Quick verdict: Canvas fingerprinting renders a hidden 2D image in the browser, hashes the pixel data, and uses the hash as a near-unique identifier. The hash depends on browser version, OS, GPU, font rendering, and even system updates — usually unique enough to identify users even when they clear cookies, change IPs, or use incognito mode. It is one of the most reliable signals in modern fingerprinting libraries (FingerprintJS, ThreatMetrix). Scrapers defeat it via antidetect browsers (consistent per-profile spoof) or by patching canvas.toDataURL to return randomized output.
The HTML5 <canvas> element is for drawing 2D graphics. Browsers expose JavaScript APIs to render shapes, text, and images on the canvas, then read the pixel data back. Canvas fingerprinting weaponizes this:
canvas.toDataURL() or getImageData()The hash is stable for the same browser/OS/hardware combination, but changes across different setups — making it a near-unique identifier.
function getCanvasFingerprint() {
const canvas = document.createElement("canvas");
canvas.width = 200;
canvas.height = 50;
const ctx = canvas.getContext("2d");
ctx.textBaseline = "top";
ctx.font = "14px Arial";
ctx.fillStyle = "rgb(255, 0, 102)";
ctx.fillRect(125, 1, 62, 20);
ctx.fillStyle = "#069";
ctx.fillText("Cwm fjordbank glyphs vext quiz \uD83D\uDE00", 2, 15);
return canvas.toDataURL();
}
const fp = await sha256(getCanvasFingerprint());
fetch("/track", { method: "POST", body: fp });Every browser-OS-GPU combo produces a slightly different pixel layout. The emoji U+1F600 renders subtly differently on Windows vs macOS vs Linux. Anti-aliasing varies by GPU driver version. Font fallback chains differ by OS.
The result: out of a sample of 100K browsers, ~99% have a unique canvas hash. Combined with other signals (WebGL, audio context, hardware concurrency), you can identify a specific browser instance with near-perfect accuracy.
The defense surface is small. Either spoof the canvas API output (what antidetect browsers do), or use entirely separate hardware (cloud VMs, physical devices).
Tools like Multilogin, GoLogin, Kameleo override canvas.toDataURL in each profile to produce a consistent-per-profile but distinct-across-profiles hash. To the destination, profile A and profile B look like different machines.
Important: the spoofed hash must be CONSISTENT within a profile across sessions. Randomizing on every page load makes you look more suspicious than a real fingerprint.
For Playwright/Puppeteer scrapers:
// Add noise to canvas output
page.add_init_script("""
const origToDataURL = HTMLCanvasElement.prototype.toDataURL;
HTMLCanvasElement.prototype.toDataURL = function(...args) {
const ctx = this.getContext("2d");
if (ctx) {
const imageData = ctx.getImageData(0, 0, this.width, this.height);
// Add small noise to alpha channel
for (let i = 3; i < imageData.data.length; i += 4) {
imageData.data[i] = Math.max(0, Math.min(255,
imageData.data[i] + (Math.random() < 0.5 ? -1 : 1)
));
}
ctx.putImageData(imageData, 0, 0);
}
return origToDataURL.apply(this, args);
};
""")This patches every canvas read to add 1 unit of alpha-channel noise, producing a different hash each call. Detectable if the site fingerprints multiple times and notices instability — for that, you need a persistent-but-unique spoof keyed to your session.
privacy.resistFingerprinting: similar approach. Available in regular Firefox via about:config.The most reliable but expensive defense: use entirely separate machines per "identity." Different GPU + different OS install = different canvas hash. Cloud VMs (AWS, GCP, DO) all run on virtualized GPUs with their own characteristic hashes.
Anti-bot services have caught up to canvas spoofing. They detect:
For commercial scraping, antidetect browsers handle the consistency problem better than DIY patches. They maintain a stable canvas hash per profile across sessions, matching what a real user would show.
Canvas is one of ~30 signals used in modern browser fingerprinting:
navigator.hardwareConcurrency, navigator.deviceMemoryCombined, the signals identify a browser with near-perfect uniqueness. Defending against canvas alone is insufficient — you need all the layers spoofed consistently. That is what antidetect browsers and tools like curl_cffi (for TLS impersonation) provide.
Related: Browser fingerprinting explained, How fingerprints are detected, Top antidetect browsers.