Font Detection Test

The set of fonts installed on your device is a surprisingly personal thing. It reflects your operating system, its version, and every application that quietly added its own typefaces along the way. This test detects which fonts from a common list are present, and shows how distinctive that makes your browser, using the exact technique trackers rely on.

There is no browser feature that hands a website your font list, so fingerprinting scripts measure their way to the answer instead. The method is simple and clever.

• Draw a reference. A line of text is rendered in a guaranteed generic font, and its exact width and height are recorded.
• Request the candidate. The same text is rendered asking for a specific font, with the generic one as fallback.
• Compare. If the size changed, the requested font exists and was used. If it stayed identical, the fallback was substituted, so the font is not installed.

Repeat that across a list of fonts and you have a map of what is installed, built entirely from invisible measurements. In practice the page may use an off-screen element and read its offsetWidth, or draw the text on a canvas and call measureText; both give the same answer without the text ever being shown.

Two people might both run Windows, but one has design software, another has a particular office suite, and a third installed a favourite programming font years ago. Each of those adds typefaces, and the resulting combination is far more varied than the operating system alone.

That variety is what makes fonts a powerful fingerprinting signal. On its own a single common font tells a tracker almost nothing, but the full pattern of which fonts are present and which are missing can narrow you down considerably, and it stays stable between visits. It also survives clearing cookies and using a private window, because it describes the machine rather than anything stored. The meter above turns your detected count into a rough sense of how much you stand out.

A distinction that trips people up: this test can only measure fonts installed on your device. The fonts a website serves through @font-face are downloaded with the page, live only inside that origin, and are not visible to a detection list at all. So a site using a custom typeface tells you nothing about your machine, and equally, a font you see on one website is not necessarily installed anywhere.

The same goes for fonts that arrive through a stylesheet from a third-party font host. They are fetched as ordinary files, cached, and used for that page alone. Detection scripts look past all of this and probe only the local system, which is why two browsers on the same machine can agree about fonts even when the pages they are showing look nothing alike.

You can confirm which of your fonts are genuinely local with the canvas fingerprint test, since the rasteriser uses the same installed set when it paints text.

For speed, the test probes a fixed list of well-known fonts rather than every possible one, exactly as real scripts do. So the number you see is "how many of these common fonts you have", not a full inventory of your system. A genuinely complete enumeration is slower and rarely necessary for a tracker, since the common list already produces a distinctive result.

Newer browser features are also starting to gate font access more tightly. The Local Font Access API, queryLocalFonts(), would hand a page your real font list directly, but it requires an explicit permission prompt and is Chromium-only, so it has not replaced the measurement trick. Privacy browsers may standardise or spoof what is reported, and some simply block font measurement outright.

If your result looks unusually short, your browser may be limiting detection on purpose, which is good news for your privacy. The operating system test shows the signal that a font list is really a proxy for.

You cannot uninstall the fonts your software depends on, but you can reduce how much they give away.

• Use a fingerprint-resistant browser. The Tor Browser ships with a fixed font set and reports the same list for everyone, erasing the signal. Brave and Firefox have protections that limit it.
• Avoid installing exotic fonts on the machine you use for sensitive browsing, since each unusual one makes you more distinctive.
• Do not rely on this alone. Fonts are one signal of many, and hiding them while leaving the rest exposed rarely helps.