Canvas and WebGL Fingerprinting

A canvas fingerprint is one value in a browser fingerprint: the hash of a test image that a website asks your browser to draw. The technique was first described in 2012 by Keaton Mowery and Hovav Shacham of UC San Diego, who rendered text and WebGL scenes to a <canvas> element and examined the pixels produced. They called the result "consistent, high-entropy, orthogonal to other fingerprints, transparent to the user, and readily obtainable": in 294 tests on Amazon's Mechanical Turk they saw 116 different values (Pixel Perfect: Fingerprinting Canvas in HTML5, W2SP 2012).

Two properties make it useful to trackers and to bot detection:

• It is stable. The same browser on the same machine draws the same pixels every time, so the hash survives cleared cookies and private windows.
• It varies between setups. The operating system's font rendering, the graphics driver, the GPU and the browser version all leave traces in the pixels.

A canvas hash alone rarely identifies one person, because many people share the same laptop model and browser. It narrows the crowd, and combined with the other signals in a fingerprint (screen, fonts, time zone, language, user agent) it can single out a device. The full set of signals is in what is a browser fingerprint.

Why the pixels differ is the interesting part: text anti-aliasing and subpixel rendering differ between Windows, macOS and Linux, emoji come from different font files, and blending semi-transparent colors goes through the graphics stack. A change of browser version or graphics driver can change the hash; a change of IP address cannot.

WebGL fingerprinting uses the browser's 3D graphics API, WebGL, to read details of your graphics hardware. It collects two kinds of data:

MDN describes the debug extension as exposing "two constants with information about the graphics driver for debugging purposes", and notes that depending on the browser's privacy settings it may be unavailable; in Firefox with privacy.resistFingerprinting set to true it is disabled (MDN: WEBGL_debug_renderer_info).

Related techniques work the same way with other APIs. Audio fingerprinting processes a generated sound through the Web Audio API (OfflineAudioContext) and hashes the output; Englehardt and Narayanan's 1-million-site study was the first to measure it at scale, and font fingerprinting uses the canvas to measure which fonts are installed (Online Tracking: A 1-million-site Measurement and Analysis, 2016).

Common enough that you meet it daily, on a minority of sites. A 2014 crawl of the 100,000 most popular sites found that more than 5.5% ran canvas fingerprinting scripts on their home pages, 95% of them from a single provider (Acar et al., The Web Never Forgets, ACM CCS 2014). The 2016 study above found canvas fingerprinting on 14,371 of 1 million sites (1.6%), 98.2% of it from third-party scripts, and more often on popular sites: 5.10% of the top 1,000. Since then, canvas and WebGL values have also become inputs to fraud-prevention and anti-bot scripts, which read them to check that a browser is what it claims to be (see the scraping section below).

You can see your own values in about a minute.

Online tests:

• BrowserLeaks: Canvas shows your canvas signature, how unique it is in the site's own sample, and the image details; it also has a WebGL page.
• EFF: Cover Your Tracks shows how identifiable your whole fingerprint is, canvas and WebGL included.
• CreepJS is an open-source test that also looks for signs that values were faked.
• AmIUnique compares your fingerprint with its collected sample.

Your own check, in the browser console (on any HTTPS page, F12, Console):

async function canvasHash() {
  const c = document.createElement('canvas');
  c.width = 280; c.height = 60;
  const ctx = c.getContext('2d');
  ctx.textBaseline = 'top';
  ctx.font = '16px Arial';
  ctx.fillStyle = '#f60';
  ctx.fillRect(100, 1, 62, 20);
  ctx.fillStyle = '#069';
  ctx.fillText('Cwm fjordbank glyphs vext quiz \u{1F603}', 2, 15);
  ctx.fillStyle = 'rgba(102, 204, 0, 0.7)';
  ctx.fillText('Cwm fjordbank glyphs vext quiz \u{1F603}', 4, 17);
  const bytes = new TextEncoder().encode(c.toDataURL());
  const digest = await crypto.subtle.digest('SHA-256', bytes);
  return [...new Uint8Array(digest)].map(b => b.toString(16).padStart(2, '0')).join('').slice(0, 16);
}

