Use html2canvas with useCORS: true only when every external image permits your origin with CORS. Add crossorigin="anonymous" before each image starts loading, and make the image server return a matching Access-Control-Allow-Origin header. If you cannot change that server, relay the images through a same-origin proxy. Otherwise the browser may taint the canvas, and exporting with toDataURL(), toBlob() or getImageData() fails with a SecurityError.
Why a visible image can still be impossible to export
Browsers distinguish between displaying pixels and allowing script to read those pixels. An image from another origin can appear inside your div, yet drawing it into a canvas without CORS approval makes that canvas tainted. Once tainted, pixel-read operations and image export are blocked by the browser’s same-origin security model.
The permission is two-sided: the request must be made in CORS mode, and the image response must opt in. Setting only one side is insufficient. Client-side JavaScript cannot add permission after the remote server has declined it.
The working html2canvas pattern
This example captures a div containing a remote image and downloads a PNG. Replace the image URL with one whose server sends an appropriate CORS header.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
<img id="remote-photo"
crossorigin="anonymous"
src="https://cdn.example.com/photo.jpg"
alt="">
<div id="capture">
<h1>Product preview</h1>
<img crossorigin="anonymous"
src="https://cdn.example.com/photo.jpg"
alt="Product photo"
width="640">
</div>
<script type="module">
import html2canvas from "html2canvas";
const element = document.querySelector('#capture');
const canvas = await html2canvas(element, {
useCORS: true,
allowTaint: false
});
const link = document.createElement('a');
link.download = 'capture.png';
link.href = canvas.toDataURL('image/png');
link.click();
</script>Set crossorigin before assigning src. If the browser has already begun a non-CORS request, adding the attribute later does not repair that request. Keep allowTaint: false when you need an export; allowing taint does not make unreadable pixels readable.
Install html2canvas
With npm, install the package and bundle the module in your application:
npm install html2canvasIn a plain browser page, use the distribution build provided by your bundler or a locally hosted copy. The capture call is the same.
Configure the image server correctly
The host serving each image must return an Access-Control-Allow-Origin value that permits the page’s origin. For anonymous, non-credentialed requests, a wildcard (*) can be suitable, or the server can return your exact origin. The header must be present on the actual image response, including redirects and CDN variants.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteFor example, a page at https://app.example needs the image response to allow that origin. If the image host uses cookies or other credentials, anonymous mode is not the right configuration; arrange an appropriate credentialed CORS policy or proxy the asset instead.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
- Send
crossorigin="anonymous"on every relevant<img>beforesrcis set. - Return a compatible
Access-Control-Allow-Originheader from the image server. - Apply the policy to resized, optimized and redirected image URLs, not only the original path.
- Check CSS
background-imageURLs and images inside SVG files; one unapproved resource can contaminate the result.
Wait for all images before capturing
Calling html2canvas while images are still loading can produce missing content or make failures difficult to diagnose. Wait for every image in the target element, including images that were added dynamically.
async function waitForImages(root) {
const images = [...root.querySelectorAll('img')];
await Promise.all(images.map(img => {
if (img.complete) {
return img.naturalWidth > 0
? Promise.resolve()
: Promise.reject(new Error(`Image failed: ${img.src}`));
}
return new Promise((resolve, reject) => {
img.addEventListener('load', resolve, { once: true });
img.addEventListener('error', () => reject(new Error(`Image failed: ${img.src}`)), { once: true });
});
}));
}
const target = document.querySelector('#capture');
await waitForImages(target);
const canvas = await html2canvas(target, {
useCORS: true,
allowTaint: false
});
canvas.toBlob(blob => {
if (!blob) throw new Error('Canvas export returned no data');
const url = URL.createObjectURL(blob);
const a = document.createElement('a');
a.href = url;
a.download = 'capture.png';
a.click();
URL.revokeObjectURL(url);
}, 'image/png');Handle a rejected image explicitly in production. You can show an error, remove that image from the capture, or switch to a proxied URL; silently continuing often creates a screenshot that looks complete but is missing artwork.
When you do not control the image host: use a same-origin proxy
If the remote server does not grant CORS access, the reliable browser-side fallback is to fetch the image on your server and expose it from the same origin as the page. Your page then points the img element at your proxy URL, and html2canvas captures that same-origin response.
Free tools Windows power users keep installed
One-click scans. No signup required.
A proxy must be deliberately constrained. Accept only approved hosts or signed asset identifiers, impose response-size and timeout limits, validate content types, and cache safely. Otherwise it can become an open proxy or server-side request-forgery endpoint.
