Why Tor Browser Restricts Fonts on Websites

Tor Browser restricts the fonts a website can load primarily to defend against browser fingerprinting, an advanced tracking technique used to identify users without relying on cookies. By standardizing the fonts that websites are allowed to display and preventing access to locally installed system fonts, Tor ensures that all its users appear identical to web servers, preserving anonymity across the internet.

Understanding Font Fingerprinting

Browser fingerprinting is a method of collecting technical information about a user’s device and browser configuration. When you visit a webpage, scripts can measure how the browser renders text or query the system to detect which fonts are installed on your device.

Because people install different applications, language packs, design software, and operating system updates, the specific list of fonts on any given computer is surprisingly unique. When combined with other data points—like screen resolution and operating system version—a website can construct a distinct “fingerprint” that tracks you across different browsing sessions and distinct websites, even if you route your traffic through an encrypted proxy like Tor.

How Tor Neutralizes the Threat

To counter this tracking vector, the Tor Browser implements a defense strategy based on uniformity:

• Blocking Local Font Enumeration: Tor blocks websites from probing the operating system to see which fonts are locally installed on your machine.
• Bundling Standardized Fonts: Tor packages a fixed set of open-source fonts directly within the browser. Regardless of whether you are using Windows, macOS, or Linux, Tor serves the exact same standard fonts to web pages.
• Restricting Remote Web Fonts: In higher security configurations, Tor can restrict third-party web fonts (fonts downloaded from a server) to prevent timing-based side-channel attacks and canvas-rendering measurement tricks used to profile your device’s rendering engine.

The Trade-Off Between Privacy and Aesthetics

Restricting font loading can occasionally cause websites to look visually plain, render with fallback typefaces, or fail to display certain custom icon fonts. However, this is a deliberate trade-off. For the Tor Project, visual consistency with standard system defaults ensures that millions of users share the exact same digital signature, rendering font-based tracking techniques useless.