Does Tor Spoof Your Keyboard Layout?

This article examines whether the Tor Browser spoofs or masks your keyboard layout to defend against browser fingerprinting. It explains how websites can detect a user’s keyboard configuration, the technical challenges associated with spoofing input layouts, the specific fingerprinting protections Tor actually implements, and the steps users can take to minimize input-based tracking.

The Short Answer

No, the Tor Browser does not spoof your keyboard layout. While Tor includes robust protections against most forms of browser fingerprinting, completely spoofing physical or virtual keyboard layouts would break basic text input functionality and make typing unusable for international users.

How Websites Detect Keyboard Layouts

Websites can infer your keyboard layout primarily through JavaScript event listeners. When you type on a webpage, modern browsers expose two key properties via the KeyboardEvent API:

• KeyboardEvent.code: Identifies the physical key pressed on the keyboard (e.g., KeyQ), regardless of the operating system’s active layout.
• KeyboardEvent.key: Identifies the character generated by that keypress according to the active language layout (e.g., typing KeyQ on an AZERTY keyboard produces the character "a").

By comparing the physical key location (code) against the resulting character (key), a script can quickly determine the exact keyboard layout you are using (such as QWERTY, AZERTY, QWERTZ, or Dvorak).

Additionally, websites can analyze keystroke dynamics (typing biometrics), which measures the dwell time on keys and the flight time between specific key combinations to infer language patterns and layout habits.

Why Tor Does Not Spoof Keyboard Layouts

Spoofing keyboard layouts presents a major usability barrier. If the browser intercepted and altered keyboard signals to mimic a standard US QWERTY layout, the characters appearing on the screen would no longer match what non-QWERTY users are physically typing.

Because usability is essential for maintaining a wide user base, the Tor Project prioritizes defenses that do not disrupt essential user inputs.

What Tor Does to Protect You

Even though keyboard layouts are not spoofed, Tor Browser includes several built-in mechanisms to reduce your overall digital footprint:

• Locale Spoofing: Tor requests web pages in English (en-US) by default to prevent your operating system’s language settings from giving away your region.
• Font Enumeration Defenses: Tor restricts the system fonts a website can detect, preventing scripts from deducing regional language support via installed localized fonts.
• Timezone Normalization: Tor sets the browser timezone to UTC, ensuring your local clock does not corroborate your physical location.
• Letterboxing: Tor restricts the viewport dimensions to prevent screen size fingerprinting.

How to Protect Against Keyboard Fingerprinting

If you want to prevent websites from identifying your keyboard layout while using Tor:

1. Use a Standard US QWERTY Layout: If feasible, switch your operating system input method to standard US QWERTY before browsing.
2. Increase Tor Security Level: Setting the Tor Browser Security Level to “Safest” disables JavaScript entirely on non-HTTPS sites and restricts it significantly on HTTPS sites, preventing scripts from reading keyboard event properties.
3. Avoid Typing Sensitive Information on Untrusted Sites: Keystroke timing and layout detection can only occur when you interactively type into a page running active scripts.