The same drawing can produce different pixels
The HTML canvas is a drawing surface used for charts, image editing, games and visual effects. A script can draw text and shapes, then read the resulting pixel values. Although the instructions are identical, small differences in fonts, text rasterisation, graphics drivers and browser rendering can affect the output. Fingerprinting systems can use those differences as one signal among many.
This diagnostic renders a fixed image twice and hashes the raw pixel arrays with SHA-256. It displays a preview and both digests so you can compare repeatability. The page does not claim that a canvas hash belongs to one device or that a changed hash automatically means tracking has been defeated. The meaningful question is what changed in the rendering or readout conditions.
What this particular drawing measures
The controlled drawing uses a fixed 360 by 120 pixel canvas, a solid background, a coloured gradient, text in a named serif font, a circle, a blending operation and a curved stroke. The combination exercises several rendering paths without requiring an image download. Reading the RGBA data yields a fixed-size byte array that is passed to the browser’s cryptographic digest implementation.
The preview helps you verify that a drawing was produced, but visual inspection is not enough to compare exact output. Two images can look identical at normal size and still differ in antialiasing values around a character or curve. Conversely, a font substitution can be obvious. The digest detects either kind of change without pretending to explain its cause.
The pixel hash is separate from the PNG data URL used for the preview. File encoders can produce different encoded files for equivalent pixels, so hashing the pixel array avoids confusing an encoding difference with the rendering observation this diagnostic is intended to measure.
The Overview tab explains the findings. Measured data lets you search individual fields and values, while JSON report shows the complete export. Export JSON to retain a baseline, or print the findings for your own records. Review the report before sharing it: browser characteristics, token claims, and file names can reveal information about your setup.
Compare repeats, profiles and browser updates
First run the test without changing anything. It makes two independent renderings during that check. Matching hashes suggest the output was repeatable under those immediate conditions. Run it again after reloading if you want to examine whether behaviour remains stable across page loads. Some privacy features introduce variations at a different scope, so one repeated pair cannot describe every future visit.
For a useful comparison, record the browser version, profile, operating system and hardware-acceleration setting. If you switch browsers and disable acceleration at the same time, you cannot isolate which change affected the result. A graphics driver update or a font change can also alter output without any deliberate anti-fingerprinting action.
Save the JSON report before making a change. Compare complete digests, dimensions and the described drawing recipe. A hash from an unrelated canvas testing website is not expected to match because its image instructions may differ. Even a tiny text or colour change produces a different input, which makes the digest unsuitable for cross-tool comparisons unless the recipes are identical.
Interpret blocking and noise carefully
Some browsers standardise canvas behaviour, ask permission before allowing readback or add noise to pixel results. An extension can also intercept canvas APIs. A blocked readback is meaningful evidence about this page’s access, but it does not establish that the site cannot use other signals. Timezone, account state, network information and other APIs can remain available.
A changing digest can be consistent with privacy noise, but the test does not inspect the implementation of your privacy software. It cannot prove whether the noise is unpredictable, whether it is stable for a particular site or whether another API reveals the original data. Likewise, stable output can be intentional in a browser that aims to make many users look the same.
The goal is not to force the result into one particular state. Start with the browser’s supported privacy controls and evaluate compatibility. Canvas is widely used for legitimate image and document tasks. If a change breaks a tool you need, consider a profile-specific setting or a documented exception instead of disabling unrelated protections.
Reading a canvas comparison
| Result | What it tells you |
|---|---|
| Two matching hashes | The two measured pixel arrays match for this drawing. |
| Different hashes, similar preview | Small numerical differences may exist below obvious visual perception. |
| Different-looking text | Font selection or rendering conditions may have changed. |
| Readback blocked | The page could not read canvas pixels; other fingerprint signals may remain. |
Strengths and limitations
What this is useful for
A fixed recipe and two renderings make this a focused way to observe canvas behaviour. The report includes the dimensions and exact digests, while the preview gives useful visual context. You can investigate privacy settings without sending an image to a remote comparison service.
What to keep in mind
No population comparison is performed, and a hash is not a hardware serial number. Results depend on this exact drawing. The test does not comprehensively detect API interception, quantify tracking risk or tell you whether a particular browser configuration is common among other users.
Common questions
Does a canvas fingerprint identify my graphics card?
Not directly. Rendering can depend on fonts, browser code, operating-system text rendering, driver behaviour and hardware acceleration. Multiple devices can produce the same output, while one device can produce different output after an update. Read the separate WebGL inspector for the renderer information a browser explicitly exposes.
Is a changing result better for privacy?
It can be part of a useful protection, but the result alone is insufficient. Standardising output across users is another approach. A poorly coordinated modification can also create unusual behaviour. Evaluate the browser’s documented design and your whole setup rather than optimising one hash.
Does the drawing or hash leave the device?
The image is drawn, read and hashed inside the page. This application does not upload the canvas or query a fingerprint database. Downloading or copying a report is an explicit action you control. The preview contains only the test drawing, not your screen or browsing history.
Why does another canvas test show a different hash?
Each tool can choose its own text, shapes, colours, dimensions, font and hashing method. Different inputs should produce different digests. A meaningful comparison requires the same drawing recipe and digest algorithm; the appearance of a hexadecimal string does not make two recipes equivalent.