WebGL Fingerprinting Explained

What WebGL exposes

WebGL is the browser API for hardware-accelerated 3D graphics. To let developers work around hardware quirks, it can report details about the graphics stack: a vendor string, a renderer string, the WebGL version, the shading-language version, supported extensions, and numeric limits like maximum texture size. The most revealing values come from the WEBGL_debug_renderer_info extension, which returns the unmasked vendor and renderer — often naming the exact GPU model and driver, such as a specific integrated or discrete graphics chip.

Why hardware strings are durable identifiers

Most fingerprint signals describe software, which changes with updates. A GPU string describes hardware. It stays identical across browsing sessions, across cleared cookies, often across browser reinstalls, and until you physically change machines. That durability is what makes WebGL information valuable in a combined fingerprint: it anchors the profile to the device itself.

Extension lists and capability limits add further detail. Two machines with the same GPU can still differ in driver version and enabled extensions, and the combination narrows the matching set further.

What this site's test does

The analyzer opens a WebGL context, reads the vendor and renderer (unmasked when the browser allows it), the version strings, the maximum texture size, and the supported extension list, then hashes those parameters locally with SHA-256. The result card tells you whether your browser exposed the real renderer string or a masked generic one, because that difference determines the rating: an unmasked GPU string rates Higher distinguishing power; a masked one rates Moderate.

Masking and its trade-offs

Browser vendors have been narrowing this surface. Some browsers return generic strings such as a standardized ANGLE identifier instead of the raw GPU name; Firefox's resist-fingerprinting mode and Tor Browser mask renderer details; Brave randomizes parts of WebGL output per site. The trade-off is diagnostic: some 3D-heavy sites use renderer strings to pick code paths, and masking occasionally degrades that. For most everyday browsing, masking costs nothing noticeable.

Checking your own exposure

Run the analyzer and read the WebGL card. If it shows a specific GPU model, any page you visit can read the same string silently. If you then enable a masking option in your browser and use Run again and compare, you can confirm whether the reported renderer actually changed. Note that a VPN will not change this value at all — it describes your device, not your connection.