Canvas Fingerprint Test
Render one fixed scene twice, hash both reads and see the canvas identifier your machine produces — and whether it holds still. Free, no signup, results stay on this page.
- Runs entirely in your browser
- Results are not uploaded
- No signup
See the canvas hash this machine produces
The test draws one fixed scene into an off-screen canvas, hashes both the encoded image and the raw pixels, then draws it a second time — because the repeat read is what shows whether anything is rewriting the result.
Runs entirely in this browser. Nothing is uploaded, nothing is stored, no signup.
Now give every account its own device.
A clean browser is still one browser. Sendwin runs each profile in isolation with its own fingerprint, cookies and proxy, so the accounts you work on never look like they came from the same machine.
- Isolated profiles, each with its own fingerprint and cookies
- A proxy per profile, with the timezone bound to the proxy country
- Windows, macOS and Linux — plus cloud sessions when you need them
The free plan includes 10 minutes of cloud browsing a day.
How a drawing turns into an identifier
Canvas fingerprinting works by asking your browser to draw something and then reading the pixels back. The instructions are identical for every visitor: the same text, the same curve, the same overlapping shapes with the same blend modes. The output is not. Font rasterization and hinting, sub-pixel antialiasing on curves, the emoji set installed on the system and the arithmetic your GPU performs on overlapping alpha all move the result by a few bits, and a hash of those bits is stable enough to recognize the same machine on a later visit.
It needs no permission, no plugin and no cookie, which is why it appears in nearly every commercial fingerprinting script. This test draws that scene twice in a row, hashes the encoded PNG and the raw pixel buffer separately, and compares the two runs — because the second render answers something the first cannot: whether anything on your machine is rewriting the result between reads.
Where the differences actually come from
Three layers decide your hash. The font stack picks which typeface renders the probe string and how it is hinted, which is why the same browser on Windows and on macOS diverges immediately. The rasterizer decides antialiasing on curves and text edges, and it differs between GPU drivers and between hardware and software rendering. The compositor decides the arithmetic on overlapping translucent shapes. Change your GPU, update a driver or install a font pack and the hash moves — which is also why a value that stays identical across genuinely different machines is suspicious in its own right.
Why randomising the canvas is detectable
The obvious defence is to add noise so that every read returns a different hash. It does defeat one specific kind of tracking, and it announces itself while doing so. A site draws the same scene twice on one page load and compares the two: real hardware returns byte-identical pixels every time, so two different answers to two identical draws is not a device, it is a tool. A canvas that returns an almost blank image tells the same story. The block is louder than the value it was hiding, and the session now carries a flag ordinary visitors never have.
Stable and coherent beats random
What survives a second look is a canvas that behaves like hardware: identical on repeat reads, consistent across reloads and inside iframes, and plausible next to everything else the page can measure. A hash produced by an Apple GPU should sit beside macOS fonts, an Apple renderer string and macOS Client Hints. Changing the canvas alone leaves the rest of that group describing a different machine. This is why patching one value at a time does not hold, and why an anti-detect browser generates the whole environment at the engine level instead of intercepting a single API.
How the hash is produced
- 1
Draw the scene twice
The test renders one fixed composition — a gradient, blended circles, a bezier curve and mixed Latin, Arabic and emoji text — into an off-screen canvas, then renders it again from scratch.
- 2
Hash both reads
Each render is hashed two ways: the encoded PNG and the raw RGBA buffer from getImageData, so an encoder difference between browsers is never mistaken for a difference between devices.
- 3
Compare the pair
Identical hashes mean the canvas behaves like hardware. Different hashes for identical instructions mean something is injecting noise between the draw and the read, which is the tell this page exists to surface.
Other free checks
A hash only means something beside the machine and the string it claims to come from. Here is the rest of that claim.
Canvas fingerprinting FAQ
What the technique reads, why blocking it is visible, and why your hash drifts over months but never between two reads.
It is a tracking technique that asks the browser to draw a fixed image and then reads the pixels back. Because font rendering, antialiasing and GPU compositing vary between machines, the resulting hash is fairly stable per device and fairly distinctive across devices. It requires no cookie and no permission prompt, so clearing your browsing data does not affect it.
You can, with an extension or a browser setting that refuses the readback or returns a blank image. The catch is that refusing is visible: a canvas returning two distinct colours where a real render produces hundreds is an obvious answer, and the block applies to every site rather than only the ones you mind. Blocking removes one identifier and hands over a rarer one in its place.
No. A private window clears cookies, history and storage for the session, but it renders through the same fonts, the same drivers and the same GPU, so the canvas hash is unchanged. That is precisely the property that makes canvas useful to trackers — it survives clearing everything a user can normally clear.
No. Randomising per read defeats simple tracking and creates a much clearer signal in its place, because two identical draws returning different pixels is something no real device does. If you need separate accounts to look like separate machines, each one needs its own stable, coherent canvas — not a canvas that changes while the site is watching.
Usually a browser or graphics driver update, a font installed or removed, or a change in whether hardware acceleration is switched on. Each of those alters the rendering pipeline slightly and moves the hash. Drifting over months is normal; what matters for detection is that it does not change between two reads in the same second.
Not on its own. A canvas hash is one signal among many, and plenty of machines with the same GPU, operating system and font set produce the same value. It becomes an identifier when it is combined with everything else you expose. We cannot tell you how common your hash is, because we hold no database of other visitors' results and will not invent one.
The width, in fractional pixels, that measureText returns for the probe string. It resolves against the fonts actually installed on the machine, so it narrows down the platform without drawing anything at all. Two different widths for the same string in the same page load tells the same story as two different pixel hashes: a real text engine returns one answer.
Still have questions? Talk to us →
How to read your hash
This page measures what this browser renders right now, and whether it renders the same thing twice. It does not tell you how rare your hash is — we hold no database of other visitors' canvases and will not estimate one. Read a stable hash as “this machine behaves like hardware” and an unstable one as “something between the draw and the read is being rewritten”.
A stable canvas per profile, not a random one.
Sendwin builds each profile's rendering stack at the engine level, so the canvas holds still under repeat reads and matches the fonts, GPU and platform around it. Free for 30 days on Windows, macOS and Linux.
30-day free trial · $0 today · cancel anytime — your profiles stay on your machine