What Is WebGL Fingerprinting? How Your GPU Identifies Your Browser

WebGL fingerprinting uses your browser's 3D graphics API to read your GPU vendor, model, and driver-level rendering output — producing a device identifier that persists across all browsers on the same machine and is completely unaffected by clearing cookies or switching networks. You can check what your browser exposes right now on whatsmy.fyi.

TL;DR

WebGL fingerprinting exploits the WebGL API — the same one that renders browser-based games and 3D maps — to extract your GPU vendor string, GPU model name, and pixel-level rendering output. Each GPU model produces subtly different results for identical rendering commands due to differences in floating-point rounding, driver behavior, and hardware architecture. Combined with other signals, WebGL data can uniquely identify 99.24% of desktop browsers. No storage on your device, nothing to delete, and a VPN cannot stop it.

What Is WebGL Fingerprinting?

WebGL fingerprinting is a browser tracking technique that abuses the WebGL API — a JavaScript interface for rendering hardware-accelerated 2D and 3D graphics — to read device-specific GPU characteristics. Unlike cookie tracking, it requires no storage and is unaffected by private browsing mode or clearing your browser data.

The technique has two complementary components. The first reads static hardware metadata directly from browser APIs: your GPU vendor name, GPU model, and the complete list of WebGL extensions your driver supports. The second component renders a hidden 3D scene and reads back pixel data — a process that produces subtly different results on every hardware and driver combination.

WebGL fingerprinting is closely related to canvas fingerprinting, but targets a different — and more identifying — layer of your system. Canvas fingerprinting captures 2D font-rendering differences; WebGL fingerprinting reaches directly into your GPU hardware. Together, they are two of the highest-entropy signals in the fingerprinting toolkit.

How Does WebGL Fingerprinting Work?

A WebGL fingerprint is assembled in three stages, each taking only a few milliseconds and completely invisible to the user.

Stage 1 — Reading Hardware Parameters

The script calls gl.getParameter() with dozens of constants to extract hardware capabilities. Most values are benign on their own — maximum texture size, maximum viewport dimensions, supported GLSL shader precision. But one WebGL extension changes everything.

The WEBGL_debug_renderer_info extension exposes two constants designed for debugging: UNMASKED_VENDOR_WEBGL and UNMASKED_RENDERER_WEBGL. When queried, they return the exact, unmasked GPU vendor string — for example, "NVIDIA Corporation" — and the full GPU renderer string — for example, "NVIDIA GeForce RTX 4080/PCIe/SSE2". These strings alone can narrow a visitor population to fewer than 100 individuals, according to research from Inria and KU Leuven.

Stage 2 — Rendering a 3D Scene

The script creates a hidden WebGL canvas and renders a complex scene: gradients, lighting calculations, and transparent geometry with specific texture coordinates. Because floating-point arithmetic is handled differently by each GPU's shader units — NVIDIA, AMD, Intel, and Apple Silicon all implement slightly different rounding behaviour — the resulting pixels differ at the binary level across hardware, even for identical GLSL shader code.

Stage 3 — Pixel Hash via readPixels()

The script calls gl.readPixels() to extract the raw RGBA pixel buffer from the rendered scene and hashes it — typically with MurmurHash — into a compact fingerprint value. This hash is stable across browser sessions, incognito mode, and reboots. It changes only when the GPU driver is updated or the physical hardware is replaced.

// Stage 1 — read unmasked GPU strings via the debug extension
const canvas = document.createElement('canvas');
const gl = canvas.getContext('webgl');

const ext = gl.getExtension('WEBGL_debug_renderer_info');
if (ext) {
  const vendor   = gl.getParameter(ext.UNMASKED_VENDOR_WEBGL);
  const renderer = gl.getParameter(ext.UNMASKED_RENDERER_WEBGL);
  // e.g. "NVIDIA Corporation", "NVIDIA GeForce RTX 4080/PCIe/SSE2"
}

// Stage 2 — collect hardware capability parameters
const params = {
  maxTextureSize:     gl.getParameter(gl.MAX_TEXTURE_SIZE),
  maxViewportDims:    gl.getParameter(gl.MAX_VIEWPORT_DIMS),
  supportedExts:      gl.getSupportedExtensions(),
  highFloatPrecision: gl.getShaderPrecisionFormat(
    gl.FRAGMENT_SHADER, gl.HIGH_FLOAT
  ).precision,
};

