Duplicate URLs are inevitable: tracking parameters (`?utm_source=...`), filter combinations (`/products?color=blue&size=md`), pagination, www vs non-www, and HTTP vs HTTPS all generate variants of the same content. Without a canonical tag, search engines have to guess which version to rank — and they may split ranking signals across all variants.
The canonical points to the version you want indexed. Every variant of a page should either declare itself canonical (`<link rel='canonical' href='https://example.com/page'>`) or point to the canonical URL of the master version.
The most common canonical mistake is cross-domain canonicals to a third-party site (e.g. medium.com → yourdomain.com). This is the right move when you republish content, but doing it accidentally hands ranking authority to someone else.