of the upstream fingerprinting scripts before they execute. The defenses break a small number of sites that legitimately depend on canvas (some image-rendering tools, some games); the trade-off is acceptable for daily browsing and reversible per-tab when needed.