Canvas fingerprinting: the tracker you can't delete

The short version

Most tracking uses cookies — little files you can delete. Canvas fingerprinting is sneakier. A website quietly asks your browser to draw a tiny picture, then measures the exact result. Because every device draws it just a little differently, that result becomes a hidden ID for your machine — and there's no cookie to clear. The good news: a few free browser choices make this far less useful to trackers.

What's actually happening

Imagine every printer in the world printing the same sentence. If you looked very closely, each printout would be slightly different — a hair thicker here, a touch of color there — because of the exact ink, paper, and mechanism. You could tell printers apart without ever seeing a label.

Your browser is like that printer. A hidden piece of code on a web page tells it to draw some text and shapes onto an invisible canvas, then reads back the pixels. Your particular graphics chip, drivers, installed fonts, and operating system all nudge those pixels in a way that's remarkably consistent for your device and different from most others. The site never shows you the picture. It just keeps the "signature."

Why it matters to you

• It works even in private/incognito windows and after you clear cookies.
• Different sites (and the ad networks hidden inside them) can use it to recognize the same device.
• You never see it happen and there's no "off" switch on the page itself.

It's not magic, though, and it's not perfectly unique on its own. It's one strong clue among many — and you can make that clue much weaker.

How to fix it

You don't fix this in Windows or in a menu on the website. You fix it by choosing a browser that fights back. There are two honest strategies, and they're opposites:

Strategy 1 — scramble the picture. Give trackers a slightly different signature every time, so it's useless. This is the easiest option for everyday use.

Strategy 2 — look identical to a big crowd. Make your browser draw the same as thousands of other people, so you blend in. This is the most private but the most restrictive.

Option A — Brave (easiest; scrambles)

1. Install Brave and use it normally. Its "Shields" feature randomizes canvas results by default.
2. To check it's on, click the Brave lion icon in the address bar; under Fingerprinting blocked you'll see it's active.
3. Leave it on the default setting. There's nothing else to do.

Option B — Firefox (scrambles, with a switch)

1. Firefox already blocks many known fingerprinting scripts when tracking protection is set to Strict (Settings → Privacy & Security).
2. For stronger, built-in canvas protection you can turn on "Resist Fingerprinting," but it has side effects (wrong clock time zone, pages forced into English, extra-wide margins). Most people should stick with Strict and skip this.

Option C — Tor Browser (blends into a crowd)

1. Download Tor Browser from torproject.org.
2. It's built to make everyone's canvas look the same, and it will ask permission before any site reads a canvas at all. Just use it as-is — don't resize the window or add extensions.

A note on anti-fingerprint extensions

Add-ons that promise to "block canvas" can backfire. If almost nobody else has that exact add-on, having it makes you more recognizable, not less. Prefer a browser that does this by default (Brave, Tor) over bolting on a rare extension.

On phones

Brave for Android and iPhone/iPad has the same Shields protection — use it. Firefox Focus on mobile also helps. On an iPhone, Safari already hides a lot of device detail from trackers, so you're in decent shape there too.

How to check it worked

Run this site's fingerprinting test twice in the same browser. With Brave or Tor, your canvas result should change or match a common one, and your grade should improve. You can also open two private windows and confirm the test doesn't report the same canvas ID both times.

If your result was already good

If you scored an A or B, your browser is already scrambling or standardizing this — you don't need to install or change anything. Just keep it updated, and avoid piling on extra "privacy" extensions that could undo the benefit by making you stand out.

Want to go further?

The Advanced version explains exactly which pixels get measured, how Brave's per-site randomization ("farbling") works, and why Tor's "everyone looks the same" approach is the gold standard for the technically minded.

What canvas fingerprinting actually is

Canvas fingerprinting abuses the HTML5 <canvas> element. A script renders text and shapes — often including emoji and specific fonts — then calls toDataURL() or getContext('2d').getImageData() to read back the rasterized pixels, and hashes them. The resulting hash is stable per device because rendering depends on the GPU, graphics driver, anti-aliasing and sub-pixel hinting, installed font set, OS text stack, and color management. It requires no permission, no storage, and survives cookie clearing and private mode. In practice it's not uniquely identifying by itself; it's a high-entropy signal combined with others (WebGL, audio, fonts, screen metrics) into a composite ID.

