Canvas Fingerprinting
Canvas API output is a widely used tracking signal. BotBrowser provides deterministic, profile-driven protection for all Canvas readback surfaces.
Prerequisites
- Familiarity with Browser Fingerprinting Explained.
- BotBrowser installed with a valid profile. See Installation.
Quick Start
chromium-browser \
--bot-profile="/path/to/profile.enc"Start with this launch to establish a clean baseline before adding extra overrides.
Overview
Canvas fingerprinting uses the HTML5 Canvas API to generate a device-specific identifier. The rendering output varies across devices and platforms, producing a stable tracking signal that can identify users across sessions without their knowledge or consent.
Canvas fingerprinting is one of the most widely deployed tracking techniques. The Princeton Web Census found Canvas fingerprinting scripts on over 14,000 of the top 1 million websites. BotBrowser provides profile-driven protection across all Canvas readback surfaces.
Configuration
Enabling/Disabling Canvas Noise
Canvas noise is enabled by default. To control it explicitly:
# Enable canvas noise (default)
--bot-config-noise-canvas=true
# Disable canvas noise
--bot-config-noise-canvas=falseNoise Seed for Reproducibility
Use --bot-noise-seed to produce a specific, reproducible noise pattern:
# Each seed produces a unique but stable canvas fingerprint
--bot-noise-seed=42The noise seed affects Canvas 2D, WebGL, WebGPU, text metrics, and other surfaces simultaneously. See CLI Flags Reference for the full list of affected surfaces.
Cross-Platform Consistency
When a profile is loaded, BotBrowser uses its built-in font libraries and rendering engine to produce identical Canvas output regardless of the host operating system. A Windows profile running on a Linux server produces the same Canvas fingerprint as it would on a Windows machine.
How BotBrowser Provides Protection
BotBrowser applies deterministic noise to all Canvas 2D output at the rendering pipeline level, not through JavaScript injection. This covers all pixel readback and text measurement operations. Built-in rendering produces consistent results across hosts, and platform-appropriate emoji sets are loaded from the profile. API call patterns and timing remain consistent with native browser behavior.
Effect Verification
To verify protection is active:
- Launch BotBrowser with a profile and visit a fingerprint testing site such as BrowserLeaks or CreepJS .
- Confirm that the reported Canvas hash and image data match the profile configuration, not the host machine.
- To verify reproducibility, launch two sessions with the same
--bot-noise-seedand confirm that the Canvas fingerprint output is identical.
Troubleshooting / FAQ
| Problem | Solution |
|---|---|
| Canvas fingerprint changes between sessions with same profile | Verify you are using the same --bot-noise-seed value. Without a fixed seed, noise varies per session by design. |
| Canvas fingerprint differs between headless and headful mode | Ensure --bot-config-noise-canvas=true is set. Check that the same profile is used in both modes. |
| Canvas output matches raw system output (no noise) | Confirm the profile is loaded correctly with --bot-profile. Check for error messages at startup. |
| Different fingerprint on different host OS | This is expected without a profile. With a BotBrowser profile, Canvas output should be identical across hosts. |
Next Steps
- WebGL Fingerprinting. GPU-level rendering as a fingerprint surface.
- Font Fingerprinting. How font differences contribute to Canvas fingerprinting.
- Browser Fingerprinting Explained. The full picture of fingerprint-based tracking.
- CLI Flags Reference. All noise and configuration flags.
Related documentation: Advanced Features: Multi-Layer Fingerprint Noise | CanvasLab Forensics Tool
Legal Disclaimer & Terms of Use • Responsible Use Guidelines . BotBrowser is for authorized fingerprint protection and privacy research only.