What is Canvas Fingerprint?

The script creates a canvas element, usually kept off-screen, draws a line of text in a named font together with an emoji and some overlapping shapes or a gradient, then calls toDataURL or getImageData to pull the pixel data back. Hashing that byte array yields a short value. The whole read takes a few milliseconds, needs no permission prompt and leaves nothing visible on the page. Most collectors run a WebGL variant beside it, rendering a small 3D scene and hashing the result the same way.

Variation comes from the rendering path. Anti-aliasing and sub-pixel positioning depend on the GPU and its driver, glyph shapes depend on the installed font files and the operating system's hinting engine, and the browser's graphics library adds quirks of its own version. Identical hardware running an identical browser build returns an identical hash, which is why canvas entropy is high across desktops and much lower across a fleet of the same iPhone model. On its own it identifies a device class rather than a person.

Countermeasures split into blocking and noise. Firefox's resistFingerprinting mode returns a uniform value shared by everyone who enables it, Tor Browser blocks reads or asks first, Brave adds randomised noise scoped per session and per site, and antidetect browsers inject deterministic per-profile noise so one profile keeps one hash for its lifetime. The naive approach fails: randomise on every read and a site that samples the canvas twice in one page load gets two different hashes, which no real device produces.

Your GPU and browser produce the canvas output, so no proxy or VPN touches it. Two accounts signing in from different countries with the same canvas hash link together, and a hash shared by thousands of unrelated accounts marks a common spoofing tool just as clearly. What you want is a value that holds still inside one profile and looks plausible for the device that profile claims to be. Rarity works against you here, since a hash no other machine on the internet reports is as useful to a detector as a duplicate.