Canvas fingerprinting: tracked with no cookies.

Clearing your cookies feels like a fresh start. So does a private window, or a VPN. But none of them change the machine you're on, and the machine is what canvas fingerprinting reads. A page draws a line of text on a canvas you never see, reads the pixels back, and hashes them. The same device draws the same pixels, so it gets the same hash, visit after visit, with no cookie at all.

Watch the 60-second version on Instagram.

It isn't new: researchers described it in 2012 and called the result "consistent, high-entropy" and invisible to the user. What's new is that it's back in the conversation. A widely shared post (Fingerprints are the new cookies) shows a working demo, and since 2025.02.16 Google's ad platform no longer bans device fingerprinting.

The whole trick, in six lines

Everything it needs is a standard Web API. No permission prompt, nothing to click.

const c = document.createElement("canvas");
const ctx = c.getContext("2d");
ctx.font = "16px Arial";
ctx.fillText("Cwm fjordbank 😃", 2, 20);
const bytes = new TextEncoder().encode(c.toDataURL());
const hash = await crypto.subtle.digest("SHA-256", bytes);
// same device -> same hash, cookies or not

The canvas is never added to the page. toDataURL() returns its pixels as a data:image/png;base64,… string, and crypto.subtle turns that string into a SHA-256 hash. (crypto.subtle only exists on HTTPS pages, which is every page that matters.)

Why the pixels differ

You'd expect "draw this text in 16px Arial" to produce the same pixels everywhere. It doesn't. The text goes through the font files actually installed, the OS's text renderer, the anti-aliasing settings, the GPU and its driver. Each step makes small choices about the edges of the glyphs, and the emoji comes from a different font on every platform.

The figure exaggerates it to make it visible: in reality the differences are colour values of a few edge pixels, invisible on screen. But a hash doesn't care how small a change is. One different byte gives a completely different hash.

The demo in the post goes further than text. It draws several fonts, emoji and a gradient, then adds the WebGL renderer string (your GPU vendor and model), navigator details (CPU cores, language) and Intl (time zone, locale), and hashes all of it together.

One hash isn't you. A few signals are

A canvas hash on its own isn't unique. Identical devices, say the same iPhone model on the same iOS version, often draw identical pixels and share a hash. That's why fingerprinting combines signals: each one splits the crowd a bit further.

The numbers in the figure are illustrative. Published "X% of browsers are unique" figures conflict with each other and none come from browser vendors, so I'm not going to quote one. The shape is the point: canvas, then GPU, then time zone, and the crowd you hide in gets small fast.

What incognito and a VPN actually do

• Incognito / private windows drop cookies and storage when you close them. In Chrome and Edge the canvas pixels are exactly the same, so the hash is too.
• A VPN hides your IP address. It doesn't change your GPU, your fonts or your time zone. A VPN exit in another country with your home time zone is, if anything, a stronger signal.
• Clearing cookies removes what the site stored. A fingerprint isn't stored anywhere on your side; it's recomputed on every visit.

Who defends against it

Two different strategies there. Tor and Mullvad make you identical to everyone else, so your hash is shared by the whole crowd. Brave does the opposite: it makes your hash different every time, so it can't link two visits. Either breaks the trick. Doing nothing, which is what Chrome does by default, leaves it working.

It isn't only for ads

The W3C's guidance on fingerprinting notes that it "can be used as a security measure", and it is: banks and checkout pages use device fingerprints to spot a stolen session on a new machine, and anti-bot services use them to tell a real browser from a script. The UK ICO's position is that businesses "do not have free rein" to fingerprint people: it's still personal data, and consent rules still apply.

If I needed it on a project, it would be for fraud signals on login and checkout, with the user told about it, not for following people around.

The short version

1. A page draws text on a hidden canvas, reads the pixels with toDataURL(), and hashes them.
2. Fonts, OS, GPU and driver make the pixels differ per device, so the hash is stable per device.
3. One hash is shared by identical devices; combined with WebGL and time zone it narrows to one.
4. Incognito, a VPN and clearing cookies don't change it in Chrome or Edge.
5. Tor, Mullvad, Brave and Safari 26 defend by default; Firefox only in private windows and Strict mode.

Sources: MDN, Fingerprinting · Mowery & Shacham, Pixel Perfect (W2SP 2012) · MDN, toDataURL() · royfish.dev, Fingerprints are the new cookies · Lewis Silkin, Google's new stance on device fingerprinting · DLA Piper, the ICO's response · W3C, Mitigating Browser Fingerprinting · Mullvad, Browser fingerprinting · Tor Browser manual · Brave, Fingerprint randomization · 9to5Mac, Privacy features in iOS 26 · Mozilla, Firefox expands fingerprint protections · Firefox source docs, Privacy Capabilities