What is canvas fingerprinting? How it works and why it is so stable

Canvas fingerprinting is used to identify website users and is part of a broader set of browser fingerprinting techniques. A script asks the browser to render text and graphics to an off-screen HTML canvas, then reads the pixels back and hashes them. Because the result depends on the browser along with the GPU, graphics driver, operating system, and installed fonts, two browsers rarely produce the same hash, which makes it a stable way to recognize the same browser again.

Canvas is one of the most asked-about browser fingerprinting techniques, partly because it is easy to demonstrate and partly because it keeps working after cookies are cleared. This guide explains what canvas fingerprinting is, how it works step by step, what it reveals, how unique and stable it is, and where it fits in fraud detection.

Key takeaways

• Canvas fingerprinting reads how a browser renders a hidden image and turns the result into a hash. The same browser produces the same hash, a different browser usually does not.
• It is stable because it reflects the real browser, graphics hardware, and software underneath, which a user cannot easily change, and it survives cleared cookies and incognito mode.
• No single canvas hash is unique on its own. Its value comes from combining it with other browser fingerprinting techniques into one identifier.
• For fraud detection, canvas is one signal among many. It helps recognize a returning visitor, and randomized or noise-injected canvas readings are themselves a sign that something is hiding.

How canvas fingerprinting works

Canvas fingerprinting works in three steps, and the whole process runs in the background in milliseconds without any permission prompt. The user never sees the image, because it is drawn off-screen and never displayed.

1. Draw. A script uses the HTML canvas API to draw text and shapes to a hidden canvas, often a line of text in a specific font over a colored or gradient background.
2. Render. The browser renders that drawing. The GPU, the graphics driver, the operating system, and the font rasterizer all influence the exact pixels produced, down to the anti-aliasing at the edges of each letter.
3. Hash. The script reads the pixel data back and runs it through a hash function. The output is a compact value, the canvas fingerprint, that stays the same in that browser and differs in browsers with a different rendering stack.

The detail that makes this work is that the drawing instructions are identical for everyone, so any difference in the output comes from the browser and the device it runs on, not the request. The same instructions sent to a thousand browsers return many different hashes.

What a canvas fingerprint reveals

A canvas fingerprint does not reveal personal information like a name or location. What it reflects is the combination of browser, hardware, and software that renders graphics:

• The GPU and graphics driver, which decide how shapes, gradients, and curves are turned into pixels.
• The operating system and its version, which affect font rendering and anti-aliasing.
• The installed fonts, since the chosen font, or its fallback when missing, changes the shape of the rendered text.
• The browser and its rendering settings, which influence how the canvas instructions are carried out.

None of these is identifying on its own. Many people run the same phone model with the same browser, so they share a similar canvas hash. The point is not that the hash names a person, but that it is consistent for one browser over time and different enough from most others to help tell browsers apart.

Property	Canvas fingerprinting
What it reads	How a browser renders a hidden off-screen image, hashed into a value
Why it differs between browsers	The browser, GPU, graphics driver, operating system, and installed fonts shape the exact pixels
Does it survive clearing cookies?	Yes, it reflects the browser, hardware, and software underneath and survives cleared cookies and incognito mode
Main limitation	Not unique on its own, since browsers of the same model and version render alike, so it works only combined with other browser fingerprinting techniques

How unique and stable is a canvas fingerprint?

A canvas fingerprint is moderately unique and quite stable, which is exactly the combination that makes it useful. On its own it does not single out one browser in a million, but it carries enough distinguishing detail to narrow the field of possible browsers, and it stays the same across sessions because the underlying browser and hardware do not change between visits.

Canvas fingerprinting is also widespread enough to be well studied. It was first documented at scale in 2014, when researchers found it running on thousands of popular websites, and a 2025 measurement found that around 12.7% of the top 20,000 websites used it, with a slightly lower share on less popular sites. It is not a fringe technique; it is a common part of how the modern web recognizes returning browsers.

Stability has limits. A driver update, an operating system upgrade, or a new browser version can shift the hash, so a system that relies on canvas does not expect a permanent exact match. It treats the canvas value as one of several signals and tolerates small changes, which is also why canvas is rarely used alone.

Canvas fingerprinting in fraud detection

Canvas fingerprinting has two very different uses, and they are worth keeping separate. Advertisers and analytics networks use it to track people across sites for profiling, which is the privacy concern attached to the technique. Security and fraud detection use it for the opposite reason: to recognize that a returning browser is the same one, so a service can spot a single actor opening many accounts or coming back after a ban.

For fraud detection, canvas is one contributing signal, not a verdict. It helps link activity to a browser even when the cookies are cleared and the email is new, which is the exact reset that abuse relies on. On its own a canvas hash proves little, but combined with the other techniques in a browser fingerprint and with network signals, it raises or lowers confidence that two visits came from the same place. A defender uses it to inform a risk score the customer's own rules act on.

Can canvas fingerprinting be blocked?

Canvas fingerprinting can be resisted but not cleanly blocked, and the way it is resisted creates its own signal. Privacy browsers and extensions take one of two approaches: they refuse the canvas read, or they add random noise to the pixels so the hash changes on every read. Both reduce tracking, and for a privacy-minded user that is the goal.

For a fraud detection system, those countermeasures are informative rather than defeating. A canvas reading that changes on every single load is not what a normal browser does, so the randomization is itself a flag that something is being hidden. An anti-detect browser tries to present a clean, consistent fake canvas instead, but keeping that fake value consistent with the GPU, the fonts, and the rest of the fingerprint across every visit is hard, and the signals can contradict each other. This is the recurring pattern in fingerprinting: covering a technique tends to leave a different trace.

How ShieldLabs uses canvas fingerprinting

ShieldLabs combines canvas with the other browser and network techniques through one JavaScript snippet, so canvas is never read in isolation. Browser fingerprinting like this is the foundation of a stable device identifier that recognizes a returning visitor after cleared cookies and a rotated IP, and the identifier is derived from the whole combination rather than any single hash.

Each visit returns a risk score from 0 to 100 with the named anonymity signals and the Details behind the score. That includes the anonymity signals and the contradictions that arise when the canvas reading and others are randomized or do not match the rest of the browser and device characteristics. Because the read happens in the background from data the browser already exposes, it adds no friction for a real visitor, and you act on the risk score and named anonymity signals through the API and webhooks while your own rules decide the outcome.