What is canvas fingerprinting?

Quick answer

You can hide your IP perfectly with a VPN and still be tracked — because trackers have moved beyond IP addresses to device fingerprinting. Canvas fingerprinting is one of the most common techniques. Here’s how it works and why it matters.

The idea: identify the device, not the IP

Instead of tracking your address (which changes and can be masked), fingerprinting builds a unique signature from your device’s characteristics. Because the combination of your hardware, software, and settings is nearly unique, sites can recognise you across visits and even across a VPN — without cookies or your IP.

How canvas fingerprinting specifically works

The site quietly asks your browser to draw text or graphics on a hidden HTML5 <canvas> element. The exact pixels produced depend on your GPU, graphics drivers, fonts, operating system, and browser — tiny rendering differences that vary from device to device. The site reads back the rendered image, hashes it, and gets a stable identifier for your device. You never see any of it happen.

Why doesn’t a VPN stop fingerprinting?

A VPN changes the IP a site sees; it does nothing to your browser’s rendering output. So the canvas fingerprint is identical whether your VPN is on or off, letting a tracker link your “anonymous” VPN session to your real one. This is why IP privacy alone is incomplete — the device itself is the identifier.

What actually reduces canvas fingerprinting?

Defences include privacy-focused browsers that randomise or block canvas readout (Brave randomises the fingerprint; the Tor Browser standardises it so all users look alike), anti-fingerprinting extensions, and Firefox’s resist-fingerprinting mode. No method is perfect — aggressive blocking can break sites — but they break the stable signature trackers rely on.

The bigger picture

Canvas is one of several fingerprinting vectors (also fonts, audio, WebGL, screen metrics). Real privacy means addressing both layers: hide the IP (VPN/Tor) and reduce the device fingerprint (hardened browser). One without the other leaves a gap. For the IP side, see our guide on identifying IP leaks.