Helium browser dev recommends per-site exceptions while working to fix Cloudflare Turnstile clash

The developer behind the Helium browser, who goes by Wukko, is working on a fix after users noticed that one of its anti-tracking settings is causing Cloudflare Turnstile checks to fail.

The issue came up on X when a user pointed out that Cloudflare’s human verification boxes refuse to pass whenever Helium’s canvas pixel noising feature is turned on. They even shared a screenshot of the browser’s experimental flags showing they had to shut off the #helium-noise-canvas flag just to get through a security prompt.

If you’ve ever clicked one of those little Cloudflare checkboxes to show you’re not a bot, only to watch it spin endlessly, you’ll know exactly the frustration we mean.

Under the hood, the canvas pixel noising flag works by “[adding] insignificant noise to canvas pixels during readback to deceive canvas-based fingerprinting”. Basically, websites often try to track you across the web by drawing a hidden image in the background and seeing how your computer’s specific hardware renders it.

Helium slightly alters pixels to prevent trackers from building a unique profile, aligning with its privacy focus and last month’s v0.19.4 update with private vault improvements. But strict bot detectors like Cloudflare use those details to verify normal browsers, so altered pixels can look suspicious.

Responding in the thread on X, dev noted, “I’m working on improving noise consistency, will hopefully fix it for you.” Making the randomized noise stay consistent during a browsing session usually keeps anti-bot scripts happy without giving up your real hardware identity.

That said, they didn’t share any ETA for this fix. Until that patch arrives, you do not have to turn off the experimental flag globally as the original poster did. Wukko pointed out that “you can disable fingerprinting protection in site settings only for the affected website, no need to disable it everywhere.”

Meanwhile, other users in the replies suggested that Helium should eventually add a built-in exception list for problematic sites, much like Firefox and Brave do.

We stand out from the tech-media crowd because we break news stories; we mainly bring you stuff that you won’t find anywhere in the mainstream tech media. Our stories have been picked up by some of the world’s most popular websites and media outlets—more info is available here.