What Is WebGL Vendor Fingerprinting? How Your GPU Brand Identifies You

WebGL vendor fingerprinting reads your GPU manufacturer and exact model name from the browser's 3D graphics API to build a persistent device identifier — without storing anything on your machine. You can check what your browser exposes right now on whatsmy.fyi.

TL;DR

WebGL vendor fingerprinting uses a browser extension called WEBGL_debug_renderer_info to read two strings your GPU driver exposes: the vendor name (e.g., NVIDIA Corporation) and the renderer string (e.g., ANGLE (NVIDIA GeForce RTX 3050 Direct3D11 vs_5_0 ps_5_0)). These strings are specific enough to identify your GPU model, driver backend, and sometimes even driver version — information that rarely changes and cannot be cleared like a cookie.

What Is WebGL Vendor Fingerprinting?

WebGL vendor fingerprinting is a browser tracking technique that exploits the WEBGL_debug_renderer_info extension — a debugging feature built into the WebGL specification — to extract detailed information about your graphics hardware. Unlike canvas fingerprinting, which infers GPU differences from pixel-level rendering variations, WebGL vendor fingerprinting asks the driver directly: "Who made you and what are you called?"

The result is a pair of strings — UNMASKED_VENDOR_WEBGL and UNMASKED_RENDERER_WEBGL — that identify your GPU manufacturer, model name, graphics backend (Direct3D, Metal, Vulkan, or OpenGL), and often the driver version. Together these two values carry 10–15 bits of entropy, making them among the highest-signal individual attributes in the browser fingerprinting toolkit.

The technique was originally intended for developers debugging graphics performance issues. It was never designed as a tracking surface — yet because it exposes hardware-level identifiers that are stable across browser sessions, private windows, and even OS reinstalls, it has become one of the most widely deployed fingerprinting signals on the web.

How Does WebGL Vendor Fingerprinting Work?

The extraction process requires only a few lines of JavaScript and completes in under a millisecond.

Step 1 — Request the Debug Extension

The script calls gl.getExtension("WEBGL_debug_renderer_info") on a WebGL context. Most browsers expose this extension by default; privacy-hardened browsers may return null or a generic string.

Step 2 — Read the Vendor and Renderer Strings

With the extension available, the script calls gl.getParameter() twice — once for ext.UNMASKED_VENDOR_WEBGL (e.g., Google Inc. (NVIDIA)) and once for ext.UNMASKED_RENDERER_WEBGL (e.g., ANGLE (NVIDIA, NVIDIA GeForce RTX 3050 Laptop GPU Direct3D11 vs_5_0 ps_5_0, D3D11)). These are raw driver strings — not values the browser or OS sanitises before returning.

Step 3 — Combine With Other Signals

The renderer string is hashed and combined with supported WebGL extensions, maximum texture size, shader precision, and other WebGL parameters to produce a composite GPU fingerprint. This combined value is far more unique than either string alone.

// WebGL vendor fingerprinting — how tracking scripts extract GPU identity
function getWebGLVendorFingerprint() {
  const canvas = document.createElement('canvas');
  const gl =
    canvas.getContext('webgl') ||
    canvas.getContext('experimental-webgl');

  if (!gl) return { vendor: 'unsupported', renderer: 'unsupported' };

  // Request the debug extension that exposes unmasked driver strings
  const ext = gl.getExtension('WEBGL_debug_renderer_info');

  if (!ext) {
    // Browser is protecting you (Brave / Firefox resistFingerprinting)
    return { vendor: 'protected', renderer: 'protected' };
  }

  // These strings directly identify your GPU brand and model
  const vendor   = gl.getParameter(ext.UNMASKED_VENDOR_WEBGL);
  const renderer = gl.getParameter(ext.UNMASKED_RENDERER_WEBGL);

  // Example output:
  // vendor:   "Google Inc. (NVIDIA)"
  // renderer: "ANGLE (NVIDIA, NVIDIA GeForce RTX 3050 Laptop GPU
  //            (0x000025A2) Direct3D11 vs_5_0 ps_5_0, D3D11)"

  return { vendor, renderer };
}

What Do the Renderer Strings Look Like?

