What Is Font Fingerprinting?

Font fingerprinting is a browser tracking technique that identifies your device by detecting which fonts are installed on your system and how they are rendered. Your operating system ships with a default set of fonts, and over time you may install additional fonts for specific software, language support or design work. The exact combination of fonts on your system can be surprisingly unique and can be used to identify you across websites without cookies. For the overview of how font fingerprinting fits with other techniques, see our complete browser fingerprinting guide and the online privacy check hub.

Like other fingerprinting techniques, it stores nothing on your device. Clearing cookies, private browsing or a VPN do not change your font fingerprint.

How Does Font Fingerprinting Work in the Browser?

There are two main methods for detecting installed fonts, plus a third method that measures how fonts are drawn. A fingerprinting script runs in JavaScript and needs only milliseconds.

1. CSS Font Fallback Measurement

The first method uses the CSS font fallback mechanism. The script writes a test text in a candidate font, for example "Calibri", with a generic fallback such as monospace. If the font is missing, the browser uses the fallback, and the text gets a different width or height at the same font size. By measuring the rendered text in hundreds of different fonts, JavaScript learns which font names are installed. This is called font enumeration.

2. Canvas Font Detection

The second method uses the Canvas API to draw text in different fonts and measure the pixel output. This overlaps with canvas fingerprinting. The 2016 Princeton crawl of the top 1 million websites found such canvas font fingerprinting on 3,250 sites.

3. Font Metrics (Glyph Measurement)

Font metrics fingerprinting does not ask which fonts exist. It measures the exact size of rendered glyphs. Fifield and Egelman (2015) measured glyph bounding boxes in over 1,000 browsers. Font metrics uniquely identified 34% of participants. Out of more than 125,000 Unicode code points, only 43 were needed to capture all the variation they saw. Browser version, installed fonts, hinting and antialiasing settings all change the result.

What About the Local Font Access API?

Some browsers offer queryLocalFonts(), which returns the full list of local fonts. It is experimental, works only over HTTPS and requires your permission for "local-fonts". A site cannot read the list silently this way, so trackers rely on the measurement methods above.

Why Is Your Font List Unique?

Your font list is unique because software and language packs add fonts that differ from person to person. Most users have their OS default fonts plus fonts installed by specific applications:

  • design software like Adobe Creative Suite installs dozens of extra fonts,
  • development environments install monospace fonts,
  • language packs add regional scripts.

A user with Adobe Photoshop installed has a different font profile from someone who has only the default Windows fonts. In the 2010 EFF Panopticlick study, the font list was one of the most identifying attributes, together with plugins and the user agent.

Font typeSourceFingerprinting value
Default system fontsOperating systemReveals OS and version
Language fontsLanguage packsReveals languages and region
User or app fontsOffice, design or developer softwareHighly identifying
Web fontsLoaded by the websiteLittle value, they come from the site

Why Do Websites Use Font Fingerprinting?

Websites use font fingerprinting to gather information that helps them recognize a browser across visits without cookies. Trackers add the font result to other values to build a unique fingerprint and track users across sites. Some security services use the same data points to detect bots or suspicious logins. You do not see any of this: the script runs during the page load and shows nothing on screen.

What Does a Font Fingerprint Reveal About You?

A font fingerprint can reveal more than an ID. Default font families point to your operating system and its version. Fonts for Unicode glyphs of certain scripts, such as Thai, Arabic or Chinese, hint at the languages you read. Fonts from design or office software hint at the programs you use. These privacy concerns apply even if the site never stores your name.

How Is Font Fingerprinting Different from Canvas Fingerprinting?

Font fingerprinting asks which fonts exist and how big their glyphs are, while canvas fingerprinting hashes a whole drawn image. Scripts often combine both, together with WebGL and screen values, to build one browser fingerprint.

How Can I Block Font Fingerprinting?

Brave browser limits font API access and randomizes font fingerprinting. Firefox with privacy.resistFingerprinting reports a reduced, standardized set of fonts. The Tor Browser allows access only to a small, fixed set of fonts to prevent enumeration. In detail:

  • Brave (since 1.39, 2022): sites see the OS fonts for your top language. Fonts you or your software installed appear as a random set that changes per site and per session. This protection runs on Windows, macOS and Android, not on Linux or iOS.
  • Firefox with Resist Fingerprinting: sites can only use fonts that came with the operating system. Fonts from language packs are excluded. Mozilla warns that the setting can break some sites.
  • Tor Browser: uses an allowlist of system fonts plus bundled Noto fonts on Windows and macOS, and only bundled fonts on Linux. The goal is that all users show the same font set.

Some browser extensions spoof the font result by adding noise to text measurements. Like all anti-fingerprinting add-ons, they also change your profile, so check the result in more than one test. Uninstalling rare fonts you do not need also shrinks your font list. This has a tradeoff: you lose these fonts in your own apps.

Can Font Protection Still Identify My Browser?

Yes, partly. A font allowlist hides which extra fonts you have, but the same font can still render slightly differently on different systems. Fifield and Egelman found that allowing only a standard set of font files would cut the share of users with a unique font fingerprint to below 10%, but not to zero. Font protection also does not hide your operating system, which the default fonts reveal anyway.

How Can I Check My Font Fingerprint?

The SpeedIQ checks do not include a font test yet. You can run the SpeedIQ test to see related fingerprint values: the canvas hash (drawn in Arial), screen, hardware, language, time zone and user agent. The results stay in your browser. To see if your protection works, compare your browser with and without the settings above.

→ Try it free: You can check your browser fingerprint directly at SpeedIQ — no account, no ads.

FAQ

Can my browser be fingerprinted through fonts?

Yes. Any website can run JavaScript that measures text in many fonts and finds out which ones are installed, without asking you.

Is font fingerprinting legal?

In the EU, the Article 29 Working Party stated in 2014 that the ePrivacy consent rule applies to device fingerprinting. Font fingerprinting for tracking therefore usually needs consent.

Do web fonts make me easier to track?

No. Web fonts come from the website itself, so every visitor gets the same ones. Fonts installed on your own system are the risk.

Does deleting fonts help against font fingerprinting?

It can make your font list more common, but you lose those fonts in your apps. A browser with font protection is the simpler fix.

Which browser blocks font fingerprinting best?

Tor Browser offers the strongest protection with a fixed font set. Brave randomizes user-installed fonts, and Firefox with Resist Fingerprinting allows only operating system fonts.

Sources