Canvas fingerprint

Canvas fingerprinting is a way of identifying a computer by how it draws. A site asks the browser to draw an invisible image with text and shapes, takes the result, and computes a checksum from it.

The image is the same, but the checksum differs across machines: the drawing is done by the video card, and tiny differences in it, in the driver, in the font set and in anti-aliasing produce different pixels at the output. A human can't see the difference — a number can.

The same trick works with WebGL (3D graphics, plus the video card's name in plain text) and with AudioContext (audio processing instead of an image).

Why it's a strong tell

A canvas checksum isn't stored in any file — it can't be cleared like a cookie. It's computed fresh on every visit and stays the same until you change your computer, video card or driver.

That's why two accounts opened from the same machine look like one person by canvas, even if everything else is different.

What makes a sloppy spoof dangerous

Spoofing is usually done with noise: barely noticeable deviations are added to the result so the checksum changes. It's easy to make things worse than they were, and here are three ways:

• The noise changes on every read. A real machine gives the same answer to the same request. If the checksum jumps from call to call, that's not "a unique computer" — it's an obvious spoof, and it's checked with two requests in a row.
• The noise is too large. The value drifts into a range where real devices never land.
• Canvas is spoofed, but the WebGL video card stayed real. Two values that are supposed to be linked start contradicting each other.

The rule is the same as for the whole fingerprint: consistency matters more than uniqueness. A stable, ordinary fingerprint is better than a one-of-a-kind one.

How to check

The fingerprint check shows your canvas checksum and takes two reads in a row — so you can see whether the value holds or jumps.