The exact format depends on your GPU vendor and operating system. On Chromium-based browsers, strings are prefixed with ANGLE — Chrome's translation layer that wraps native graphics APIs. Here are real-world examples:

The renderer string often encodes the GPU's internal PCI device ID (e.g., 0x000025A2), which is specific to a particular GPU SKU. This makes the renderer string unique not just to a GPU family but often to a specific product line variant.

How Unique Is a WebGL Vendor Fingerprint?

The renderer string is one of the most stable fingerprinting signals available — it does not change between browser sessions, private windows, or even after a full OS reinstall as long as the same GPU and driver are in place. Its entropy is lower than a full canvas hash but its stability makes it more reliable for long-term re-identification.

Who Uses WebGL Vendor Fingerprinting in the Real World?

Fraud Detection Platforms

Security companies such as Fingerprint (formerly FingerprintJS) use the WebGL renderer string as a core device-identity signal. When a login attempt arrives from a device whose GPU fingerprint does not match any previous session for that account, it triggers a risk escalation. The signal is also used to detect credential-stuffing bots, which typically run in virtualized or headless environments where the renderer string returns a generic software rasteriser value rather than a real GPU name.

Ad-Tech and Cross-Site Tracking

Advertising networks combine the WebGL renderer string with canvas output, audio fingerprint, screen dimensions, and timezone to build a cross-site device identifier that survives cookie deletion. As third-party cookies have been deprecated across major browsers, WebGL vendor data has become a more important input to cookieless audience matching and frequency capping.

Bot and Automation Detection

Automated bots running in containerised or headless browser environments return anomalous renderer values — often Google SwiftShader (Chrome's software fallback renderer) or Mesa OffScreen. A real human device almost never returns these values in normal browsing. Anti-bot systems flag these renderer strings as high-confidence bot indicators, often without the user being aware any check has taken place.

Paywall Enforcement

Publishers that meter article access use the GPU renderer string alongside canvas and audio fingerprints to identify returning visitors who clear cookies to reset their article counter. Unlike a cookie, the renderer string cannot be deleted — it can only be hidden by a browser with active fingerprint protection.

Is WebGL Vendor Fingerprinting Legal?

Under the GDPR, any persistent identifier that can reasonably be linked to an individual — including a GPU renderer string used for re-identification — constitutes personal data processing. The French supervisory authority CNIL has explicitly listed browser fingerprinting as a technique requiring informed consent or a narrow legitimate-interest exemption. Under the US CCPA and CPRA, fingerprinting data is classified as personal information subject to opt-out rights.

The W3C Fingerprinting Guidance identifies the WEBGL_debug_renderer_info extension as a "high-fidelity fingerprinting vector" and notes that browser vendors are expected to restrict its availability in privacy-sensitive contexts. Several browser vendors have already acted on this guidance — see the protection section below.

How to Protect Yourself from WebGL Vendor Fingerprinting

• Brave Browser (recommended for daily use): Brave's built-in Farbling system randomises the WebGL renderer and vendor strings on a per-session, per-site basis. Each site receives a slightly different GPU description, making cross-site tracking by renderer string unreliable. No configuration is required.
• Firefox with privacy.resistFingerprinting: Setting this flag to true in about:config causes Firefox to return a generic, non-identifying renderer string instead of your real GPU data. Tor Browser enables this by default. Some WebGL-heavy applications (games, 3D design tools) may not function correctly with this enabled.
• Firefox webgl.enable-debug-renderer-info: false: A more targeted option in about:config that disables only the debug extension — the rest of WebGL continues to function normally. This blocks the direct vendor/renderer query while preserving compatibility with WebGL content.
• WebGL Fingerprint Defender extension: Available for both Chrome and Firefox, this extension intercepts the WEBGL_debug_renderer_info extension calls and returns a randomised or spoofed renderer string. Useful for users who need fingerprint protection without switching browsers.
• Tor Browser (strongest protection): Tor Browser normalises all WebGL output so every user returns identical renderer data, eliminating GPU-based identification entirely. The trade-off is slower speeds due to the Tor network overlay.
• Disable WebGL entirely: Setting webgl.disabled: true in Firefox or using a browser extension to block WebGL prevents all WebGL-based fingerprinting — but will break 3D web content including online games, maps, and data visualisations.

