Static local string encryption with printable recovery codes.
Canvas display reduces casual DOM exposure. It does not protect against a compromised browser, OS, extension, screenshot, screen recorder, or keylogger.