Show your typefaces.
Never ship your fonts.

Most type testers hand out the font

To let a visitor preview your typeface, an ordinary type tester has to send them the font file. By the time the page has loaded, a copy is already sitting on their computer.

Keeping it takes no skill and no hacking — a few clicks in the browser, or a free extension that grabs every font on a page with one button. Retail families, trial cuts, unreleased work: whatever the tester can show, it has already handed over.

Technically there is nowhere to hide it. A @font-face rule is a plain URL: the browser issues a normal GET, writes the response into its HTTP cache, and the file sits on disk in a readable form. DevTools → Network → Fonts lists every face with a one-click Save as…, and document.fonts enumerates the rest. WOFF2 is not encryption — it is Brotli-compressed OpenType, and woff2_decompress (or a three-line fontTools script) turns it back into an installable .otf in under a second, outlines, hinting, kerning and all.

The usual countermeasures only raise the cost. Randomised filenames, blob URLs and base64 data-URIs still resolve to the same bytes in memory. Referrer or Origin checks are headers a client sets freely. Subsetting to the characters on screen narrows the theft, not the method — and a tester, by definition, has to accept arbitrary input, so the subset is the whole charset. Name-table stripping and glyph reordering survive a pass through fontTools with the outlines intact; scrambled encodings can be rebuilt by rendering each codepoint once and matching the shapes. The moment the outlines reach the client, the font is recoverable.