Canvas fingerprint

A canvas is created off screen and never shown. Text and shapes are drawn on it, most often a short string in a named font.

1. 1

   Draws off screen

   Nothing appears on the page and there is no permission prompt.

2. 2

   Reads the pixels back

   The image comes back as text or as raw bytes.

3. 3

   Collapses it to one value

   That short value is the fingerprint, and on an untouched machine it is the same on every visit.

These values are read in your browser on this page. The hash is what a site would store about this machine.

Almost every tool in this category adds random noise to the canvas. The question is not whether noise is added but whether it behaves like a machine.

Three ways it fails. All three were measured on our own engine before we closed them, and the numbers are in the check block below.

• One pixel reads two ways

  Noise tied to the position in the returned buffer makes the same strip disagree with itself. A real machine disagrees on nothing.

  5 bytes

• Transparent pixels come back coloured

  Colour under full transparency means nothing, and no real driver produces it.

  6 pixels

• The mask can be subtracted

  If the offsets never change, a site learns them from a solid fill and removes them anywhere. The defence becomes the mark.

  7 of 7

The noise comes from the profile seed, so one profile is stable to itself and two profiles are unrelated. It is applied where the pixels are made, not where they are handed back.

Two runs of the same self-test: the build before the fingerprint patches, and the build shipping today.

• WebGL fingerprint

  The picture is drawn by the graphics card, not by the 2D canvas. Different surface, different values, separate defence.

• Cookies

  A cookie is stored on your machine and can be deleted. A canvas fingerprint is computed on demand and there is nothing to delete.

• User agent

  The browser reports it, so it can be set to anything. The canvas is produced by hardware and drivers, so it has to agree with the rest.

The self-test lives in the app, not on this website. Open a profile, open the fingerprint self-test, and the four canvas rows are the ones named below.

It runs in the profile you are looking at, against the engine you launched. A third party checker in a frame on a marketing page tells you about that page.