Font Fingerprinting: How Your Installed Fonts Identify You

Q: What is font fingerprinting?

Font fingerprinting identifies your device by figuring out which fonts are installed on it. The specific combination of fonts is shaped by your operating system, language packs, and installed software, which makes it surprisingly distinctive. Websites detect this without needing any permission.

Q: How do websites detect which fonts I have installed?

The common method renders a piece of text in a candidate font and measures its width and height, then compares that to a known fallback font. If the size is different, the font is installed; if it matches the fallback, it is not. Repeating this across a long list of font names reveals your installed set.

Q: Why is my set of fonts identifying?

Although any single font may be common, the full combination of fonts on your machine is often rare or unique. Professional software, design tools, and language packs each add fonts that many other users do not have. That combined set adds significant identifying information to a fingerprint.

Q: Does the Font Access API let any website read my fonts?

No. The newer Font Access API, which can list local fonts directly, requires an explicit user permission prompt and is not available in every browser. Without that permission, sites fall back to the older measurement-based detection method. Declining the permission blocks the direct enumeration path.

Q: How can I reduce font fingerprinting?

The Tor Browser exposes a fixed, standardized set of fonts so all its users look alike, and the Firefox resistFingerprinting setting limits font enumeration. Brave also restricts font-related signals. None of these fully eliminate the measurement-based method, and an unusual font configuration can sometimes make you stand out more.

~/sheets/font-fingerprinting.md

Your Font List Is More Unique Than You Think
Font fingerprinting identifies a device by working out which fonts are installed on it. The set of installed fonts is shaped by your operating system, language packs, and the software you have added over the years, which makes it surprisingly distinctive. A website can probe for it without any permission prompt. See what your browser exposes with our browser fingerprint tool, alongside the full browser fingerprinting overview.
How Detection Works
The classic method needs no permission. A script renders a piece of text in a candidate font and measures its rendered width and height, using offsetWidth and offsetHeight or canvas text metrics, then compares the result to a known fallback font. If the size differs from the fallback, the candidate font is installed. If it matches, it is not. Repeating this across a long list of font names reveals your installed set.
Why the Set Identifies You
Although any single font may be common, the full combination on your machine is often rare or unique. Professional software, design tools, and language packs each add fonts that many other users do not have. Like canvas fingerprinting, the result is read live each visit, so it is stateless and survives clearing cookies and private browsing. It feeds directly into your overall privacy grade.
The Newer Font Access API
A newer Font Access API can list locally installed fonts directly through a call such as queryLocalFonts. Unlike the measurement trick, it requires an explicit user permission prompt and is not available in every browser. Declining that permission blocks the direct enumeration path, but sites can still fall back to the older measurement-based method, which is why that method remains the dominant approach.
How to Reduce It
The Tor Browser exposes a fixed, standardized set of fonts so that all of its users look alike, which is a deliberate anonymity strategy. The Firefox resistFingerprinting setting limits font enumeration, and Brave restricts font-related signals. None of these fully eliminate the measurement method, and an unusual font configuration can sometimes make you stand out more rather than less. This vector is one reason a network-layer fingerprint and browser-layer fingerprints are often combined.
Frequently Asked Questions
What is font fingerprinting?
Font fingerprinting identifies your device by figuring out which fonts are installed on it. The specific combination of fonts is shaped by your operating system, language packs, and installed software, which makes it surprisingly distinctive. Websites detect this without needing any permission.
How do websites detect which fonts I have installed?
The common method renders a piece of text in a candidate font and measures its width and height, then compares that to a known fallback font. If the size is different, the font is installed; if it matches the fallback, it is not. Repeating this across a long list of font names reveals your installed set.
Why is my set of fonts identifying?
Although any single font may be common, the full combination of fonts on your machine is often rare or unique. Professional software, design tools, and language packs each add fonts that many other users do not have. That combined set adds significant identifying information to a fingerprint.
Does the Font Access API let any website read my fonts?
No. The newer Font Access API, which can list local fonts directly, requires an explicit user permission prompt and is not available in every browser. Without that permission, sites fall back to the older measurement-based detection method. Declining the permission blocks the direct enumeration path.
How can I reduce font fingerprinting?
The Tor Browser exposes a fixed, standardized set of fonts so all its users look alike, and the Firefox resistFingerprinting setting limits font enumeration. Brave also restricts font-related signals. None of these fully eliminate the measurement-based method, and an unusual font configuration can sometimes make you stand out more.
Last updated: April 2026