Note that a VPN has no effect on WebGL fingerprinting. Your GPU renderer string is read from local browser APIs, not from your network connection. Check whether your VPN is actually hiding your IP address (a separate concern) on whatsmy.fyi.

Frequently Asked Questions

What is the difference between WebGL vendor and WebGL renderer fingerprinting?

They are two aspects of the same technique. The vendor string (UNMASKED_VENDOR_WEBGL) identifies the GPU manufacturer — typically NVIDIA, AMD, Intel, Apple, or a translation layer like Google (ANGLE). The renderer string (UNMASKED_RENDERER_WEBGL) identifies the specific GPU model, graphics backend, and often the driver version. Both are read in the same API call; together they form the WebGL vendor fingerprint.

Does private browsing mode hide my WebGL renderer string?

No. Incognito and private mode prevent your browser from saving history and cookies, but they do not change the hardware your browser runs on. Your GPU's renderer string is identical in private mode and in a normal window. Only browsers with active fingerprint protection — Brave, Tor Browser, or Firefox with privacy.resistFingerprinting — return a different value.

Can I change my WebGL renderer string without changing my GPU?

Not reliably. You cannot modify the string your GPU driver reports to the OS, and the browser reads it from the driver. Browser extensions and privacy settings can intercept the API call and return a spoofed value to websites — but a sophisticated fingerprinting system may detect the spoofed value as anomalous (e.g., a renderer string that doesn't match any known GPU) and flag it as a privacy-protective device, which is itself a fingerprinting signal.

How is WebGL vendor fingerprinting different from canvas fingerprinting?

Canvas fingerprinting infers GPU differences indirectly — it draws an image and analyses pixel-level rendering variations caused by your hardware and software stack. WebGL vendor fingerprinting queries the GPU driver directly, reading explicit manufacturer and model strings. Canvas fingerprinting is more sensitive to software differences (fonts, OS text rendering); WebGL vendor fingerprinting is more directly tied to hardware identity. They are typically deployed together because they capture complementary dimensions of device uniqueness. See the canvas fingerprinting guide for a detailed comparison.

Does a VPN protect against WebGL vendor fingerprinting?

No. A VPN encrypts your traffic and masks your IP address, but it has no interaction with your browser's graphics API. Your GPU renderer string is read from local hardware — not from your network — and a VPN cannot change it. WebGL vendor fingerprinting works identically whether you are connected through a VPN, a proxy, or a direct connection.

What renderer string does a headless browser return?

Headless browsers and automated test environments that lack a real GPU typically return the software fallback renderer: Google SwiftShader in Chromium or Mesa OffScreen in Firefox. Real user devices almost never return these values in normal browsing. Anti-bot systems treat them as high-confidence bot indicators. Some automation frameworks attempt to spoof the renderer string to avoid detection, but the spoofed value often fails consistency checks against other WebGL parameters.

Is WebGL vendor fingerprinting related to the DrawNApart technique?

They are related but distinct. DrawNApart (arXiv 2022) is a more advanced GPU fingerprinting technique that identifies devices from micro-timing variations in GPU execution speed — measurable using unprivileged JavaScript. WebGL vendor fingerprinting simply reads the driver strings. DrawNApart can distinguish between two machines with identical GPU models because individual GPU execution units vary slightly in speed; standard vendor fingerprinting cannot make that distinction. Commercial fingerprinting platforms may combine both approaches.

Related Articles

• What Is WebGL Fingerprinting? How Your GPU Identifies Your Browser — the broader guide to WebGL as a fingerprinting surface, including pixel hash techniques
• What Is Canvas Fingerprinting? How Websites Track You Without Cookies — how 2D canvas rendering differences complement WebGL vendor data
• What Is Browser Fingerprinting? How Sites Track You Without Cookies — the complete guide to all fingerprinting signals combined
• What Is Audio Fingerprinting? How AudioContext Tracks Your Browser — how your device's audio stack produces a persistent identifier alongside WebGL