function webglInfo() {
  const gl = document.createElement('canvas').getContext('webgl');
  if (!gl) return 'WebGL unavailable';
  const ext = gl.getExtension('WEBGL_debug_renderer_info');
  return ext
    ? `${gl.getParameter(ext.UNMASKED_VENDOR_WEBGL)} | ${gl.getParameter(ext.UNMASKED_RENDERER_WEBGL)}`
    : `${gl.getParameter(gl.VENDOR)} | ${gl.getParameter(gl.RENDERER)}`;
}

canvasHash().then(h => console.log('canvas:', h, '| webgl:', webglInfo()));

Run it twice, then in a private window, then through a proxy: the canvas hash stays the same each time, because none of those change how your machine draws. Run it in another browser on the same computer and it usually changes. We ran this snippet twice in headless Chromium 156 on a Linux server with no graphics card: both runs gave the same hash, and WebGL reported "ANGLE (Google, Vulkan 1.3.0 (SwiftShader Device (Subzero) ...), SwiftShader driver)", a software renderer that no ordinary home computer reports.

For scrapers, canvas and WebGL are less about tracking and more about consistency. Anti-bot scripts read them to check whether the browser is what it says it is:

• Software renderers. Headless browsers on servers without a GPU report SwiftShader or llvmpipe as the WebGL renderer, as our test shows. A visitor claiming to be Chrome on Windows with a SwiftShader renderer is an easy flag. What else gives automated browsers away: browser fingerprinting and scraping.
• Contradictions. A macOS user agent with a canvas hash that only Linux font rendering produces, or a WebGL renderer that names a GPU the claimed device never shipped with.
• Unstable values. Randomizing tools add noise to the canvas output. If the same scene drawn twice on one page gives two different hashes, the noise itself becomes the signal.
• Too many visitors with one hash. A thousand "different" visitors on a thousand IPs who all share one rare canvas hash look like one machine.

Rotating residential IPs solve a different problem: they spread requests over many addresses so that no single IP crosses a rate limit or carries a datacenter label. Fingerprints and IPs have to agree with each other, so pair the IPs with browser profiles that look like real, common devices; antidetect browsers manage canvas and WebGL values per profile (antidetect browser proxies).

Browsers handle it in three ways, each with trade-offs:

For privacy, randomization defeats tracking across sites. For scraping, it is the wrong goal: a randomized fingerprint is unusual by design, while a scraper wants to look like the most common real device of its claimed type. That means a full browser on real or well-emulated hardware, consistent values across a session, and the same profile on the same sticky IP. How spoofing tools work and how sites catch them: fingerprint spoofing.

So a proxy and a fingerprint do different jobs. ProxyField gives you 412M+ residential IPs in 195+ countries, with targeting by country, region (state) and city, per-request rotation or sticky sessions from 30 seconds to 36 hours, and HTTP, HTTPS and SOCKS5 on one gateway; the browser profile on top of it is yours to keep consistent. More on the split in what proxies can and cannot fix.

Need IPs that match your browser profiles? ProxyField residential proxies cost $2.95/GB for 1 GB down to $1.95/GB from 1,000 GB, with no subscription. Start with the Easy Trial (1 GB); traffic never expires, and all purchases are final.

Checked on October 23, 2026:

• Mowery and Shacham, Pixel Perfect: Fingerprinting Canvas in HTML5, W2SP 2012.
• Acar et al., The Web Never Forgets, ACM CCS 2014.
• Englehardt and Narayanan, Online Tracking: A 1-million-site Measurement and Analysis, ACM CCS 2016.
• MDN: HTMLCanvasElement.toDataURL(), WEBGL_debug_renderer_info, OfflineAudioContext.
• Brave: Fingerprint randomization; WebKit: Safari 17.0 features; WebKit: News from WWDC25, Safari 26.