Explore checkers, demos and evaluation routes →
Summarize this page with
Canvas and WebGL fingerprinting use graphics-related observations as identity evidence. They are related collection surfaces, not interchangeable proofs of a stable browser identity. Evaluate what each implementation observes and how its matching system behaves when normal browser or graphics conditions change.
The Canvas API supports drawing graphics through JavaScript. WebGL supports hardware-accelerated graphics in a compatible browser. A fingerprinting implementation chooses operations and observations on top of those interfaces.
- 1Choose the surface
- 2Repeat the observation
- 3Change the environment
- 4Check matching
Distinguish the interface from the matching service
| Layer | What to inspect | Common evaluation mistake |
|---|---|---|
| Graphics interface | Supported operations and availability | Assuming every browser exposes identical observations |
| Collected result | Output or components returned by the implementation | Counting a different value as a different physical device |
| Matching process | Recognition across repeated visits | Assuming exact-hash equality is the only strategy |
| Application decision | The associated event and risk evidence | Treating a graphics value as authentication |
A change in an observation is not necessarily a failed recognition. A matching service may retain the identity using additional evidence. Conversely, two similar observations should not force unrelated browsers into one identity.
Use a small, interpretable matrix
Include known repeat visits, distinct browser profiles, a browser upgrade and an ordinary change in graphics or display configuration where practical. Keep the ground-truth labels outside the detector. Record collection availability and the final identity result alongside the component observations.
One useful row is a repeated visit that changes an observed component but retains the correct match. Another is two distinct browsers with similar components that remain separate. Those rows reveal more about the system than a gallery of unique hashes.
Ask how the result is trusted
A client-side library exposes code and computes observations in a client-controlled environment. A hosted API can provide a trusted retrieval path and additional server evidence, but its collection and event association still need to be integrated correctly. Read the integration guide for the request-to-result boundary.
Do not assume a browser-side value proves that the expected graphics operation ran unmodified. Evaluate documented tamper detection, request association and replay handling in the actual product.
Keep browser privacy changes in the evaluation
Browsers can alter the information available to scripts. The W3C guidance describes fingerprinting exposure as a privacy concern. For software selection, that means maintenance and coverage are ongoing operating requirements, not a single installation checkbox.
The cookies and privacy-mode guide covers recognition when stored state changes. The false-merge guide explains how to evaluate correct matches, incorrect joins and unnecessary splits separately.
FAQ
Is WebGL always better than canvas for identification?
No universal ranking follows from the interface name. Compare availability, stability and the contribution to the complete matching result on your browser population.
Does a changed graphics hash mean a new person?
No. It records changed observed output. A browser environment can change while the same legitimate user returns.
Should an API expose component evidence?
It can help explain changes and investigate mistakes. Also verify the final identity result, risk reasons and the trusted delivery path your application will use.
Sources
Checked October 22, 2026: MDN Canvas, MDN WebGL, W3C guidance. Read the full scoring rubric.
Continue reading
- What is a browser fingerprint? From browser observations to a returning visitor
- Browser fingerprinting techniques: compare rendering, environment and network evidence
- Audio fingerprinting in browsers: what the signal can and cannot tell you
Compare all ten tools or read the complete deployment guide.