Canvas Fingerprinting.

A browser-fingerprinting technique that exploits subtle GPU and font rendering differences when drawing on an HTML canvas to identify a device. It belongs to the Privacy & Data Protection category of cybersecurity.

A browser-fingerprinting technique that exploits subtle GPU and font rendering differences when drawing on an HTML canvas to identify a device.

Canvas fingerprinting asks the browser to render a hidden HTML5 canvas containing text, shapes, or emojis and then hashes the resulting pixel buffer. Because GPU, driver, OS font rasterizer, and anti-aliasing settings produce slightly different output on each device, the hash acts as a stable identifier without storing any cookie. The technique was popularized in 2014 by Princeton's research on tracking scripts and quickly became standard in commercial tracker stacks. Defences include disabling canvas readback for third-party origins, returning randomized pixel noise (Brave, Firefox), warning prompts before canvas.toDataURL access, and the uniform rendering pipeline of the Tor Browser.

Defences for Canvas Fingerprinting typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: HTML5 canvas tracking, Canvas hash fingerprinting.