Canvas fingerprinting explained: the invisible tracker with no cookies
Websites can identify you without cookies by asking your browser to draw a hidden image. Tiny hardware differences make your drawing unique — here is how it works and what helps.
How a hidden drawing becomes an ID
The canvas API lets sites draw graphics in your browser. A fingerprinting script draws hidden text and shapes, then reads back the exact pixels. Your GPU, drivers, fonts, and operating system each nudge the rendering by sub-pixel amounts — and the combination is often unique to your device.
Unlike cookies, there is nothing stored to delete and no prompt to decline. The identifier is recomputed on every visit, silently, in milliseconds.
Why blocking it outright breaks the web
Canvas is a legitimate graphics API used by games, charts, and design tools, so browsers cannot simply remove it. Instead, privacy-focused browsers add noise: they subtly randomize the pixels a page can read back, so the fingerprint changes between visits while the visible image looks the same.
That is why the same fingerprint test can show different results in different browsers. The difference is the protection working, not a measurement error.
What actually reduces your uniqueness
The strongest lever is blending in: a widely used browser configuration produces a common fingerprint shared with many users. Hardened Firefox and Tor Browser both normalize or randomize canvas output for exactly this reason.
Test your own setup with the fingerprint analysis on this site, note the uniqueness signals, then apply one hardening step at a time and re-run. The privacy score snapshots let you compare before and after so you can see which change actually moved the needle.
- Prefer browsers that randomize or normalize canvas readout.
- Avoid rare combinations of fonts, screen size, and extensions.
- Re-test after each change instead of applying ten at once.