Your Fonts Are Your Passport

Graphology swore it could read a person through handwriting. Slant of letters, pen pressure, loop size. Field turned out feeble: experts kept clashing, forensic analysts passed off hunches as findings. Yet the seed held water. How someone writes does leak something about them.

Your computer has handwriting too. Made of installed fonts. Every font you've ever put in, or got bundled with some app, sits registered in the system. List is unique. Not roughly. Not sort of. Per Gomez-Boix, Laperdrix, and Baudry at WWW 2018 in Hiding in the Crowd, full font enumeration yields up to 13.9 bits of entropy. Enough to shrink the pool to one in 15,000 users. Fold in canvas, WebGL, and User-Agent, and you're one of one.

Your bookshelf tells guests who you are. Font list does the same, except the guests don't knock.

In brief: Installed fonts uniquely tag a browser. CSS attacks read them without JavaScript, work inside email clients, and give away your profession, OS, and installed software. Defenses exist but wreck the internet for a billion users of non-Latin scripts.

Three Ways to Read Your Handwriting

Way one: enumeration. A script walks through a roster of several hundred known fonts. For each, it builds a hidden text element, sets font-family to the test font with a fallback. If text width strays from the fallback, the font is there. Crude, fast, effective. Checking 500 fonts takes 200ms. A fixed list of 500 well-known fonts yields 6.9 bits of entropy per Gomez-Boix et al. in 2018. Full enumeration through Chrome's Local Font Access API hands over the whole catalog, all 13.9 bits yours for the taking.

Way two: metrics. Don't need to know which fonts sit on the machine. Just measure how they render. Same Arial on Windows and macOS spits out different glyph widths. Hinting, subpixel rendering, kerning shift across OSes and even across versions of the same OS. Fifield and Egelman in 2015 at Financial Cryptography showed 43 Unicode codepoints are enough to catch all the drift. Metrics yield 8.058 bits of entropy. Blocking the font list doesn't graze this vector. WHOX checks it as C43: font metrics hash.

Way three: CSS only. Not one line of JavaScript. Trampert et al. from CISPA at NDSS 2025, in Cascading Spy Sheets, proved the point: CSS container queries and calc and font width measurement can pin down 1,176 browser-OS combos at 97.95% accuracy. Container query shifts an element's style based on container width. Container width hangs on text width. Text width hangs on the installed font. CSS fires a request to a unique URL. Server gets the answer. JavaScript never enters the picture. Pure CSS, pure fingerprint.

WHOX catches output of all three in check F07 through Font MinHash32x8 and through OS-tied signatures: macOS tends to show fewer than 50 fonts, Windows fewer than 100, Linux with full package sets can push past 200.

What Your Fonts Betray About You

Every app drags fonts along like a tourist hauling souvenirs. Adobe Creative Cloud drops in over 200: Myriad Pro, Minion Pro, Adobe Garamond, Source Sans. Microsoft Office tacks on Calibri, Cambria, Consolas, Leelawadee. TeamViewer writes a font whose name encodes its version number. JetBrains IDEs ship JetBrains Mono.

Look at this through an analyst's lens. Myriad Pro and Adobe Garamond and Minion Pro = designer. Likely a Creative Cloud subscription at $55 a month. Above-average earnings. Computer Modern and Latin Modern = scholar running LaTeX. JetBrains Mono and Fira Code = developer. Leelawadee and Calibri, no Adobe = office worker.

Font list gives away your trade and your ballpark salary. Not idle guesswork. A PoPETs 2025 study by Google and MIT showed browser fingerprints correlate with income level and racial background. Fonts make a measurable dent in that correlation.

Cascading Spy Sheets: Reading You Through Email

Here's where it turns genuinely grim. JavaScript is blocked in email clients. Everyone knows that. CSS is not blocked. Almost nobody thinks about it.

CISPA tested 21 email clients. 18 fell to CSS fingerprinting. 9 of them fully exploitable: attacker can nail down your OS, browser, and installed software. You open an HTML email, sender learns you're on Windows 11 with Office 365, Chrome 120, and Adobe Acrobat. JavaScript plays no part. Pure CSS does the lifting.

Just identification? Fontleak from adragos.ro in 2025 went further: data can be stolen, not merely read. Researchers built a custom font with OpenType GSUB substitutions, ligatures. Each character combo renders as a glyph with a unique width. CSS tracks the width and fires a request to the attacker's server. Character by character. No JavaScript.

Not fingerprinting anymore. Data theft. CSRF tokens, API keys, session IDs from inline <script> tags. DOMPurify, the most widespread HTML sanitizer, lets <style> through by default. CSS injection becomes the working twin of XSS. Runs in Chrome, Firefox, Safari.

Why Defenses Keep Failing

Firefox offers Resist Fingerprinting through layout.css.font-visibility at three tiers. Tier 1 locks visibility to base system fonts, roughly 20. Tier 2 adds language packs. Tier 3 lets user-installed fonts through.

Sounds fair. Here's the snag. RFP is on for 0.48% of Firefox users per fingerprint.com data. If your browser shows exactly 20 base fonts, you land in a group smaller than half a percent. 200 times more findable. Shield turned into a beacon. Same bind as turning off WebRTC, where 2% of users do it and uniqueness jumps 50-fold, or blocking JavaScript entirely.

W3C knows. Issue #4055 in the CSS Fonts Working Group has sat open since 2019. CSS Fonts Level 4 lets browsers skip user-installed fonts. At the Csswg meeting on February 26, 2025, Brave's team talked through how to tackle font fingerprinting. Still talking.

Reason is blunt: clamping down on fonts shatters non-Latin scripts. Japanese needs 10,000+ glyphs. Arabic demands bespoke shaping. System fonts for CJK swing wildly across OSes: a Japanese Windows user sees MS Gothic and Yu Gothic, macOS user sees Hiragino and Osaka. Hefty entropy. Privacy and internationalization are at war, no truce in sight.

Even if a browser walls off enumeration outright, metrics go nowhere. Same Arial, different pixel widths on Windows, macOS, Linux. 8 bits of entropy from rendering measurements alone. Don't need to know which fonts are there. Just need to gauge how they draw.

FAQ

Does incognito mode hide my fonts? No. Private mode wipes cookies and history. Font list belongs to the OS, not the browser profile. Same in normal mode and incognito.

What if I strip out all non-standard fonts? You lose function: documents break, apps may glitch. You gain the fingerprint of a person who stripped out all their fonts. Tiny group, easily singled out.

Do antidetect browsers fix this? They spoof the font list and metrics. Good ones with rendering through a standalone engine work. Cheap ones spoof the list but not the metrics. WHOX checks both layers through F07 and C43 and catches the gaps.

Can a website learn my fonts without JavaScript? Yes. CSS container queries and calc and background image. CISPA hit 97.95% accuracy across 1,176 browser-OS combos. Works in email clients where JS is blocked.

Which browser best shields against font fingerprinting? Tor Browser. Locks both the font list and the rendering. Cost: some sites render poorly, speed drops.

---

Read Next

• The First 100ms: What Happens on Connection
• Canvas Randomization Defeated
• What Actually Works: A Protection Guide

---

WHOX - We tell real signals from manufactured ones. Check your fingerprint at whox.com and find out what signals leak from your browser and how unique you are.