कैनवास फिंगरप्रिंट हैश

What the Canvas Fingerprint Hash reveals

Canvas fingerprinting is one of the quietest tracking techniques on the web, and this tool lets you watch it happen to your own device. It asks your browser to draw a small picture — some text, a couple of coloured rectangles and a circle — onto an off-screen canvas, then reduces that rendered image to a single short hash. Because the drawing is invisible and requires no permission, sites can use it to recognise you across visits even when you block cookies. Reach for this tool when you want to see whether your browser is resistant to canvas tracking, compare how different browsers behave, or simply understand why two people looking at the same page can be told apart by nothing more than a picture neither of them ever saw.

Why the same drawing produces a different hash on every device

The trick is that "draw this text" is not deterministic across machines. The exact pixels depend on your GPU, your graphics driver, the installed fonts, the operating system's anti-aliasing and sub-pixel rendering, and how emoji are rasterised. Those tiny differences are invisible to your eye but very real in the pixel data. Here is the pipeline this tool runs:

• It renders text and shapes to a 320×80 canvas, including an emoji lock and overlapping semi-transparent fills that stress the rasteriser.
• It calls canvas.toDataURL(), which serialises the result to a Base64-encoded PNG data URL.
• It feeds those bytes into crypto.subtle.digest('SHA-256', ...), the browser's built-in Web Crypto engine.
• It prints the digest as a 64-character hexadecimal string.

SHA-256 is a one-way cryptographic hash: it always produces 256 bits (64 hex characters), and there is no way to run it backwards to recover the image. What matters for tracking is that identical pixels always yield the identical hash, while a single flipped pixel produces a completely different one. So your machine tends to return the same hash every time you click, and a friend on different hardware returns a different one — a stable, cookie-free label.

Reading your result and defending against it

Run the tool twice. If you get the same hash both times, your browser is exposing a stable canvas fingerprint that trackers can lock onto. If the hash changes on every click, your browser is deliberately injecting a little random noise into canvas reads — the approach taken by the Tor Browser and by Brave — which is a good privacy sign. Some hardened setups block canvas reads outright, in which case you will see an error instead of a hash. A few practical notes:

• A canvas hash by itself is not personal data, but combined with other signals it becomes a durable identifier, which is why it is worth checking alongside your other exposure.
• Perfectly blocking canvas can paradoxically make you more identifiable, because very few visitors block it — blending in usually beats standing out.
• Changing your IP address does nothing to your canvas hash; the two are independent, so protecting your network identity with a VPN and reducing device fingerprinting are separate tasks that you need to handle together.

Your privacy here

The entire process happens on this page, in your browser. The canvas is drawn locally, hashed locally by your own device's crypto implementation, and the resulting hex string is shown to you and no one else. Nothing is uploaded, and we never receive or store your fingerprint — you can verify that the "Generate" button triggers zero network requests.