# CanvasBlocker Firefox Extension: Fingerprint Protection Modes

> CanvasBlocker is a Firefox extension that blocks or falsifies fingerprinting-related JavaScript APIs, with separate controls for canvas, WebGL, audio, history, screen, and other browser interfaces. Its flexibility comes with a compatibility cost, because blocking an API can break websites and overlapping protections can cause severe performance problems.

**kkapsner/CanvasBlocker** — A Firefox extension to protect from being fingerprinted.

- Repository: https://github.com/kkapsner/CanvasBlocker
- Website: https://canvasblocker.kkapsner.de
- Stars: 1,528 · Forks: 95
- Language: JavaScript
- License: MPL-2.0
- Published: 2026-10-16 · Updated: 2026-10-16 · Language: en
- Canonical page: https://hysenlabs.com/projects/kkapsner-canvasblocker

## What CanvasBlocker Changes in Firefox

CanvasBlocker addresses browser fingerprinting, which occurs when websites collect values from browser APIs and combine them into a device or browser identifier. The extension targets canvas 2d, WebGL, audio, history, window, DOMRect, SVG, TextMetrics, navigator, and screen. Canvas is not the only surface covered. That distinction matters because a site can derive fingerprinting signals from graphics output, audio processing, screen dimensions, geometry, font measurements, or browser properties.

The extension is intended for Firefox users who want control over those API results. It can prevent a protected API from operating, or it can preserve access while changing values so that the returned fingerprint is not stable enough for consistent identification. CanvasBlocker does not describe itself as a general browser lockdown tool. Its scope is JavaScript APIs associated with fingerprinting, and each interface has its own protection setting.

Window and navigator protection are disabled by default. Their inclusion does not mean every installation changes them immediately. The default configuration leaves those two surfaces untouched unless the user enables them, which reduces the chance of breaking common site functionality at installation time.

## Fake, Permission, and List-Based Modes

The default mode is `fake`. Under this policy, sites outside the configured lists can continue calling protected APIs, but CanvasBlocker alters the values returned by fingerprinting-friendly readouts. This is a compatibility compromise. A page can execute the relevant code without receiving the same native signal, while the value it receives is no longer useful as a consistent fingerprint.

`ask for permission` moves the decision to the user. When an unlisted site calls a protected API, Firefox asks whether that site may use it. This mode gives direct control over individual sites, but it can create repeated prompts and interrupts normal browsing. The README does not document a way to suppress these prompts or configure a timeout, so the operational cost of that mode cannot be evaluated further from the available documentation.

The remaining modes impose broader rules. `block everything` ignores both lists and blocks protected APIs everywhere. `allow only white list` permits listed sites and excludes all others. `block only black list` reverses that emphasis by blocking selected sites while allowing other sites. `allow everything` ignores the lists and permits native API use. These modes are useful when the desired policy is simple, but a global block can directly break sites that depend on canvas, WebGL, audio, screen data, or another protected interface.

## Why Firefox Fingerprint Protection Can Conflict

CanvasBlocker's most important warning concerns overlapping defenses. The README says that users should have only one add-on or setting protecting an API, citing the possibility of massive performance issues. It specifically mentions Palemoon's EclipsedMoon `canvas.poison` setting as an example associated with a known issue. This is not a generic recommendation to use one privacy extension. It is a warning against applying multiple modifications to the same JavaScript surface.

The README distinguishes overlapping add-on behavior from Firefox's built-in mechanisms. It states that setting `privacy.resistFingerprinting` to `true`, using the fingerprinting protection introduced with Firefox 67, or using both is fine. That means CanvasBlocker can coexist with those named Firefox protections according to the project documentation. It does not mean CanvasBlocker can safely be combined with every add-on that touches canvas or another protected API.

This distinction is important for adoption. A user may already have browser-level anti-fingerprinting enabled and may still install CanvasBlocker without violating the warning. A user with a second canvas modification add-on is in a different situation. The project does not provide a compatibility matrix, so identifying conflicts requires reviewing the settings of other installed add-ons rather than relying on a documented compatibility list.

## Installing CanvasBlocker and Starting With Fake Mode

The README points users to the CanvasBlocker website and separately lists a beta versions directory, but it does not provide installation commands, package steps, or a first-use configuration example. The repository contains `package.json`, `manifest.json`, and `package-lock.json`, yet `package.json` has no scripts. Based on those files, the repository does not document a source-build command that can be copied into a tutorial without guessing.

For an end user, the documented starting point is therefore the project's website at `https://canvasblocker.kkapsner.de`. The README says that beta versions are available at `https://canvasblocker.kkapsner.de/versions/`; it does not say that beta releases are the recommended installation path or explain how to install a downloaded file in Firefox.

A practical first use should begin with the default `fake` mode rather than `block everything`. After installing the extension through the project's published distribution channel, open its options and confirm that `fake` remains selected for the APIs the user wants to protect. `window` and `navigator` should also remain disabled unless the user intends to change them. The README documents no Firefox menu path for opening the options page, so the article does not invent one.

