Canvas and audio fingerprint
What your browser draws and sounds like: the Canvas and audio hashes, whether they stay stable between renders, and whether noise is injected into one readout path only — a pattern anti-fraud scripts detect.
What your browser draws
The exact scene the test hashes: the site name and a pangram in a missing font and in Arial, an emoji, and three blended circles. Font rasteriser, anti-aliasing, GPU and OS all leave their mark in the pixels.
280×60, shown at 2×
emoji font — an OS signature
What to do about it
Per-call noise
Random noise on every readout is the easiest protection to detect: draw twice, compare. Use a seeded mode that returns the same altered image for the whole browser, or none at all.
One path only
Noise must apply equally to toDataURL, toBlob, getImageData and OffscreenCanvas in workers. A patch on one path is caught by decoding the PNG and diffing the pixels.
Blocked canvas
A blank canvas is rarer than any real fingerprint. Allow readout; a plausible hash beats a missing one.
Emoji and fonts
The emoji glyphs come from the OS emoji font (Segoe UI Emoji, Apple Color Emoji, Noto Color Emoji). Windows emoji under a macOS User-Agent is visible in the pixels.
How this test works
The scene is drawn on two fresh canvases and read out three ways: toDataURL (PNG), getImageData (raw pixels) and a PNG decoded back into pixels. Identical renders and matching readouts are what a real browser produces; any difference is injected. The same scene is also drawn on an OffscreenCanvas inside a Web Worker, where patches applied to the page often do not reach. Audio is rendered offline and hashed the same way.