Typetin

Fingerprinting

A fingerprint in every font you deliver.

Every file a buyer downloads is made for that order. It carries a short signed record of who it was issued to, so a leaked copy can be matched to an order. Foundries also call this watermarking or serialising a font.

Typetin hasn’t launched. What this page describes is built and in testing, and it isn’t open to foundries.

The record in the file

The fingerprint names the order, the order line, the licensee, the licence with its EULA version, and the time of payment. The licensee is the name and company on the order, or the order’s email address when neither was given. The fingerprint goes in two places: a record in the font’s name table, and the private data block of WOFF and WOFF2 files.

The record is signed with HMAC-SHA256, using a key that Typetin holds and no foundry or buyer sees. An edited record no longer matches its signature. The record isn’t encrypted, so anyone who knows the format can read it.

Typetin also keeps its own record of what was written into each delivered file.

The limits of a fingerprint

A fingerprint deters and traces. It isn’t DRM. It doesn’t stop a font being copied or installed, and someone who knows the format can strip both places it’s written.

The signature covers the record and nothing else in the font, so a record copied into another file still verifies. A match tells you which order a record was issued for. It doesn’t prove who passed the file on.

Reading a fingerprint back

Reading one back gives the order and the line, and says whether the signature still holds. Today that’s done from the code. The admin has no screen for it.

The buyer’s download

A desktop licence delivers your OTF or TTF files. A web licence delivers WOFF2 and WOFF, converted at delivery. The ZIP also holds the text of the EULA version the buyer accepted and a licence certificate.

A download link lasts 90 days. A buyer who is signed in to their account can issue a fresh one for the same order, unless it was refunded or disputed, or one of its licences is no longer active. Links stop working after a full refund, a dispute, or when you revoke a licence.

Trial fonts

A trial font is cut from your own file. It keeps the 95 printable characters of basic Latin, takes your family’s name with “Trial” after it, is set to allow embedding for preview and print only, and is fingerprinted like any other download. Retail files are never handed out as trials.

Fingerprints in hosted webfonts

Fonts that Typetin hosts for a web licence are fingerprinted for the order as well. Those files are public: every visitor to the buyer’s site downloads them, with the record inside. How hosted webfonts work.

The rest of the back office

  • Licensing: licence tiers, terms, renewals and quotes.
  • EULAs: the version each buyer accepted, on every order.
  • Royalties: each designer’s share of every sale.
  • Hosted webfonts: licensed domains and pageview counts.
  • API: your own site, reading from Typetin.

Pricing has what each plan includes, and the roadmap has where every feature stands.