Canvas Fingerprinting Explained: How Sites Track You Without Cookies
Canvas fingerprinting turns an invisible browser drawing into an almost-unique ID for your device.
Canvas fingerprinting is a device ID derived from the exact way your browser renders a hidden HTML5 Canvas image — sites hash that result to recognize you, no cookies needed.
Canvas fingerprinting is a tracking technique that identifies your device by the exact way your browser renders a hidden piece of text or graphics using the HTML5 Canvas. Because every machine paints those pixels slightly differently — thanks to its GPU, drivers, fonts and operating system — a website can hash the result into a stable ID that follows you around, even after you clear cookies or switch to incognito. This guide starts from scratch; no technical background needed.
TL;DR • Canvas fingerprinting derives a device ID from how your browser renders HTML5 Canvas graphics. • It works silently, without cookies, and is nearly invisible to users. • The differences come from your GPU, driver, fonts, OS and browser engine. • Clearing cookies or going incognito does not remove your canvas fingerprint. • To manage many accounts safely, use an antidetect browser that changes the fingerprint per profile — like GPM Login. |
Table of contents
● What is canvas fingerprinting?
● How does canvas fingerprinting work?
● Why is each device's canvas fingerprint different?
● What do websites use canvas fingerprinting for?
● Canvas fingerprint vs cookies: what's the difference?
● How do you test and block canvas fingerprinting?
● Frequently asked questions
What is canvas fingerprinting?
Canvas fingerprinting is a method of generating a device ID from how your browser draws a hidden image using the HTML5 <canvas> element. A website asks the browser to render some text and shapes off-screen, then reads back the individual pixels and hashes them into a short string. Because everyone's hardware and software differ, that string is nearly unique — and stays consistent across visits.
The technique was first described in “Pixel Perfect: Fingerprinting Canvas in HTML5” (Mowery & Shacham, UC San Diego, 2012), and confirmed as widespread by “The Web Never Forgets” (Acar et al., ACM CCS 2014). In other words, this isn't theory — it has run quietly on the web for over a decade, and it's a key ingredient of your overall browser fingerprint.
How does canvas fingerprinting work?
Canvas fingerprinting works in four steps that happen in a few milliseconds, with nothing shown on screen:
The four steps of canvas fingerprinting — the same code, but every device produces a different hash.
● Issue draw commands: the site's JavaScript asks the browser to draw a line of text (often with a special font, accents or an emoji) plus shapes onto a hidden canvas.
● The device renders: the browser hands the work to the GPU and OS — identical commands, but each stack fills the pixels slightly differently.
● Read the pixels back: the site calls toDataURL() or getImageData() to pull the raw pixel data of the drawing.
● Hash it into an ID: that data is run through a hash function (e.g. a3f9c1b8…). This string is the canvas fingerprint, usually the same every visit.
Why is each device's canvas fingerprint different?
Because rendering graphics depends on the specific combination of hardware and software on each machine. Given the same “Cwm fjord” drawing command, your laptop and someone else's won't produce identical pixels at letter edges, in anti-aliasing, or in blended colors. The main contributing factors are:
Six main factors that make it rare for two devices to share the same canvas fingerprint.
● GPU model (graphics chip) and graphics driver version.
● Operating system and its version.
● Installed fonts and how they're rendered.
● The anti-aliasing algorithm.
● The browser and its engine (Chromium or Firefox).
The more of these differ, the lower the chance two people collide — which is exactly why canvas fingerprinting is so good at telling devices apart.
What do websites use canvas fingerprinting for?
Websites mostly use canvas fingerprinting to re-identify users and detect fraud, even when the user isn't logged in or has cleared cookies. Common uses include:
● Fighting fraud and bots in payments and advertising.
● Tracking users for behavioral ads without cookies.
● Limiting abuse of free trials.
● Detecting several accounts from the same device to flag or ban them together — crucial for multi-account operators.
If you run multiple stores, ad accounts or airdrop wallets from one machine, a shared canvas fingerprint is one of the signals that makes a platform suspicious.
Canvas fingerprint vs cookies: what's the difference?
The core difference: a cookie is data a website stores on your machine, while a canvas fingerprint is inferred from your machine's own characteristics — so you can't simply “delete” it the way you clear a cookie.
Aspect | Cookie | Canvas fingerprint |
Nature | A data file on your device | An ID derived from how you render |
Visible to users? | Yes (in settings) | Almost never |
Can you delete it? | Yes — clearing removes it | No — you must change/mask it |
Does incognito help? | Usually yes | No — still identifiable |
Requires consent? | Usually yes (banners) | Often silent |
This is why so many people are surprised to still be recognized after wiping cookies and opening a private window: the cookies are gone, but the canvas fingerprint remains.
How do you test and block canvas fingerprinting?
You can test your own canvas fingerprint with free tools (the EFF's Cover Your Tracks or AmIUnique.org), and defend against it in a few ways:
● Use a privacy-focused browser: Tor blocks or prompts before canvas reads; Firefox offers resistFingerprinting; Brave applies light randomization.
● Use an extension that blocks fingerprinting scripts.
● Use an antidetect browser so each profile carries its own consistent fingerprint — ideal when you run many accounts.
That's exactly the problem GPM Login is built to solve: every profile gets an independent fingerprint set in which the canvas value is changed in a controlled way, so multiple accounts on one machine don't share a single tell-tale reading. In practice, across hundreds of profiles, this is the difference between accounts that last and accounts banned in waves.
If you're new to this, the foundational guide on what browser fingerprinting is is a good place to get the full picture first.
Frequently asked questions
Is canvas fingerprinting legal?
The technique itself isn't banned in most places, but using it to track users can fall under data-protection laws such as the GDPR. Legality depends on purpose and jurisdiction.
Does clearing cookies or using incognito remove a canvas fingerprint?
No. Cookies get deleted, but the canvas fingerprint is inferred from how your machine renders graphics, so it survives incognito mode and cookie clearing.
Does a VPN hide my canvas fingerprint?
Not directly. A VPN only changes your IP address, while a canvas fingerprint is based on your browser and hardware and has nothing to do with your IP.
How does an antidetect browser stop canvas fingerprinting?
It gives each profile its own consistent canvas value — usually by adding controlled noise to the pixel data — so different accounts on the same machine look like different devices.
Conclusion
Canvas fingerprinting is one of the most silent and persistent identification techniques on the web: it fingerprints the very way your machine draws graphics, needs no cookies, and isn't erased by incognito. For multi-account operators, controlling your canvas fingerprint is essential to keeping accounts from being linked and banned.
Want each account to have its own browser identity? See how GPM Login manages fingerprints per profile. Try GPM Login free →
