What is a canvas fingerprint?

A page draws text and shapes on an invisible canvas, reads the pixels back and hashes them. The result is the same every time on your machine and differs between machines, so it works like an ID.

Use a browser that adds random noise to canvas, WebGL and audio, like Brave by default or Firefox with resistFingerprinting. The "fingerprint protection" row shows whether two drawings came out different.

Do privacy extensions help?

Some do, by wrapping the drawing functions. That can itself be noticed: the browser environment check flags replaced functions.

Canvas fingerprint test

Ask two computers to draw the same text and shapes, and the pixels come out slightly different: the graphics card, the driver, the fonts and the anti-aliasing all leave a mark. Sites hash that drawing into a fingerprint. Here are yours, and whether your browser scrambles them.

Your canvas fingerprint

Canvas…
WebGL…
Audio…
Fingerprint protection…
Combined fingerprint…

79 sniffers · no permission asked

Who sites think you are

You're probably from , and right now you're in . You speak , and your computer runs on with a clock.

You're on , using , with a screen and graphics: .

You get online through , ; the DNS server that looks up sites for you is in . .

You like , and . . Your fonts drop a hint: . As for your age, .

Browser fingerprint IDThe same on every site, in private windows and behind a VPN

Disguise check

–

Sniffing…

Time zone vs IP
- Set the system time zone to the IP's
- Windows: Settings → Time & language
- macOS: System Settings → General → Date & Time
Language vs IP
- Put the IP country's language first in the browser
- Not passing as a local? Leave it
System language vs IP
- The system has another language pack installed, and its fonts and voices show it
- Use a system or virtual machine without those languages
- Or pick a region that matches the system's language
DNS leak
- Clash / Mihomo: DNS with fake-ip, or TUN mode
- V2Ray / Xray: send DNS through the proxy too
- Browser: turn on Secure DNS
Split routing
- To hide it: switch to global mode
- Local sites going direct on purpose? Leave it
WebRTC leak
- Proxy client: turn on TUN mode
- Or limit WebRTC in the browser (Chrome: WebRTC Network Limiter)
Round trip
- A proxy always adds this leg, and sites can measure it
- A server closer to you, with less latency, narrows the gap
- Residential or mobile exits raise fewer eyebrows than data center IPs
Data center IP
- Use a home or mobile exit instead
- Streaming, AI and payment sites often block data centers
User agent vs system
- Don't change the user agent alone: the graphics card gives it away
- Need several identities? Use an anti-detect browser
Tampered environment
- Extensions that change the user agent, language or time zone only change what JavaScript reads; the request headers and the functions underneath stay as they were
- To pass for elsewhere, change the system itself: its language and time zone
- With an anti-detect browser, make sure its settings agree with each other
Trackable fingerprint
- Use Brave (scrambles the fingerprint)
- Or Firefox with resistFingerprinting
- Or Tor Browser
Automation
- Close Selenium, Puppeteer or other automation, then reload

Connection

HTTP/3
- Let the proxy carry UDP (Clash / Mihomo: TUN mode, udp: true)
- Allow UDP 443 on the firewall
- Check QUIC isn't turned off in the browser
ECH
- Turn on secure DNS (DNS over HTTPS) in the browser
- Proxy: turn off fake-ip, or have its DNS return HTTPS records
- Use a browser that supports ECH: Chrome, Edge, Firefox
Post-quantum
- Update the browser
- Turn off HTTPS scanning in your antivirus, or ask whether the company proxy decrypts traffic
WARP
- Cloudflare WARP: switch it in the 1.1.1.1 app

Where do you want to seem to be?

Target region

Every sniffer and what it read

Any site can read all of this, without a permission prompt.

What the server sees15

IP address…CF-Connecting-IP

Location…request.cf.city

Coordinates…request.cf.latitude

Network (ASN)…request.cf.asOrganization

DNS resolver…edns.ip-api.com

Time zone of the IP…request.cf.timezone

Reverse DNS…DNS PTR

Nearest data center…request.cf.colo

HTTP and TLS…request.cf.tlsVersion

Key exchange…/cdn-cgi/trace · kex, sni

Cloudflare WARP…/cdn-cgi/trace · warp

TLS fingerprint…TLS ClientHello

Your clock…Date.now()

WebRTC addresses…RTCPeerConnection · STUN

Local address…WebRTC host candidate

Exits6

Site in mainland China…myip.ipip.net

IP service abroad…api.ip.sb

ChatGPT…chatgpt.com/cdn-cgi/trace

Claude…claude.ai/cdn-cgi/trace

Cloudflare…www.cloudflare.com/cdn-cgi/trace

IPv4 and IPv6…Cloudflare Radar · IPv4 / IPv6

Request headers7

User agent…User-Agent

Languages…Accept-Language

Browser brands…Sec-CH-UA

Platform…Sec-CH-UA-Platform

Compression…Accept-Encoding

Do Not Track…DNT · Sec-GPC

Came from…Referer · document.referrer

Language and region8

Browser languages…navigator.languages

Locale…Intl.DateTimeFormat

System time zone…Intl …timeZone

Clock format…Intl …hourCycle

Week starts…Intl.Locale weekInfo

Number and date format…Intl.NumberFormat

Keyboard layout…navigator.keyboard

Speech voices…speechSynthesis

Fingerprints7

JS engine…Error.message

Canvas…canvas.toDataURL

WebGL…WebGL getParameter

Audio…OfflineAudioContext

Font list…fonts → SHA-256

Combined fingerprint…SHA-256

Fingerprint protection…canvas × 2

Device22

Operating system…userAgentData

Browser…userAgentData.brands

CPU architecture……architecture · bitness

Screen…screen · devicePixelRatio

Refresh rate…requestAnimationFrame

Screens…screen.isExtended · screenX

Window…innerWidth · availHeight

Graphics card…WebGL RENDERER

WebGPU…navigator.gpu adapter.info

WebGL capabilities…WebGL2 · MAX_TEXTURE_SIZE

CPU cores…hardwareConcurrency

Memory…navigator.deviceMemory

Touch and pointer…maxTouchPoints · pointer

Battery…navigator.getBattery

Connection…navigator.connection

Cameras and mics…enumerateDevices

Audio hardware…AudioContext.sampleRate

Biometrics…PublicKeyCredential

Bluetooth…bluetooth.getAvailability

Video codecs…MediaSource.isTypeSupported

DRM…requestMediaKeySystemAccess

Storage quota…storage.estimate

Browser settings14

Color scheme…prefers-color-scheme

Animations…prefers-reduced-motion

Display colors…color-gamut · dynamic-range

Accessibility…prefers-contrast · forced-colors

Opened as…display-mode

Privacy signals…doNotTrack · GPC

Cookies…navigator.cookieEnabled

Permissions…permissions.query

PDF viewer…pdfViewerEnabled

Automation…navigator.webdriver

Ad blocker…bait element

Extensions…window.ethereum · DOM marks

Tab history…history.length

Installed fonts…canvas measureText

Canvas fingerprint test

Your canvas fingerprint

Who sites think you are

Where do you want to seem to be?

Every sniffer and what it read

What the server sees15

Exits6

Request headers7

Language and region8

Fingerprints7

Device22

Browser settings14

Help

What is a canvas fingerprint?

How do I stop it?

Do privacy extensions help?

Canvas fingerprint test

Your canvas fingerprint

Who sites think you are

Where do you want to seem to be?

Every sniffer and what it read

What the server sees15

Exits6Full check

Request headers7

Language and region8

Fingerprints7

Device22

Browser settings14

Exits6