Font Fingerprinting Explained

How font detection works

Browsers do not hand pages a list of installed fonts. Pages infer it instead, using a measurement trick. The detecting script renders a fixed test string — something width-sensitive like mmmmmmmmlli — at a large size in a generic fallback font (monospace, sans-serif, serif) and records the width. Then it renders the same string requesting a candidate font with the generic as fallback. If the width differs from the fallback's width, the candidate font rendered, which means it is installed. Repeat across a candidate list and you have a yes/no answer for every font on it.

Why installed fonts identify systems

Font sets encode history. The operating system ships a base set that differs between platforms and versions — detecting Segoe UI versus Helvetica Neue versus SimSun already suggests which OS and language configuration a system runs. On top of the base set, software adds fonts: office suites, design tools, and language packs each leave their signature typefaces behind. The result is a slowly accumulating inventory that differs between systems and stays stable for months at a time — exactly the properties a tracking signal needs.

What this site's test does

The analyzer checks a fixed list of 41 candidate fonts spanning Windows, macOS, and common application fonts, using the width-measurement method on an off-screen canvas. The result card shows how many candidates were detected, names a few examples, and hashes the full detected list locally. The rating scales with the detected set: a large set that likely includes software-installed fonts rates Higher; a standard OS set rates Moderate; a minimal set rates Lower. As with every test here, nothing is uploaded or stored.

A note on the candidate list

Real fingerprinting scripts often probe hundreds of fonts. This analyzer's list of 41 is deliberately compact — enough to demonstrate the technique and give a meaningful reading without pretending to be exhaustive. If your system has unusual fonts outside the list, your actual exposure may be higher than the test shows.

Defenses

• Standardized font reporting — Tor Browser bundles its own fonts and reports only those, so users present identical font sets. Firefox's resist-fingerprinting mode restricts pages to a whitelist of common fonts.
• Restraint — every font you install is a durable addition to your fingerprint. Install what you need; remove what you do not.
• Per-site randomization — Brave randomizes font availability slightly per site, breaking cross-site linkage of the font signal.

To test a defense, run the analyzer, enable the protection, and use Run again and compare — a changed font hash means the reported set actually changed.