## Website Compatibility and API Failure Modes

Canvas protection is the most obvious compatibility concern, but it is not the only one. CanvasBlocker also covers WebGL, audio, history, DOMRect, SVG, TextMetrics, navigator, and screen. A website can use any of these APIs for normal behavior, so a strict policy can remove functionality unrelated to fingerprint collection. Web-dependent games and graphics applications may be sensitive to WebGL changes. Drawing and export tools may depend on canvas output. Audio applications may call audio interfaces during initialization or playback.

The failure modes differ by mode. In `fake` mode, an API may remain callable while returning altered values. That can produce incorrect measurements or behavior in applications that expect native browser output. In `block everything`, code may receive no usable API result at all. That is more likely to expose code paths written without graceful handling, although the README does not document the exact exceptions or error values supplied for each API.

Per-site lists reduce the scope of these consequences. A whitelist supports sites known to need an API, while a blacklist isolates sites that should have it blocked. The README does not document automatic list updates, wildcard syntax, import formats, or a recommended list policy. Users therefore need to choose their own site categories rather than relying on documented presets.

## CanvasBlocker Compared With Browser-Level Fingerprint Protection

The closest documented alternative is Firefox's built-in fingerprinting protection. The README explicitly allows `privacy.resistFingerprinting` and the protection introduced with Firefox 67 to be used with CanvasBlocker, but it does not present a detailed feature comparison. The practical difference is control. Firefox provides a browser-level defense, while CanvasBlocker exposes separate policies for named APIs and can ask for permission or apply whitelist and blacklist rules.

A user who wants one browser-wide policy and little extension configuration may prefer Firefox's built-in mechanism. A user who needs to preserve API calls while changing their values, or who wants site-specific rules, has more control in CanvasBlocker. That extra control also creates more configuration and troubleshooting work. The project documentation does not state how closely its falsified values match Firefox's protections, and it provides no measurements of breakage or performance under either arrangement.

Another alternative is an add-on that poisons or otherwise modifies canvas. CanvasBlocker's warning shows why this is not automatically a better choice: two tools modifying the same API can create major performance issues. The difference is therefore not simply feature count. It is whether the user needs CanvasBlocker's six policies and per-API controls enough to accept that configuration burden.

## Maintenance, Releases, and MPL-2.0 Changes

The repository is not archived, and its last push was on 2026-09-07. That is recent activity, but it does not by itself define the cost of upgrading. The recent release history lists version 1.12 on 2026-02-13, version 1.11 on 2025-01-15, and version 1.10.1 on 2024-04-16. These dates show that releases have occurred across several years, but the README does not describe migration steps, breaking changes, automatic update behavior, or compatibility requirements for Firefox versions.

The repository's `package.json` reports version `0.5.15`, while the release history separately names released versions 1.12, 1.11, and 1.10.1. The available files do not explain that discrepancy, so it should not be treated as evidence of either the installed extension version or the versioning scheme used for releases.

CanvasBlocker is licensed under MPL-2.0, as stated in both `package.json` and `LICENSE.txt`. The repository also accepts translation contributions, with the README directing contributors to issue 420 for instructions. MPL-2.0 governs use and modification of covered files, but this review does not provide legal advice. Organizations should inspect the license and their own distribution practices before modifying or redistributing the extension.

## Conclusion

CanvasBlocker is appropriate for Firefox users who want site-specific control over JavaScript fingerprinting surfaces and can accept occasional compatibility problems. It is less suitable for users who need every protected API to retain its native behavior, or who already use another add-on that modifies the same APIs. Before adopting it, check the mode selected for each protected API, review the whitelist and blacklist, and disable overlapping fingerprint protection first.

## FAQ

### What does CanvasBlocker protect against?

CanvasBlocker alters or blocks JavaScript APIs commonly used to create browser fingerprints. Its documented coverage includes canvas 2d, WebGL, audio, history, window, DOMRect, SVG, TextMetrics, navigator, and screen.

### Will CanvasBlocker break websites?

It can. The README says that blocking APIs entirely may break some websites, while the default `fake` mode preserves access but changes fingerprinting-friendly values.

### Can CanvasBlocker be used with Firefox fingerprinting protection?

The README says that setting `privacy.resistFingerprinting` to `true` and using the fingerprinting protection introduced with Firefox 67 are compatible with CanvasBlocker. It warns against combining multiple add-ons or settings that protect the same API.

## Sources

- [kkapsner/CanvasBlocker on GitHub](https://github.com/kkapsner/CanvasBlocker)
- [License: MPL-2.0](https://github.com/kkapsner/CanvasBlocker/blob/master/LICENSE)
- [Project website](https://canvasblocker.kkapsner.de)
- [README](https://github.com/kkapsner/CanvasBlocker/blob/master/README.md)
- [Releases](https://github.com/kkapsner/CanvasBlocker/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/kkapsner-canvasblocker