Canvas Fingerprinting

The technique leverages the HTML5 Canvas API to draw a hidden scene—typically text with a fallback font and an emoji—and then extracts the raw pixel data using toDataURL(). Because the final rasterized image depends on the precise font rasterization algorithm, GPU driver version, operating system sub-pixel hinting, and even installed font sets, the resulting hash is highly unique. The same JavaScript code will produce a different checksum on a Windows machine with an NVIDIA GPU than on a macOS device with Apple Silicon, even if both use the same browser version.

The uniqueness of a canvas fingerprint derives from multiple stacked entropy sources:

• Font Rendering: Anti-aliasing, hinting, and fallback substitution differ by OS.
• GPU & Driver: Subtle differences in WebGL or 2D context rendering paths.
• Sub-pixel Geometry: Display DPI and pixel layout affect anti-aliasing.
• Emoji Rendering: Operating systems use entirely different glyph libraries (e.g., Segoe UI Emoji vs. Apple Color Emoji), creating massive divergence in the rendered bitmap.

Canvas fingerprinting is an active technique, meaning the script must explicitly instruct the browser to render content and read back the pixels. This contrasts with passive fingerprinting (e.g., HTTP headers). While active execution makes it detectable by anti-tracking browser extensions, it also provides far higher entropy. Modern privacy browsers like Brave and Tor Browser specifically block or randomize canvas readout to prevent this vector, often returning a blank or subtly perturbed image data array.

The raw pixel data is not used directly. Instead, a lossy hashing function (often a perceptual hash or a simple CRC checksum) is applied to the base64-encoded PNG output. This ensures that minor, imperceptible rendering variations do not cause the fingerprint to change between page loads. A stable canvas fingerprint can persist across private browsing sessions and even after standard cookie deletion, making it a powerful mechanism for browser fingerprinting scripts to reconstruct user identity without any client-side storage.

Canvas fingerprinting is often combined with WebGL fingerprinting to dramatically increase identifier entropy. While the 2D canvas exposes the font and 2D rendering stack, the WebGL renderer exposes the precise GPU model, driver version, and vendor-specific shader precision. A script that hashes both the 2D canvas output and the WebGL RENDERER string can achieve near-unique identification of a device across the entire web, a technique used by commercial fraud detection services but heavily scrutinized under GDPR and ePrivacy regulations.

Defenses against canvas fingerprinting operate on multiple layers:

• Randomization: Tor Browser adds a small, deterministic noise to the canvas readout per domain.
• Blocking: Extensions like CanvasBlocker prevent the toDataURL() call entirely.
• Permission Prompts: Safari and Firefox have explored requiring user permission before a site can extract canvas data.
• Virtualization: Running the browser inside a VM with a generic GPU driver profile normalizes the fingerprint across instances.

The broader category of techniques that collect device and browser configuration attributes to generate a unique identifier. Canvas fingerprinting is a subset of this approach.

• Attributes collected: User agent, screen resolution, installed fonts, WebGL renderer, timezone, language
• Entropy source: Aggregation of dozens of signals, each contributing small bits of identifying information
• Persistence: Survives cookie clearing and private browsing modes
• Defense: Browser vendors increasingly homogenize outputs to reduce fingerprint surface

A closely related technique that exploits the WebGL API to probe the GPU and graphics driver stack. Like canvas fingerprinting, it leverages rendering differences to generate a stable identifier.

• Mechanism: Renders a 3D scene and hashes the output, capturing GPU model and driver version
• Synergy: Often combined with canvas fingerprinting to increase entropy
• Variations: WebGL vendor string, renderer string, supported extensions, and shader precision
• Hardware exposure: Reveals exact GPU model, which is highly identifying when combined with other signals

Exploits subtle differences in how a device's audio stack processes sound signals. An inaudible oscillator signal is processed and the resulting waveform is hashed.

• Target: Differences in sample rate conversion, clock drift, and DSP implementation
• Entropy source: Variations across sound cards, drivers, and OS audio pipelines
• Stability: Highly stable across sessions because hardware rarely changes
• Combined use: Often deployed alongside canvas and WebGL fingerprinting for multi-modal identification

Enumerates the set of installed fonts on a system by measuring rendered text dimensions. The specific combination of fonts is highly unique across users.

• Method: Iterates through a font list, rendering fallback text and measuring width/height differences
• Entropy: Systems with creative software suites have hundreds of unique fonts
• Flash legacy: Historically performed via Flash; now uses JavaScript and CSS font detection
• Countermeasure: Browsers increasingly restrict font enumeration APIs

Generates a compact fingerprint of multimedia content based on perceptual features rather than raw bytes. Enables identification even after transformations like compression or resizing.

• Image hashing: pHash, dHash, and aHash algorithms extract frequency-domain or gradient features
• Robustness: Survives common transformations that break cryptographic hashes
• Use case: Detecting near-duplicate images, copyright enforcement, CSAM detection
• Contrast with canvas fingerprinting: Identifies content, not the device rendering it

Computes a similarity digest that allows comparison of two files to determine their degree of commonality, even when they are not bit-for-bit identical.

• Algorithm examples: ssdeep (context-triggered piecewise hashing), sdhash, TLSH
• Mechanism: Splits input into chunks based on content boundaries, hashes each chunk, and concatenates
• Application: Malware variant detection, forensic file similarity analysis
• Key property: Similar inputs produce similar hashes with measurable Hamming distance