Canvas Fingerprinting — How It Works and How Anti-Detects Spoof It
Canvas fingerprinting was the original browser identification trick. The mechanics, the detection, and how good engines handle it.
Canvas fingerprinting was invented in 2012 and is still in active use across every major anti-bot. Here's why and how good anti-detect engines defeat it.
The mechanism
A page draws text + shapes to an off-screen HTML5 canvas, then calls toDataURL() to read the pixel output as base64. The same browser, on the same GPU, with the same OS, produces the same pixel output. The hash of that output is a stable per-device identifier.
What varies across devices:
- GPU model — different antialiasing engines
- Font rendering — OS font hinting (Win ClearType vs Mac CoreText)
- Driver version — same GPU, different driver = different pixels
- Browser version — Chromium milestones change subtly
The hash space is large enough that two random users almost never collide. So canvas alone identifies ~95% of unique devices.
Naive spoofing
Many free / cheap anti-detects implement canvas spoofing as: "intercept toDataURL() and add noise to the output." That breaks the fingerprint, but it also breaks legitimate uses of canvas — image preview, PDF rendering, charts. Sites detect the noise pattern and flag.
Plausible spoofing
What Afina and other top-tier engines do: return a canvas hash consistent with the chosen device profile. If you've picked "Windows 11 / Chrome 132 / RTX 4060" — the canvas output should be what an actual Windows 11 / Chrome 132 / RTX 4060 device produces.
This requires maintaining a database of (device, browser, driver) → canvas pixel patterns. Afina's database currently covers ~12,000 device combinations.
Verification
To check whether your engine handles canvas correctly:
- Load browserleaks.com/canvas
- Note the hash
- Reload the page in the same profile — hash should be stable
- Open a different profile with a different device — hash should be different
- The reported "signature" (e.g., "Chrome 132 on Windows") should match what your fingerprint claims
A naive engine returns either always-different (randomised) or always-empty (blocked) — both flag.
How it pairs with other surfaces
Canvas alone isn't enough. The engine must also align:
- WebGL — same GPU model, same driver
- Audio — same DSP signature
- Fonts — same font set that produced the canvas hinting
If canvas claims "Windows 11 RTX 4060" but WebGL reports "Linux Mesa" — instant flag.
The takeaway
Canvas was the first fingerprint surface. It's not the most important anymore, but it's still in every detector's signal pack. A bad canvas engine = a leaking profile, regardless of how good the rest is.