Why it matters

Because the value is derived from hardware and software, it is stateless and resilient. It defeats the usual hygiene (clearing cookies, incognito). It's also cross-context: an ad or analytics script embedded on many sites can compute the same canvas value across them, enabling recognition even without third-party cookies — which is exactly why it rose in use as browsers deprecated those cookies.

Two defense philosophies

There is no "block the canvas and be done." You either randomize the output (make the signal noisy and non-reusable) or standardize it (make many users share one value). Each has trade-offs.

Brave — randomization ("farbling")

1. Brave perturbs canvas readbacks using a seed derived per session and per eTLD+1. The same site sees a consistent value within a session, different sites see different values, and a new session reseeds.
2. This is on by default under Shields (the default "Standard" fingerprinting setting). Per-site control is in the Shields panel; a global toggle lives in brave://settings/shields.
3. Edge case: because randomization is per-eTLD+1, within one site your value is reusable for that session — farbling defeats cross-site linkage and cross-session persistence, not necessarily in-session, same-site correlation.

Firefox — privacy.resistFingerprinting (RFP) and Fingerprinting Protection

1. RFP (set privacy.resistFingerprinting=true in about:config) makes canvas readback return controlled/empty data unless the user grants a per-site prompt, alongside a broad spoofing suite (UA pinned to a Windows Firefox ESR value, timezone UTC, locale en-US, letterboxing, a bundled standard font set).
2. Mozilla now recommends the lighter Fingerprinting Protection instead of raw RFP for most users. In default browsing, Firefox blocks scripts on Disconnect's fingerprinting list (active under ETP Strict); a "suspected fingerprinters" layer applies in Private Browsing and under Strict. These are list- and heuristic-based, not full canvas randomization.
3. Trade-off: full RFP breaks real workflows (in-browser image editing can show stray lines, wrong timezone, forced English, rounded window dimensions). It also makes you part of a smaller RFP cohort, which is only an anonymity win if that cohort is large.

Tor Browser — uniformity

1. Built on Firefox ESR with RFP always on, Tor Browser's goal is that all users on the same version/platform present one fingerprint. Canvas reads are blocked (return blank) until the user accepts a per-site doorhanger.
2. Letterboxing (quantizing content dimensions) and the bundled font set remove two big entropy sources. The cost is latency and some site breakage, and the protection depends on not changing the default window size or adding extensions.

OS-level entropy you can't fully remove

• Windows vs macOS vs mobile have different text rasterizers and default fonts; two machines on the same browser still differ.
• Hardware acceleration changes output: GPU-rendered vs software (SwiftShader/llvmpipe) canvas produce different pixels. Toggling it changes your signature but can itself be a distinguishing choice.
• iOS/iPadOS: all browsers use WebKit, and Safari's anti-fingerprinting presents a more uniform, lower-entropy canvas than desktop Chrome — one reason iPhones fingerprint less distinctly.
• Android: Brave's farbling carries over; Chrome offers no canvas defense.

Verify properly

• Use this site's test, plus coveryourtracks.eff.org and (for raw values) browserleaks.com/canvas. Compare the reported canvas hash across two fresh sessions.
• Brave: the hash should differ session-to-session. Tor: it should match the known uniform value for your platform. Firefox RFP: reads should be gated or constant.
• Don't over-read a single "uniqueness" score — a tiny test population inflates it.

Trade-offs & gotchas

• Rare extensions hurt. Niche canvas-blockers add their own detectable behavior; the extension's presence becomes the fingerprint. Prefer defaults in Brave/Tor.
• Randomize vs standardize don't mix well. Layering RFP, an extension, and farbling can produce a contradictory, unusually unique profile.
• Noise can be filtered. Sophisticated trackers sample canvas repeatedly and take a median to defeat weak randomization — strong, structured farbling resists this better than naive per-call noise.
• These are all software measures — no hardware buys you out of it.