What a watermark in a font proves, and what it can’t.

Watermarks, serials and fingerprints

Foundries use watermarking, serialising and fingerprinting for the same idea: each buyer gets a copy of the font that is slightly different from everyone else’s, and the difference says who it was for. The simplest form is the licensee’s name in the font’s description or copyright string, readable in any font menu. A more careful form is an order number or a short signed record in a place a buyer doesn’t see, plus a record on the foundry’s side of exactly which file went to which order.

A visible name and a hidden record do different jobs. The visible name reminds the buyer every time they open the font menu, and it is the first thing anyone sharing the file removes. The hidden record is for you: it is still there after a quick rename, and it can be checked. Many foundries use both, with the visible line kept short, such as a company name and an order number.

It only works when the files are made per order. A foundry that sends every buyer the same ZIP has nothing to trace, however carefully the fonts were built.

Where a mark can live in a font file

A font is a set of tables. Some carry text a mark can sit in, and the web formats add two blocks of their own: the WOFF2 specification describes an optional XML metadata block and an optional block of private data “for the font designer, foundry, or vendor to use”.

Writing the same mark in two places helps, because someone who strips one often misses the other. A record of what you delivered helps more: if you keep a hash of every file you sent, a file found later that matches one byte for byte needs no mark to identify it.

Who a mark deters

A mark works mostly on people who know it’s there. A designer at an agency who knows the fonts carry the agency’s name thinks twice before passing them to a freelancer, and a company that knows its name is in the files is careful about where they go. Say in your EULA and at checkout that delivered fonts are marked with the order. The mark doesn’t need to be secret to work.

It deters very little on the sites that collect fonts in bulk, where nobody is reading the name table.

How a mark is stripped

Every place in the table above can be edited with free tools. Converting a WOFF2 file to TTF drops the metadata and private data blocks without anyone meaning to. A name record can be removed in a few lines of script. Webfont services and build tools that subset fonts often drop tables they don’t recognise. Marks in the outlines last longest, but they change the drawing, they’re hard to read back reliably, and redrawing or re-converting the curves removes them.

This was said plainly in the W3C webfonts discussion in 2009: a signed record in a font that isn’t encrypted can be stripped, and then nothing shows which buyer it came from. The same message still counted it as worth doing. A mark raises the effort needed to share a font anonymously. It doesn’t stop anyone copying or installing it, and it isn’t copy protection.

Reading a match

A mark that reads back intact tells you which order the file was issued for. It doesn’t tell you who passed it on. Between the buyer and the place you found it there may be an employee, a contractor, a printer, an agency that left a project folder public, or a website. Webfonts are downloaded by every visitor to the site that uses them, so a webfont found elsewhere may have been taken from that site without the buyer doing anything.

A file with no mark proves nothing either. It may have been stripped, or it may come from before you marked files, or from a reseller.

A byte-for-byte match with a file you delivered is the strongest evidence a foundry usually has. A mark that reads correctly in a file that doesn’t match means the file was converted, renamed or edited after delivery, or that the record was copied into another file.

Signing the record

A plain order number in a name record can be changed to another number, or to an order that belongs to someone else. Signing the record, with a keyed hash or a digital signature, means an edited record no longer checks out, so a match shows the record is the one you wrote.

Signing doesn’t hide the record, and it covers only what was signed. A signed record copied whole into a different font still verifies, which is why the file hash on your side matters. Keep the signing key away from the shop’s public code, and plan for what happens to old files if the key ever has to change.

A buyer’s name inside a public file

A desktop font stays with the buyer. A webfont is public: anyone who visits the buyer’s site downloads it and can read every record in it. If the mark holds a person’s name or email address, that is personal data published to the open web, and in many places the foundry is responsible for it.

For webfonts, prefer a company name or an order reference that only you can resolve. Write no more than the licence needs, and say in your privacy notice what goes into delivered files. This isn’t legal advice: data protection and takedown rules differ by country.

When you find a leaked file

Most leaks have a dull explanation, and the order of the steps matters more than speed.

1. Save the file, the address where you found it and the date, before anything changes.
2. Read the mark, check the signature, and compare the file against what you delivered for that order.
3. Look at the order: the licence, the number of users or pageviews, and whether it was refunded or disputed.
4. Write to the buyer privately and plainly: what you found, where, and what you need. Many buyers didn’t know a file had left their company, and fix it the same day.
5. Ask the host to take the file down, with a notice that names your typeface and the copy.
6. Never publish a buyer’s name. A match is evidence to raise with the buyer, and nobody else.

Keep a note of each case and how it ended. The next one is usually the same buyer, or the same site.

Trial fonts

Trial fonts travel further than retail fonts, because they’re free and handed to anyone with an email address. Cut them down: basic Latin only, “Trial” in the family name so they’re plain in every menu, and the embedding setting limited to preview and print. Mark each download like a sale. A trial copy turning up in a finished commercial job is a common licensing conversation, and a mark makes it a short one. Never send retail files as trials.

Where Typetin fits

Typetin writes a signed record of the order, the licensee and the licence into every file a buyer downloads, in a name table record and in the private data block of WOFF and WOFF2 files, and keeps its own record of each delivered file. The admin’s font tools include a file inspector that reads the record back, checks the signature and says whether a file is byte for byte one the order delivered. The record isn’t encrypted, can be stripped, and doesn’t stop a font being copied. Typetin’s hosted webfonts carry the same record, including the licensee’s name, or their email address when no name was given. Per-order fingerprinting is on every plan. How fingerprinting works in Typetin.