// Illustrative Express endpoint (Node 18+)
import express from 'express';
const app = express();
const allowedHosts = new Set(['cdn.example.com']);
app.get('/image-proxy', async (req, res) => {
const source = new URL(String(req.query.url || ''));
if (source.protocol !== 'https:' || !allowedHosts.has(source.hostname)) {
return res.status(400).send('Image host is not allowed');
}
const upstream = await fetch(source, { signal: AbortSignal.timeout(15000) });
if (!upstream.ok) return res.status(502).send('Upstream image failed');
const type = upstream.headers.get('content-type') || '';
if (!type.startsWith('image/')) return res.status(415).send('Not an image');
res.set('Cache-Control', 'public, max-age=3600');
res.type(type);
res.send(Buffer.from(await upstream.arrayBuffer()));
});
app.listen(3000);Use the endpoint in the page, and still wait for it to load:
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
<img src="/image-proxy?url=https%3A%2F%2Fcdn.example.com%2Fphoto.jpg"
alt="Product photo">Do not expect allowTaint: true, a custom request header from browser JavaScript, or a second toDataURL() attempt to bypass the policy. None changes the origin of the bitmap.
Choosing the right capture method
| Situation | Recommended path | Reason |
|---|---|---|
| You control the image server | crossorigin="anonymous" plus server CORS and useCORS: true |
Preserves a client-only workflow while keeping the canvas origin-clean |
| You do not control the image server | Same-origin proxy | The proxy supplies a URL your page is allowed to read |
| You need exact browser pixels | Native browser or extension screenshot API | html2canvas reconstructs the DOM and is not guaranteed to match rendered pixels exactly |
| You need a downloadable PNG | Export only after all resources are CORS-readable | toDataURL() and toBlob() require an origin-clean canvas |
html2canvas fidelity and layout limits
html2canvas rebuilds the target from the DOM, styles and resources rather than taking the browser’s compositor output. Complex filters, video, plug-ins, unsupported CSS and timing-sensitive animations can differ from what a user sees. Freeze animations, set a stable viewport, and capture after fonts and images have loaded when visual consistency matters.
If the requirement is a literal browser screenshot—including cross-origin content exactly as painted—use a native browser automation or extension capture API instead of relying on DOM reconstruction. That approach still needs to respect authentication and access controls.
Troubleshooting common failures
“Tainted canvases may not be exported” or a SecurityError
At least one bitmap was loaded without usable CORS permission. Inspect every image, CSS background and nested SVG resource. Confirm that crossorigin was present before src, then inspect the image response for Access-Control-Allow-Origin. Proxy the resource if the header cannot be added.
The image is visible in the page but missing from the capture
With allowTaint: false, html2canvas may skip a resource that would taint the canvas. Verify the URL, response status, CORS header and image load state. Wait for load and check naturalWidth before capture.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Only some images fail
CORS is evaluated per request. A CDN transformation, redirect, CSS background or image inside an SVG may use a different URL or header. Compare each request in browser developer tools and make the policy consistent across all variants.
The proxy returns an error or hangs
Check allowlisted hosts, HTTPS validation, upstream status, content type, timeout and maximum response size. Log the upstream URL and status server-side without exposing secrets. Add caching only after the endpoint is protected against arbitrary destinations.
The result looks different from the page
That is expected when DOM reconstruction cannot reproduce a browser feature. Disable animations, wait for fonts and lazy images, specify dimensions, and use a native capture API when pixel fidelity is non-negotiable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Performance, reliability and security considerations
- Large pages: capture only the required element, avoid unnecessarily huge dimensions, and consider memory limits when exporting PNG.
- Lazy images: scroll or otherwise trigger loading before capture; confirm that each image has completed.
- Repeated captures: cache proxied assets and avoid recapturing unchanged content.
- Failure handling: treat image errors, timeouts and empty canvases as explicit failures rather than returning a misleading file.
- Proxy safety: restrict destinations, enforce limits and authenticate private assets. Never accept an unrestricted URL parameter in a public endpoint.
- Privacy: a proxy sees the assets it fetches. Apply retention and access controls appropriate to the captured content.
Or skip the browser setup
ScreenshotNeo provides a website screenshot API when you want a rendered page without configuring html2canvas, CORS attributes or a proxy. It accepts consent banners before capture and removes more than 60 known consent platforms, newsletter popups and chat widgets; each step can be disabled. Bot checks, CAPTCHAs, blank pages, timeouts, failed loads and cache hits are not billed, and the response identifies the result with X-Page-Verdict and X-Billed headers. Its MCP server lets Claude, Cursor and other MCP clients call take_screenshot, get_page_info and capture_pdf.
For a one-call capture, see the ScreenshotNeo API documentation:
Recommended Free Tools
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpimport requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://stripe.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://stripe.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);The Free plan includes 1,000 screenshots each month with no card. Paid plans start at $5 for 3,000 screenshots; every feature is available on every plan. Create a free ScreenshotNeo account to get started.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Frequently Asked Questions
Can I fix a tainted canvas by changing JavaScript headers?
No. Permission must come from the image response. Use a matching CORS policy on the image host or serve the asset through a controlled same-origin proxy.
Does adding crossorigin after the image appears help?
No. Set it before src is assigned so the initial request uses CORS mode.
Will a wildcard CORS header work with cookies?
Anonymous, non-credentialed requests can use a wildcard where appropriate. Credentialed requests require a credential-compatible policy, so configure that explicitly or proxy the asset.
Why does html2canvas differ from a screenshot taken by the browser?
html2canvas reconstructs the DOM rather than reading the compositor’s final pixels. Unsupported CSS, filters, video and timing can therefore produce differences.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
