Font fingerprint
Fonts Installed on Your Machine
Probed with a width-comparison technique that needs no permission. The exact list is often unique enough to identify you across sites.
Font enumeration
Probing 134 fonts...
The width-comparison probe, in one paragraph
We drop a hidden <span> onto the page with a large font size, measure its width in each of the three generic CSS families, and remember those baselines. Then we set font-family: "Candidate", monospace and measure again. If the width or height changes, the browser used the candidate font, and it's installed. Repeat for our pool of ~150 fonts.
What the fingerprint reveals
- Your OS family and version (very different base fonts on Windows / macOS / Linux).
- Whether you have Microsoft Office, Adobe Creative Cloud, or Google Chrome's Noto set.
- Locale hints, CJK fonts point at Chinese/Japanese/Korean OS installs.
Spoofing tips for scrapers
- Install a realistic font set inside your headless container (or use a base image with Office fonts).
- Don't leave the container with only DejaVu + Liberation, that's the Docker default and instantly recognizable.
- Match your font set to your User-Agent: Windows UA + macOS-only fonts is a leak.
Frequently asked questions
→How can a website read my installed fonts without permission?
The classic technique measures the width of a probe string rendered in a candidate font. If a font isn't installed, the browser falls back to a generic family (monospace/sans-serif/serif) and the width comes out matching that generic. If the width differs, the candidate font was applied, meaning it's installed. Repeat for a couple hundred candidates and you have a font list.
→Isn't the modern Font Access API gated behind permission?
Yes. window.queryLocalFonts() (Chrome) requires user permission and only returns what the user approves. But the width-comparison trick above needs no permission at all, so it's still the workhorse of fingerprint scripts.
→Why is the installed-font list a strong fingerprint?
Because the combination of OS + language pack + installed apps produces very different font sets. A fresh Windows install has ~130 fonts; add Office and you get ~200; add Adobe Creative Cloud and you're at ~600. Two random users almost never share the same set.
→Can I hide my fonts?
Firefox with resistFingerprinting only exposes a fixed system-font subset. Brave randomizes access. In Chrome you'd need an extension. For scrapers, headless Chrome usually reports the Linux base set (DejaVu, Liberation, Noto), which is itself a suspicious signal on a Windows UA.
→What does it mean if very few fonts are detected?
Two possibilities: you're on a stripped headless build (typical) or you're on a privacy-hardened browser that spoofs font metrics (Firefox RFP, Brave). Both are unusual on the wider web, so anti-bot systems weight this signal accordingly.