// Stage 3 — render a scene and extract pixels
// (abbreviated; real scripts render complex GLSL shaders)
const pixels = new Uint8Array(4 * canvas.width * canvas.height);
gl.readPixels(
  0, 0, canvas.width, canvas.height,
  gl.RGBA, gl.UNSIGNED_BYTE, pixels
);
// Hash 'pixels' → stable GPU fingerprint

How Unique Is a WebGL Fingerprint?

WebGL is one of the highest-entropy individual signals in browser fingerprinting. The GPU parameter layer alone yields 10–15 bits of entropy — enough to identify your hardware make and model within a small cohort. The rendering hash adds further discrimination between devices with identical GPU models but different driver versions.

WebGL 2.0 expands the fingerprinting surface beyond WebGL 1.0 by adding parameters such as MAX_3D_TEXTURE_SIZE, MAX_ARRAY_TEXTURE_LAYERS, and transform feedback constants. Each additional parameter further differentiates hardware configurations. Because WebGL 2.0 now has 95–99% browser support, fingerprinting scripts routinely collect both versions in a single pass.

Who Uses WebGL Fingerprinting in the Real World?

Advertising Networks

Ad-tech companies use WebGL fingerprinting to track users across websites for behavioural targeting and frequency capping — the same goal previously served by third-party cookies. As Safari blocked third-party cookies by default and Chrome moved toward deprecation, hardware-level fingerprinting became an attractive cookie replacement because it requires no storage and no user interaction.

Fraud Detection and Bot Mitigation

Security platforms use WebGL data as a bot-detection signal. Automated browsers running headless Chrome or Puppeteer often report GPU renderer strings inconsistent with their claimed user-agent — for example, a "Chrome on Windows" user-agent paired with a software-only Mesa renderer string. Mismatches between GPU hardware claims and available WebGL extensions are strong indicators of automation or VM environments. Companies including Fingerprint.com and Castle.io deploy WebGL fingerprinting as part of their device intelligence stack.

Cross-Browser Tracking

Because the WebGL renderer string and pixel hash are derived from physical hardware rather than browser state, they remain consistent across different browsers installed on the same machine. A user who alternates between Chrome, Firefox, and Edge to evade tracking will produce the same GPU renderer string in each browser — enabling cross-browser linkage that cookie-based systems cannot achieve.

How to Protect Yourself from WebGL Fingerprinting

Effective protection requires either blocking the WebGL API, randomising its output, or normalising it across a large user population. Options are ranked from strongest to most practical for daily use.

• Tor Browser (strongest protection): Tor Browser disables the gl.readPixels() function entirely and restricts WebGL to a minimal capability mode via webgl.min_capability_mode, making rendering-based fingerprinting impossible. The WEBGL_debug_renderer_info extension is blocked so the unmasked GPU strings cannot be read. The trade-off is slower browsing via the Tor network.
• Brave Browser (recommended for daily use): Brave applies its Farbling technique to WebGL: per-session, per-site noise is injected into canvas and WebGL pixel output, making the rendering hash different on every site visit. WebGL APIs are also blocked from third-party contexts by default. Your GPU renderer string is still readable, but the rendering hash becomes unreliable as a stable identifier.
• Firefox with privacy.resistFingerprinting: Setting this flag to true in about:config completely disables the WEBGL_debug_renderer_info extension, returning generic values in place of your real GPU strings. WebGL rendering output is also normalised. This is the closest to Tor-level protection available in a mainstream browser without the speed penalty.
• Safari on Apple devices: Safari reports a generic "Apple GPU" string instead of specific chip models (M1, M2, M3) and randomises canvas output. This hides hardware generation from scripts but does not protect against rendering-based pixel hashes.
• uBlock Origin (advanced users): Using uBlock Origin in medium or hard mode blocks most third-party fingerprinting scripts before they can execute. This does not protect against first-party fingerprinting but eliminates the vast majority of ad-tech tracking use cases.
• What a VPN cannot do: A VPN routes your traffic through an encrypted tunnel and hides your IP address, but it has no effect on WebGL output. Your GPU vendor string, renderer string, and pixel hash are generated inside your browser and transmitted to tracking servers as JavaScript data — not as network metadata. Verify your VPN is working (IP-level) on whatsmy.fyi, but know it does not address fingerprinting.

