Bot Arena
Selector resistance · Level 1 View on report ↗

Canvas-rendered login

The form is drawn on a canvas. There is no DOM to query.

What's measured on this page
- The login form is drawn on a <canvas> element. There is no <form>, no <input>, no <button> — just one rectangular pixel buffer. - Email, Password, and Sign in are painted strings inside the canvas. They do not exist in the DOM, the accessibility tree, or the layout tree. - A selector-driven automation tool finds nothing to interact with. page.getByLabel('Email'), getByRole('textbox'), and getByText('Sign in') all return empty locators. - The page captures real click events on the canvas and translates pixel coordinates to virtual form fields. Real keydown events feed the focused field. - An image-aware automation tool (or a human) sees the form, clicks where the email box looks like it is, types, clicks submit. The pixels work; the DOM doesn't matter.

Click on a field, then type. Click "Sign in" to submit. There are no DOM elements here — only pixels.

Production apps using this technique

  • Figma The entire editing surface is a WebGL canvas — layers, frames, text, vector nodes are not in the DOM. Plugins use Figma's own API; outside automation has only pixels.
    Market ~65% of UI/UX design tools Users ~4M daily, 200M+ accounts
  • Google Docs / Sheets / Slides Switched to canvas-based rendering for the document and sheet body in 2021 ("annotated canvas"). The toolbar is DOM; everything below it is not.
    Market Workspace ~50% of office suites Users 3B+ Workspace users; ~750M paid seats
  • Miro / FigJam / Lucidchart / tldraw / Excalidraw Collaborative whiteboards render every sticky note, arrow, and shape into a canvas. Selectors find one <canvas> element no matter how many objects are on the board.
    Market ~90% of online whiteboarding (Miro lead) Users Miro 90M+, Lucid 70M+, Excalidraw 17M+, FigJam ships with Figma
  • Citrix Workspace / Apache Guacamole / noVNC Remote-desktop and VDI clients stream the whole remote screen — including the login prompt — as a single canvas. Real-world example of a "canvas-only login".
    Market Citrix ~70% of enterprise VDI Users ~100M Citrix end users across 400K customer orgs
  • TradingView and similar charting platforms Chart prices, candles, drawing tools all live on canvas. Reading "is the 200-day MA above price?" from the DOM is impossible.
    Market Dominant retail trading charts; embedded by every major broker Users 90M+ monthly users (company disclosure 2024)
  • Photopea, Unity / Godot / Phaser WebGL builds Image editors and browser games run their entire UI inside one canvas. Menu items, buttons, dialogs — none of it exists outside.
    Market Unity ~70% of mobile game engines Users Unity 1.5M+ monthly creators; Photopea ~10M MAU
  • Anti-keylogger banking keypads Several banks (notably across India, Brazil, parts of EU) render the numeric PIN pad on a canvas with shuffled digit positions every page load — defeats both keyloggers and selector-based scrapers.
    Market Standard on most BR + IN retail-bank logins Users Hundreds of millions of online banking customers (Itaú, Bradesco, HDFC, SBI, ICICI…)

Figures are approximate / company-disclosed (~2024–2025). Sources: company filings, industry reports (Gartner, IDC, BuiltWith, npm stats), and public DAU disclosures.