# What is canvas fingerprinting? > Canvas fingerprinting draws hidden text and shapes, reads the pixels back and hashes them. Small rendering differences make the hash a mark of your machine. Source: https://mosaicbrowser.com/glossary/canvas-fingerprinting ## Canvas fingerprinting: how a drawing identifies your computer Canvas fingerprinting is a technique where a page draws text and shapes on an HTML canvas, reads the pixels back and hashes them; because GPUs, drivers and fonts render slightly differently, the hash helps identify the machine. ![Canvas fingerprinting, drawn as a mosaic of tiles](https://mosaicbrowser.com/covers/canvas-fingerprinting.webp) Canvas is the HTML element pages use to draw graphics. A fingerprinting script uses it in a way no visitor sees: it draws a short string in a few fonts, some overlapping shapes and color gradients into a canvas, then asks for the pixels back with `toDataURL()` or `getImageData()` and hashes them. ## Why the result differs between machines The drawing instructions are identical everywhere. The pixels are not. Text antialiasing, subpixel positioning, font hinting, the GPU and its driver, and the operating system's graphics stack all leave small differences in the output. Two computers with different hardware or fonts usually produce different hashes; two identical ones may match. So a canvas hash is not unique on its own, but it adds a lot to a [browser fingerprint](https://mosaicbrowser.com/glossary/browser-fingerprint) and it survives clearing cookies. The same idea is used with WebGL, which renders a 3D scene and reads it back, and with text measurement, where the width of a string reveals the fonts installed. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Machines that exist](https://mosaicbrowser.com/features/real-fingerprints) ## How it is defended against, and how that shows There are three common defenses, and each leaves a mark. - **Blocking** the readback. Rare in real traffic, so the refusal is itself distinctive. - **Random noise on every read.** The hash changes each time, which a page detects by drawing the same thing twice and comparing. No real machine does that. - **Noise that is stable per profile.** The same drawing reads back the same way every time inside one profile, and differently in another. This is the shape a real computer has. Where the noise is added matters too. A script injected into the page that wraps `toDataURL()` can be caught wrapping it, and misses readbacks a page does in a worker or through a blob. ## How Mosaic handles it Mosaic adds canvas noise inside its own engine, in C++, at the point where image data is read back, including `toBlob()` and WebGL's `readPixels()`. The noise belongs to the profile, so a profile keeps its canvas identity across launches, and repairing a profile's hardware keeps it too. [Machines that exist](https://mosaicbrowser.com/features/real-fingerprints) covers how the rest of the profile is drawn, and [why we built our own Chromium](https://mosaicbrowser.com/blog/why-we-built-our-own-chromium) explains why none of it is done with injected JavaScript. ## Questions ### Should I block canvas reads? Blocking is rare among real visitors, so a browser that refuses to read back a canvas stands out. Changing the output consistently is less conspicuous than refusing. ### Why is random canvas noise a problem? If the same drawing reads back differently on every call, a page can draw twice and compare. No real computer does that, so per-read randomness identifies the spoof. ### Does canvas fingerprinting work in incognito mode? Yes. The output depends on hardware, drivers and fonts, not on stored data, so private windows produce the same result as normal ones. ## Related [Browser fingerprint: what a site can read about your machine](https://mosaicbrowser.com/glossary/browser-fingerprint): A browser fingerprint is the set of values a site reads about your browser and computer, which together recognize you without cookies. What goes into one. [Machines that exist: fingerprints drawn from real hardware](https://mosaicbrowser.com/features/real-fingerprints): Mosaic draws each profile's GPU, screen, CPU, memory and fonts from one real device, so the parts of a fingerprint agree with each other and with the host. [Why we built our own Chromium instead of injecting JavaScript](https://mosaicbrowser.com/blog/why-we-built-our-own-chromium): Mosaic changes fingerprint values in C++ inside its own engine. Three measured differences between Chrome and plain Chromium explain why that matters. [What is an anti-detect browser?](https://mosaicbrowser.com/guides/what-is-an-anti-detect-browser): An anti-detect browser gives each profile its own fingerprint, proxy and cookies, so sites see separate visitors. What it changes, how, and its limits.   [WebGL fingerprinting: what your graphics card tells a page](https://mosaicbrowser.com/glossary/webgl-fingerprinting): WebGL fingerprinting reads the GPU vendor and renderer strings, dozens of driver limits and a rendered image, which together identify your GPU.  ## See canvas fingerprinting on a real profile Mosaic shows the values a site reads, per profile, and runs a leak test from inside the profile’s own page. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.