Canvas Fingerprinting Explained: How Websites Track You Without Cookies

Canvas fingerprinting identifies your browser by asking it to draw a hidden image and reading back the result. Tiny differences in how each computer draws make the image a useful identifier, and it works without cookies.

How it works

1. A script on the page draws text, shapes and colors on an invisible HTML canvas.
2. It reads the pixels back and turns them into a short code, called a hash.
3. Your graphics card, drivers, operating system, installed fonts and text smoothing all slightly change the pixels, so different setups produce different codes.
4. The code is combined with other details, such as screen size, time zone and language, into a browser fingerprint.

How widely it's used

Researchers first measured it in 2014, in a study called "The Web Never Forgets", which found canvas fingerprinting on about 5% of the 100,000 most popular sites. It's used for ad tracking, and also for fraud prevention and bot detection by banks and login pages.

Why it's hard to stop

• Nothing is stored on your device, so clearing cookies or using Incognito doesn't change it.
• It's not unique on its own. Many identical devices give the same result, so it's combined with other signals.
• Blocking it can make you stand out. A browser that refuses canvas reads, or adds unusual noise, can be rarer than one that doesn't.

Which browsers resist it

• Brave adds small random changes to canvas results for each site, so the code doesn't follow you.
• Firefox has fingerprinting protection, stronger in its Strict tracking protection mode.
• Tor Browser asks before letting a site read canvas data, and makes users look alike.
• Safari reduces the details sites can use to fingerprint you.
• Chrome has no built-in canvas protection.

Test your browser

The EFF's Cover Your Tracks site shows how unique your fingerprint looks and whether your browser resists it. See checking fingerprint tracking.

What you can do in Chrome

• Block third-party trackers, since most fingerprinting scripts come from ad and analytics companies.
• Be careful with extensions that randomize fingerprints; badly made ones can make you easier to spot. See preventing fingerprinting in Chrome.
• Use a fingerprinting-resistant browser for sensitive browsing.

Ghost Browser doesn't block fingerprinting. It visits random sites in the background, so the interest profile linked to your fingerprint is less accurate. For the bigger picture, see browser fingerprinting explained.