| Component name | canvas_readback |
|---|---|
| In the visitorId | no (reported, kept out of both ids) |
| structuredId group | none |
| Hashing | plain value; a digest only when longer than 128 characters or not printable ASCII |
| Excluded under | no browser class |
| Inner timeout | 1000 ms |
| Added in | signalsVersion 3 |
Some browsers and privacy extensions change a few pixels whenever a page reads an image back from a canvas, to make canvas fingerprints useless. WhiskerJS paints two exact colours into a single pixel and reads them back. If they come back unchanged it reports exact; if not, altered. It is a diagnostic about the browser’s settings, so it is kept out of the identifiers.
What it reads
The RGBA bytes of a 1x1 2D canvas after painting it, through getImageData(0, 0, 1, 1).
How the technique works
- A canvas element is created and sized 1x1; a 2D context is taken.
- It is filled with
rgb(17, 34, 51)and read back; then withrgb(204, 153, 102)and read back. These opaque colours survive premultiplied alpha exactly in every engine. - If any read returns bytes other than the colour and alpha 255, the value is
alteredat once; if both match,exact.
Why it helps
It turns canvas tampering into a signal of its own. Your server can see that a browser alters readback even when the canvas component does not look noisy (for example when the change is the same on every read), and can weigh the graphics group accordingly.
Stability
High for a given browser and its settings, but it follows those settings: turning an extension or a protection mode on or off flips it. That is why it is outside both ids.
Browser support and what blocks it
- Works wherever a 2D canvas exists: Chrome, Firefox, Safari, iOS browsers, Edge, Brave.
- Browsers or modes that randomise or block readback report
altered, orblockedwhengetImageDatathrows. Unlikecanvas, this probe is not excluded under Brave or Firefox resistFingerprinting, so there it tells you what the browser does.
Privacy
It reveals only whether canvas reads are altered, which suggests a privacy setting or extension. WhiskerJS does not try to work around the alteration.
How WhiskerJS handles noise and failures
| Status | ruleId | When |
|---|---|---|
ok |
exact or altered |
|
unavailable |
no_document |
no document or createElement |
unavailable |
no_api |
the element has no getContext |
unavailable |
no_context |
no 2D context, or no getImageData or fillRect |
unavailable |
no_value |
the pixel data is shorter than 4 bytes |
blocked |
security_error, threw |
the browser refuses or fails the read |
excluded |
caller_excluded |
you excluded it |
timed_out |
timeout, aborted |
budget or abort |
Never hashed.
Example value
All three headless test browsers in the container reported exact.
Questions and answers
What makes canvas_readback report altered?
A browser setting or an extension that changes pixel data when a page reads a canvas, which is how many anti-fingerprinting tools work. A clean browser returns the exact colours.
How is this different from canvas being noisy?
canvas renders a full scene twice and compares the exports, so it catches noise that changes between reads. canvas_readback compares one read with the colours it painted, so it also catches a change that is the same on every read.