Frequently Asked Questions

What does WebGL fingerprinting actually reveal about my hardware?

At minimum: your GPU manufacturer (NVIDIA, AMD, Intel, Apple, Qualcomm), your GPU model name, and sometimes your driver version — all exposed as plain text via the WEBGL_debug_renderer_info extension. Beyond that, the rendering hash encodes your GPU's floating-point behaviour, which is specific to a hardware generation and driver version combination. Together these signals can narrow you to a population of fewer than 0.01% of typical website visitors.

Does WebGL fingerprinting work in incognito or private mode?

Yes. Private browsing prevents your browser from saving cookies, history, and form data to disk — but it does not change your GPU hardware or driver. The WEBGL_debug_renderer_info extension returns the same strings in an incognito window as in a normal window. Only browsers with active fingerprint protection — Brave, Firefox with privacy.resistFingerprinting, or Tor Browser — behave differently.

Is WebGL fingerprinting more powerful than canvas fingerprinting?

They target complementary dimensions of device uniqueness. Canvas fingerprinting captures 2D font-rendering differences between OS text engines (ClearType, Core Text, FreeType). WebGL fingerprinting directly exposes GPU vendor and model metadata, and captures 3D shader-level floating-point differences. WebGL typically yields higher entropy per signal because GPU hardware is more diverse than font-rendering stacks. Most commercial fingerprinting platforms deploy both simultaneously. See the canvas fingerprinting guide for a side-by-side comparison.

Can WebGL fingerprinting track me across different browsers on the same computer?

Yes — this is one of its most significant capabilities. Because the GPU vendor and renderer strings are derived from hardware, they are identical whether you use Chrome, Firefox, Edge, or any other browser on the same machine. Research published at NDSS 2017 specifically demonstrated cross-browser fingerprinting using GPU-level WebGL features, linking browsing sessions across browsers without any shared cookies or storage.

Does the WEBGL_debug_renderer_info extension always work?

Not in all browsers. Firefox with privacy.resistFingerprinting returns generic placeholder strings. Tor Browser blocks the extension entirely. In some hardened configurations, the extension returns null. However, in default Chrome, Edge, and standard Firefox without privacy flags enabled, it returns full unmasked GPU strings. Most users run browsers in their default configuration, making this a broadly effective tracking vector.

Does disabling hardware acceleration stop WebGL fingerprinting?

Partially. Disabling hardware acceleration in browser settings forces WebGL to use a software renderer (typically Mesa's LLVMpipe or SwiftShader) instead of your physical GPU. This removes the GPU-specific renderer string and makes rendering output more uniform. However, it does not guarantee protection — scripts can still read software renderer strings and hardware capability parameters — and it significantly degrades graphics performance on media-heavy websites.

Is there academic research on stopping WebGL fingerprinting?

Yes. A 2019 paper published at USENIX Security, "Rendered Private: Making GLSL Execution Uniform to Prevent WebGL-based Browser Fingerprinting" by Wu, Li, Cao, and Wang, proposed UNIGL — a system that rewrites GLSL shader programs so that rendering output is uniform across different GPU hardware while preserving visual fidelity. The approach prevents rendering-based pixel hashing without blocking WebGL entirely, representing a more nuanced alternative to the blunt "block everything" approach used by Tor Browser.

Related Articles

• What Is Browser Fingerprinting? How Sites Track You Without Cookies — the complete guide to all fingerprinting signals combined
• What Is Canvas Fingerprinting? How Websites Track You Without Cookies — how the 2D Canvas API captures font-rendering and GPU differences
• What Is Audio Fingerprinting? How AudioContext Tracks Your Browser — how your device's audio stack produces a unique identifier
• What Is a WebRTC Leak? How Your Real IP Gets Exposed — a related tracking risk that exposes your real IP even through a VPN