Fingerprinting

What is WebGL Fingerprint?

A WebGL fingerprint is an identifier derived from how a browser's GPU and graphics driver render 3D content. Sites read the renderer and vendor strings the driver reports, then hash the pixels of a small scene drawn off-screen. Capability limits from the context add more. The result stays stable across sessions and changes only when the hardware or driver does.

The data comes from two places. A page creates a WebGL context on a canvas and calls getParameter for values such as the maximum texture size, the aliased line width range and shader precision, then reads the WEBGL_debug_renderer_info extension for UNMASKED_VENDOR_WEBGL and UNMASKED_RENDERER_WEBGL - strings along the lines of ANGLE (NVIDIA, NVIDIA GeForce RTX 3060 Direct3D11 vs_5_0 ps_5_0). The list returned by getSupportedExtensions() adds more entropy, since driver and browser versions support slightly different sets. That is the declarative half.

The second half is an actual render. The script draws a gradient, a texture or a shaded model off-screen, pulls the framebuffer back with readPixels or toDataURL, and hashes the bytes. Anti-aliasing, floating-point rounding inside the driver and the GPU's own texture filtering differ enough between hardware and driver versions that the hash separates machines reporting identical strings. It is the same idea as a canvas fingerprint, run through a longer pipeline with more places for hardware differences to show up.

Browsers have narrowed the exposure unevenly. Firefox hides the debug renderer extension when resist-fingerprinting is enabled and Safari reports far less detail, while Chromium still hands full renderer strings to ordinary pages. Spoofing is where automation usually fails. Overriding getParameter in JavaScript takes a few lines, but the render hash keeps coming from the real GPU, so the strings and the pixels disagree with each other. Antidetect browsers patch both paths inside the engine for exactly that reason.

Two mismatches get flagged fast. A headless Chrome started with --disable-gpu falls back to software rendering and reports SwiftShader, or llvmpipe under Mesa on Linux, values that almost no consumer machine produces. The other is a profile claiming an iPhone user agent while the renderer string names Direct3D11 on a Windows box. Catching either takes no machine learning. Detection vendors keep short lists of impossible pairings and check them on the first page view, before any behavioural scoring starts.

Where you meet it

You meet this when a profile that passed every cookie and header check still gets challenged. Open a fingerprint test page inside the profile and read the WebGL block. If the renderer says SwiftShader, your automation is running without GPU access and every visit from that profile carries the same rare value. Antidetect browsers let you pass the real value, add noise, or block WebGL entirely, and blocking is the most conspicuous of the three.

Common questions

Can I disable WebGL to avoid fingerprinting?

You can, and detection systems will notice. A browser with no WebGL context available is rarer than one with a common GPU, so the absence becomes its own signal. Sites that use WebGL for maps, charts or product viewers also break. Reporting a plausible, consistent GPU is normally the safer choice.

Is a WebGL fingerprint unique to my computer?

On its own, rarely. Any two machines with the same GPU model, driver version, operating system and browser build tend to produce the same renderer string and a very similar render hash. It becomes identifying when combined with fonts, screen metrics, timezone and the other values a fingerprinting script collects.

Does using a proxy change my WebGL fingerprint?

No. A proxy changes the network path and the IP address a site sees; the WebGL values are generated locally by your GPU and driver and travel inside the page's JavaScript results. Changing them requires a different machine, a virtual machine, or a browser that patches the WebGL layer.

Related terms

Canvas Fingerprint
Canvas fingerprinting draws hidden text and shapes into an HTML5 canvas, reads the pixels back with toDataURL or getImageData, and hashes them. The exact output varies with GPU, graphics driver, font rendering and anti-aliasing, so the hash stays stable for one device and browser build while differing between machines.
Browser Fingerprint
A browser fingerprint is an identifier derived from the properties your browser exposes - user agent, screen and window dimensions, timezone, language, installed fonts, canvas and WebGL rendering output, audio stack behaviour, hardware concurrency. Combined, these values are often unique enough to recognise the same browser across sessions and sites without any cookie.
TLS Fingerprint
A TLS fingerprint is an identifier derived from the ClientHello a client sends when it opens an HTTPS connection: the TLS version offered, the ordered cipher suite list, the extension list, supported elliptic curves and signature algorithms. JA3 and JA4 are the common encodings of it. Different HTTP clients and browsers produce visibly different values.
JA3
JA3 is a TLS client fingerprinting method that reads five fields from the ClientHello, joins their decimal values into a single string and hashes it with MD5. The fields are TLS version, cipher suites, extensions, supported elliptic curves and EC point formats. The 32-character result groups clients by TLS library and configuration.
JA4
JA4 is the TLS client fingerprint in the JA4+ family published by FoxIO, designed to replace JA3. Rather than one opaque MD5, it produces a partly readable string: a ten-character prefix describing transport, TLS version, SNI, cipher and extension counts and ALPN, followed by two truncated SHA-256 digests of the sorted cipher and extension lists.
Device Fingerprint
A device fingerprint is an identifier built from the hardware and software traits a device exposes: screen geometry, GPU and driver strings, CPU core count, memory, timezone, languages, installed fonts, audio and canvas rendering, and touch support. Hashed together, those values are stable enough to recognise a returning device across sessions without any cookie.
P0F
p0f is a passive OS fingerprinting tool that identifies the system behind a connection by watching traffic rather than probing it. It reads TCP SYN packets for initial TTL, window size, MSS, the order of TCP options and a set of quirk flags, then matches them against a signature database. It sends nothing to the host it identifies.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.

View pricing Browse the glossary