Font Fingerprinting: Your Installed Fonts Give You Away

Your font list took years to assemble. The operating system put a few hundred fonts there, Office added its own, Adobe added more with every app, and the display font you installed for one project in 2021 never left. Any website can read the result in a few hundred milliseconds, without a permission prompt, and the more that list has grown, the smaller the chance anyone else’s matches it.

Browsers have never given websites a way to simply ask for the font list, precisely because it is so identifying. That turned out not to matter. A script can measure fonts instead of asking for them, using nothing more than an invisible line of text and two width readings. The widget on this page runs that measurement against 175 candidate fonts and shows you what your browser hands over, plus how common your particular set is among everyone who has run the scan.

How font fingerprinting works: the measuring trick

Here is the entire technique. The script creates an invisible <span> containing a nonsense string, mmmmmmmmmmlli, at 72 pixels, and asks the browser how wide it came out in a generic family like monospace. Then it sets the family to "Segoe UI", monospace and reads the width again. If Segoe UI is installed, the browser renders it and the width moves. If it isn’t, the fallback kicks in and the number stays put. One candidate font, two width readings, no API involved.

The string is not random, either: m’s and l’s are the widest and narrowest lowercase letters in most typefaces, so substituting one font for another shifts the total width as far as possible. Watch it happen on your own machine:

There are tidier ways to get the same answer. document.fonts.check() hands it back as a boolean in one call — in Chromium browsers, thanks to a quirk that violates the spec; Firefox and Safari answer true for any font you name — and measuring text on a canvas avoids touching the DOM at all. The web platform does have exactly one polite API in this area, queryLocalFonts(), which returns real font names and even the font files — after the user approves a permission prompt. No tracker has ever shown you that prompt.

The whole family of techniques goes by the name font enumeration, and trackers are not its only customers. Anti-fraud and bot-detection systems run the same probe to check that a device is what it claims to be, which is why the result follows you into places a mere advertiser never could: payment flows, login risk scoring, account reviews.

What your installed fonts reveal

What makes the list valuable is not its length but what each entry admits. Fonts arrive on your machine as side effects of everything else you install. Segoe UI means Windows. Helvetica Neue means Apple. DejaVu Sans means Linux. Bahnschrift narrows Windows down to 10 or later, and Segoe UI Variable says 11. Minion Pro or Myriad Pro means Adobe software has been on this machine. A Windows install set up for Chinese carries fonts a US one has no reason to have. Your fonts are a record of what you run and roughly when you set it up:

This is the same class of leak we covered in One Browser, Five OS Claims: the labels a browser reports are editable, but the machine behind them keeps acting like itself. A spoofed macOS User-Agent sitting on a font list full of Segoe and Calibri is a contradiction any script can spot in milliseconds.

In the EFF’s Panopticlick study, the font list — collected back then through Flash and Java — carried 13.9 bits of identifying information, more than any other browser fingerprinting signal measured except the plugin list. Browsers have since neutered plugins — navigator.plugins reports the same short PDF-viewer list (or nothing at all) everywhere — while fonts remain exactly as measurable as they were in 2010. The list also leaks twice: once as a list, and once through canvas fingerprinting, where the fonts available to the renderer help decide the exact pixels a canvas draw produces.

And the list is patient. It does not change when you clear cookies, does not change in an incognito window, and could not care less about your VPN. It changes when you install or remove software, which for most people is a few times a year. As tracking identifiers go, that is a long shelf life.

Can you prevent font fingerprinting? The blocking trap

There are extensions that promise to stop the measurement, either by blocking the probes or by feeding them noise. The problem is the one that catches half-spoofs everywhere on this site: the defense is rarer than the thing it hides.

A desktop Chrome on Windows that reports nothing but a handful of web-safe fonts is not anonymous; it is peculiar, and peculiar is what fingerprinting lives on. Randomizers are worse. A real font list is stable for months, so a list that mutates between visits marks you as one of the few people running that exact extension. And the extensions that fake the numbers do it by overriding the very functions a page uses to measure. That manufactures a second problem: an overridden built-in stops reporting [native code] when inspected, the same tell that gives away stealth plugins.

Browsers that defend against this seriously do it whole. Tor Browser bundles its own fonts and restricts websites to that fixed list, so every Tor user presents roughly the same short set. It works, and it tells every site you run Tor. Brave farbles instead: per site and per session it shows trackers your OS fonts plus a random selection of the fonts you have installed, so the list a tracker collects today quietly disagrees with tomorrow’s without ever looking impossible. Both approaches work because the whole browser was built around them, rather than a patch fighting the browser it sits inside.

What to actually do

1. Look at your own list first. The widget on this page has already measured your browser. Expand the font list to see what any website sees, and check how common your exact set is among every scan this site has run. A one-of-a-kind set is worth knowing about before it matters.
2. Don’t patch it piecemeal. A font-blocking extension on an otherwise normal browser makes you rarer, not safer. If you want this defended in daily browsing, use a browser that was designed around the defense, Brave or Tor, and take their tradeoffs knowingly.
3. If you manage multiple identities, the font list is part of the identity. Each profile needs fonts that agree with the OS it claims, session after session. Incogniton gives each profile its own font list and keeps it stable session after session, so the biography a site reads belongs to the profile, not to your machine.

Your fonts have been answering questions about you for as long as you have had this machine. The widget above shows what they have been saying, and the full browser scan shows what the rest of your browser adds alongside them.