Canvas fingerprint blocker: what the extensions do and when they backfire

A canvas fingerprint script draws text and shapes on a hidden canvas. It reads the pixels back and hashes them. Your GPU, drivers and fonts shape the result, so the hash stays stable on one device.

A blocker extension changes the page’s canvas functions so the read returns something else. It uses one of three methods.

The facts below come from each extension’s store page and documentation, checked in October 2026.

CanvasBlocker’s author warns against two protections on the same API, citing “massive performance issues.” Do they work? Against a script that only hashes your canvas, yes. Against a script that looks for tampering, less so.

• A value that changes on every visit. A normal browser returns the same canvas hash each time, so constant change is itself unusual.
• Detectable lies. Scripts can check whether page functions were replaced and whether pixels carry noise. CreepJS, an open research project, exists to expose these weak points.
• Statistical tests. Brave’s 2020 design post says light noise is open to statistical attacks.
• A small crowd. Brave dropped its Strict fingerprinting mode in 2024, partly because the under 0.5% of users on it could stand out.
• The rest stays real. A canvas-only tool leaves your WebGL GPU name, fonts, screen, timezone and IP address as they were.

Browser makers now build canvas defenses into the engine. Many users share them, and they do not patch page JavaScript that a site can inspect.

Do not stack a blocker on top of these. The Tor Project strongly discourages extra add-ons, because they can make your fingerprint unique.

1. 1

   Read your canvas signature

   Open the BrowserLeaks canvas page at browserleaks.com/canvas. Note the Signature value.

2. 2

   Reload, then restart

   A signature that changes on every reload means per-visit noise. Brave’s docs say a restart, a private window or a second profile should each give a new value.

3. 3

   Compare two sites

   The CanvasBlocker author runs the same test on canvasblocker.kkapsner.de/test/ and canvasblocker2.kkapsner.de/test/. Different values mean canvas no longer links the two sites.

4. 4

   Look for detected lies

   Open CreepJS at abrahamjuliot.github.io/creepjs, its only official address. If it reports tampering, other scripts can find the same signs.

5. 5

   Ignore “unique” on its own

   Any randomizing tool looks unique on a test site. What counts is whether the value changes between sites.

AliasMode is not a canvas blocker. It is a free, open-source app that runs separate browser profiles, each with its own storage, proxy and fingerprint values.

AliasMode Chromium adds canvas and WebGL noise per profile from a stable seed. Each profile’s canvas differs from the others and stays the same at every launch.