Canvas fingerprinting explained: what it is and why it is not enough
Updated
Canvas fingerprinting asks the browser to draw a hidden image and reads back the pixels. Small differences in the graphics stack of a device make the result differ between machines, so the result can help tell devices apart. On its own it is weak and easy to change, which is why a device ID is built from many inputs and why privacy tools target it.
What canvas fingerprinting is
The HTML canvas element lets a page draw shapes and text. A script can draw something off screen, read the pixels and turn them into a short value. Because fonts, graphics drivers and the operating system all play a part in drawing, the same drawing can come out slightly different on different devices.
The page never shows the image to the visitor. Nothing is stored on the device, which is why the technique is called stateless.
Why it is only one input
Many devices of the same model and software version draw the same image, so a canvas value alone puts a lot of people in one group. It also changes when a driver or browser updates. A reliable device ID needs more than this one value.
- Many people share the same hardware and software, so the value collides.
- It can change after an update, so it cannot be the only thing you remember.
- Browsers and extensions can add noise or block the read.
Privacy and what browsers do about it
Canvas reads are a known privacy concern because they work without cookies. Some browsers ask for permission, return a blank or noisy image, or randomise the result. That is a legitimate choice by the visitor.
If you collect any device data, say so in your privacy policy, collect only what your fraud checks need and keep it for as long as you need it. Check the rules that apply to your users, since they differ by region.
Run it on yourself
The free test shows the device ID your browser gets and how stable it is, without an account. Reload, switch browser and compare.
Where it fits in a fraud check
A canvas value can help tell two devices apart, but a decision should rest on a server-verified device ID plus network and behaviour evidence. Clients only collect raw signals; your backend asks for the answer and acts on it.
Frequently asked questions
Is canvas fingerprinting legal?
It depends on where your users are and what you do with the data. Many privacy laws treat device data as personal data. Disclose it, limit it to fraud prevention and get legal advice for your case.
Can a user block it?
Yes. Some browsers and extensions block or randomise canvas reads. That is why no single input should decide an outcome.
Is a canvas value unique to one device?
No. Many devices with the same hardware and software produce the same value. It narrows a group down; it does not name one device.
Does it work without cookies?
Yes. Nothing is stored on the device, so clearing cookies does not change it.
Try FingerPrint Checker free
Every new account gets 2,000 free checks. No card required to start.
Create a free account