Browser Fingerprinting: Canvas, WebGL and Fonts Explained

Every time your browser loads a page it reveals a surprising amount about itself. A fingerprint is the combination of those attributes, hashed into an identifier that is often unique enough to recognise you on your next visit — even in a fresh incognito window with no cookies. The power comes from combination: any single attribute is common, but dozens together are rarely shared by two people.

The most informative signals are:

• Canvas fingerprinting — the site draws hidden text and shapes to a <canvas> and reads back the pixels. Tiny differences in GPU, drivers and font rendering make the output subtly unique per machine.
• WebGL fingerprinting — similar idea using 3D rendering; it also exposes your GPU vendor and renderer string directly.
• Installed fonts — the set of fonts your system has, probed by measuring text dimensions, is highly distinguishing.
• User-agent, language, timezone and screen — OS, browser version, locale, timezone offset and screen/window metrics.
• Hardware hints — CPU core count, device memory, audio-stack quirks and touch support.

Because these are read with ordinary JavaScript APIs, fingerprinting needs no permission and leaves no obvious trace.

Researchers measure fingerprints in terms of entropy — how much identifying information a signal carries. Projects like AmIUnique and CreepJS collect millions of samples and show that a full fingerprint often makes a browser unique among all others tested. The practical takeaway: a site can re-identify a returning visitor from the fingerprint alone.

This is why a proxy or VPN is only part of the picture. Changing your exit IP stops the destination from seeing your real address and separates your network identity — genuinely important, and something you can verify on the what-is-my-ip and IP info tools. But if your fingerprint is unchanged, a site that fingerprints can still tell that the "new" visitor is the same browser. Robust separation means changing both the IP and the fingerprint together, which is exactly what anti-detect browsers try to do — see our anti-detect browser guide.

Defences range from anti-fingerprinting browsers (Tor Browser normalises many signals so users share one fingerprint; Firefox has resistFingerprinting) to per-profile spoofing tools. Blocking JavaScript defeats most fingerprinting but breaks most sites, so it is rarely practical.

You cannot make a fingerprint disappear, but you can lower how much it stands out. Practical steps: keep your browser at a common, up-to-date version so you blend into the crowd; avoid rare font packs and exotic extensions that add entropy; consider a browser that actively normalises signals (Tor Browser, or Firefox with resistFingerprinting) if maximum uniformity is the goal. For multi-account work, use an anti-detect browser to give each profile a self-consistent fingerprint rather than randomised values that contradict each other. Whatever you choose, keep the network side consistent too: route the profile through a proxy or VPN whose exit geography matches the timezone and locale the fingerprint declares, and confirm there is no WebRTC or DNS leak exposing your real address behind the tunnel.