Does Tor Browser stop fingerprinting? Partly. Tor Browser blocks some of the most common fingerprinting techniques by default, including canvas and WebGL reads, but it does not make a device invisible. Understanding canvas and font fingerprinting helps explain why "using Tor" and "being untrackable" are not the same thing.
What browser fingerprinting actually is
A browser fingerprint is a set of small technical details that, combined, can identify a specific device or browser setup without using a cookie. Screen size, installed fonts, graphics card behavior, and timing quirks all leak tiny signals.
No single detail is usually enough. The problem is combination: enough small, unique-looking signals together can single out one visitor among millions, even with no cookies stored at all.
Canvas fingerprinting, the quiet workhorse
The HTML5 Canvas element lets a website draw shapes, text, and colors invisibly in the background, then read back the resulting image data. A site asks the browser to render some text or graphics, extracts the pixel output, and hashes it.
Because video cards, font packs, and graphics libraries all render slightly differently, that hash often ends up unique to a given machine. Research has pointed to canvas reads as one of the largest fingerprinting threats browsers face, precisely because it needs no stored data and works silently.
This is also why it became popular with ad networks: it sidesteps the cookie rules many websites now have to follow, since nothing is written to the user's device at all.
Font fingerprinting: a quieter cousin
Fonts add another layer. The exact set of fonts installed and subtle differences in how each one is rendered can vary enough between devices to help build a fingerprint, especially when combined with canvas output.
A related technique called getClientRects asks the browser how a specific element was drawn on screen: its exact pixel position and size. That output shifts depending on screen resolution, font configuration, and other local factors, making it a fast, low-effort fingerprinting signal in its own right.
What Tor Browser actually blocks
Tor Browser's design goal is to make as many users as possible look alike, which is the opposite of what a fingerprint needs. According to the Tor Project, several specific defenses are built in:
- Default fallback fonts are used across installs to reduce the font differences a tracker can read.
- The Canvas API and WebGL are blocked by default, so a site cannot silently extract a rendered image to hash.
- Timing functions such as performance.now have been modified to blunt the kind of micro-timing attacks that can assist fingerprinting.
These changes are not cosmetic. They target the exact mechanisms described above and reflect years of dedicated work by the Tor Project on fingerprinting resistance.
Where the gaps remain
Tor Browser is not a perfect shield. When a site attempts a canvas read, Tor Browser shows a prompt asking whether to allow it. But the browser cannot reliably tell a legitimate use of canvas from a fingerprinting attempt, so that prompt is not proof a site is behaving safely either way.
getClientRects is a known open gap. Unlike canvas reads, it has not been blocked or restricted the same way, and researchers have flagged it as one of the more practical fingerprinting vectors still available inside Tor Browser.
It is also worth remembering that fingerprinting defenses only address one layer of the problem. Tor routes traffic through multiple relays, but Tor alone does not make any single action anonymous. Logging into a personal account, downloading and opening a file outside the browser, or reusing a username across sessions can undo the protection no amount of fingerprinting resistance can fix.
A note on search engines and fingerprinting claims
Fingerprinting debates are not limited to ad networks. DuckDuckGo, for example, has been flagged by some privacy extensions for using browser APIs like getBoundingClientRect, which can double as a fingerprinting signal. DuckDuckGo states this use is for legitimate layout purposes, such as detecting browser window size, not for tracking.
The honest takeaway is not that any one tool is secretly hostile. It is that fingerprinting-adjacent APIs are everywhere in modern web code, used for both ordinary and tracking purposes, and it is genuinely hard for an outside observer to tell the two apart without digging into the source.
Practical steps that actually help
Most of what keeps Tor Browser's fingerprinting defenses working comes down to leaving it alone:
- Do not install extra browser extensions, as each one adds a new, often unique signal.
- Do not resize or maximize the window beyond its default state, since window dimensions are themselves a fingerprinting input.
- Leave the security level at its default unless you understand the tradeoffs of changing it.
- Keep Tor Browser updated through the Tor Project's own release channel, since fingerprinting defenses change as new techniques are discovered.
If you need an onion address for a service you already trust, get it directly from that organization's official surface-web site rather than from a general-purpose link list. Be cautious with so-called "Hidden Wiki" style directories: there is no single trustworthy version of that name anymore, and most copies in circulation mix outdated, fake, or outright scam links with little or no verification.
What this means for everyday use
Canvas and font fingerprinting are real, well-documented threats, and Tor Browser's default settings directly target the two biggest pieces of that puzzle. That is a meaningful improvement over an ordinary browser doing nothing about it.
But "stops fingerprinting" is too strong a claim for any single tool. Gaps like getClientRects remain, and behavior inside the browser still matters as much as the software itself. Treat Tor Browser as a strong baseline, not a finish line.