Canvas fingerprinting is a browser fingerprinting technique that draws text or graphics in an HTML5 canvas element, reads back the resulting pixel data and hashes it into an identifier. The output depends on the browser, operating system and graphics hardware, not on the network connection. Changing to a new proxy IP therefore does not change a canvas fingerprint.

Researchers Keaton Mowery and Hovav Shacham described the technique in 2012 in a paper titled "Pixel Perfect: Fingerprinting Canvas in HTML5." A W3C guidance note points out that a browser fingerprint typically cannot be cleared or reset the way cookies can.

How Canvas Fingerprinting Works

  • Draw: A script renders text in a chosen font and size, with background colors.
  • Read back: It exports the canvas pixels, for example with toDataURL(), which returns the image as a data URL.
  • Hash: It hashes the encoded pixel data. Differences in graphics hardware and drivers produce different hashes on different devices.
  • Detectable: The W3C classes this as active fingerprinting because it runs code on the client, which makes it potentially detectable there.

How Browsers Limit It

  • Firefox: Adds random data to canvas images when a site reads them back. This protection is on by default in Private Browsing and in Strict Enhanced Tracking Protection.
  • Tor Browser: Notifies users when a site tries to read canvas data and can return blank image data.
  • Blocking extensions: Tools such as Privacy Badger can block canvas fingerprinting scripts from third-party servers, but not scripts served by the site itself.

How Canvas Fingerprints Are Used

  • Tracking: The W3C says browser fingerprinting can correlate a user's browsing activity within and across sessions, and can track users without transparency or control.
  • Adoption: A 2014 Princeton and KU Leuven measurement found canvas fingerprinting on 5% of the top 100,000 sites. The top two providers caused 97% of it. A 2016 re-run found that the number of distinct trackers using it had more than doubled.
  • Security: The W3C also notes that browser fingerprinting can be used as a security measure, such as a way to authenticate the user.