Canvas fingerprint

Also called: canvas fingerprinting.

Canvas fingerprinting asks the browser to draw something — usually a line of text with a specific font, sometimes a gradient or a curve — into an off-screen canvas, then reads the pixels back with toDataURL or getImageData and hashes them. Two machines given the same drawing instructions do not produce identical pixels, because the GPU, the graphics driver, the font rasteriser and the anti-aliasing settings all differ slightly. The resulting hash is stable for one device and rare across everyone else's, which is exactly the property an identifier needs.

Operationally this is one of the highest-value signals a page can collect, and one of the worst to handle badly. Refusing to render is conspicuous; returning the same fake hash on every profile links them all to each other instead of to you. In Argus canvas is one of the surfaces handled inside the renderer rather than by a script wrapper, and it runs in one of four modes — real, noise, off or manual — so a profile whose hardware is unremarkable can pass its own answer through while another perturbs the result so the hash differs per profile and still looks like something a GPU produced. How fingerprints work covers the four modes and why they are set per surface.