How Firefox Restricts Local Fonts to Prevent Fingerprinting

This article provides an overview of how the Mozilla Firefox web browser combats browser fingerprinting by restricting website access to locally installed, non-standard fonts. By limiting font visibility to a standardized list of base operating system fonts, utilizing language-specific font allowlists, and offering granular about:config preferences, Firefox drastically reduces the unique identifying data (entropy) that trackers can extract from a user's device.

The Threat of Font Fingerprinting

Websites can determine which fonts are installed on your computer using JavaScript APIs or by measuring the dimensions of invisible text rendered with CSS. Because users install different applications—such as Microsoft Office, Adobe Creative Cloud, or specific video games—that add unique fonts to their system, the exact combination of installed fonts acts as a unique digital fingerprint. To reduce this fingerprinting entropy, Firefox makes different users look identical by hiding non-standard fonts from web content.

System Font Allowlisting

Firefox restricts access to locally installed fonts primarily through a mechanism known as font visibility restriction. Instead of allowing websites to query the operating system's entire font directory, Firefox intercepts font requests and checks them against a hardcoded allowlist of standard fonts.

  • OS-Specific Baselines: Firefox maintains strict lists of the default fonts that ship natively with Windows, macOS, Linux, and Android.
  • Blocking User-Installed Fonts: If a website requests a font that you installed manually or through third-party software, Firefox denies the request. The browser behaves as if the font does not exist and renders the text using a standard fallback font instead.
  • Web Fonts Exception: To prevent websites from breaking visually, Firefox still allows sites to download and use remote web fonts (via the CSS @font-face rule), as these do not reveal any information about the user's local machine.

Language Pack Exceptions

Strictly limiting fonts to a basic English-centric operating system list can break websites that require characters from other scripts, such as CJK (Chinese, Japanese, Korean) or Arabic.

To solve this without exposing the entire font library, Firefox categorizes supplemental system fonts by language. Firefox automatically detects the user's locale and permits access to the standard OS fonts associated with that specific language pack. This ensures proper text rendering for international users while keeping the pool of exposed fonts uniform among users in the same region.

How Firefox Enforces Font Restrictions

Firefox applies these restrictions differently depending on the user's selected privacy level. The browser manages this behavior using internal values ranging from 1 to 3:

  1. Level 1 (Base System Fonts Only): Only the core fonts included with a fresh installation of the operating system are exposed to websites.
  2. Level 2 (Base System + Language Pack Fonts): The core OS fonts plus the standard supplemental fonts for the user's specific language locale are exposed.
  3. Level 3 (All Fonts): Websites can access all locally installed fonts, including user-installed ones.

By default, Firefox enables font restrictions in Private Browsing windows and when Enhanced Tracking Protection (ETP) is set to Strict.

Manual Configuration via about:config

Advanced users can manually control how Firefox restricts font access by typing about:config into the address bar and modifying specific preferences:

  • privacy.resistFingerprinting: Setting this boolean preference to true enables Firefox's strongest anti-fingerprinting protections (inherited from the Tor Uplift project). This strictly locks font visibility to Level 1, exposing only base system fonts regardless of the browsing mode.
  • layout.css.font-visibility.standard: Controls font visibility in standard browsing windows. Changing this integer from 3 to 1 or 2 enforces font restrictions at all times.
  • layout.css.font-visibility.private: Controls the font restriction level specifically for Private Browsing windows.
  • layout.css.font-visibility.trackingprotection: Controls the font restriction level when Enhanced Tracking Protection is active.

By intercepting font enumeration attempts and enforcing these strict allowlists, Firefox ensures that a user with thousands of custom fonts appears identical to a user on a brand-new operating system installation, effectively neutralizing font-based tracking.