Skip to content
All fingerprint checks
Render & GPU

Canvas measureText widths on the 1/512 sub-pixel grid

Pim· Clearcote Research 2 min readCheck id measuretext-grid

On V8 claiming Windows or macOS: every measured width is an exact multiple of 1/512 px. Other engines and platforms: N/A — the grid follows from Arial's 2048 units per em at 12px.

What a detector infers

Chrome keeps glyph advances in 16.16 fixed point and scales them linearly from the font's design units, so a width is a whole number of font units times size / units-per-em. Arial has 2048 units per em, so at 12px every unit is 12/2048 = 3/512 px and every width lands on a dyadic 1/512-pixel grid. The audit measures five strings at 12px Arial — "A", runs of W, m and i, and a mixed alphanumeric string — and asserts that width * 512 is an integer within 1e-6 for each.

The mechanism is about the shape of the number, not its value: multiplying a width by a farble scale factor yields a result that is still a plausible-looking float but no longer sits on the grid, so post-processing is visible even when the metric itself looks reasonable, with no baseline to compare against.

The grid belongs to Arial, not to the engine: genuine Chrome 155 measured 0 of 5 strings on it when the font answering "Arial" had 1000 units per em (FreeSans, Noto Sans, Noto Serif) or 2000 (Lato), and at 13px or 14px even a 2048-unit Arial is mostly off it. So the check is asserted only on V8 claiming Windows or macOS, which ship Arial itself; Linux, Android and ChromeOS substitute a font of their own and read N/A.

Gecko and WebKit quantise differently; the corpus showed 100% of genuine Firefox failing before the V8 gate, a calibration false positive, not a spoof signal. N/A off V8, off Windows and macOS, or if measurement failed outright.

How to resolve it

Leave text-metric farbling off (the light_stealth preset does). If text metrics must vary per site, the variation has to happen inside the text/layout engine so results remain quantised on the grid; a multiplicative scale applied to the returned number is detectable here regardless of how small the factor is.

What is font fingerprinting?

Read in the wild by

CreepJS

CreepJS, an open research demo rather than a production detector, lists measureText among its tampering targets on both the CanvasRenderingContext2D and OffscreenCanvasRenderingContext2D interfaces and sweeps the whole TextMetrics interface, running its descriptor and native-code battery over them — it probes these APIs for patching rather than reading the metric values themselves.

src/lies/index.ts (abrahamjuliot/creepjs@master): `searchLies(() => CanvasRenderingContext2D, { target: ['getImageData','getLineDash','isPointInPath','isPointInStroke','measureText','quadraticCurveTo','fillText','strokeText','font'] })`, `searchLies(() => OffscreenCanvasRenderingContext2D, { target: ['getImageData','getLineDash','isPointInPath','isPointInStroke','measureText','quadraticCurveTo','font'] })`, and a whole-interface `searchLies(() => TextMetrics)`. The battery these feed (queryLies) checks descriptor keys equal "length,name" and validates native-code strings via hasKnownToString().

Every attribution traces to a published artifact. See the sources and their limits.

Nearby checks in Render & GPU

See all 64 checks in Render & GPU
Who builds this test

Clearcote is a browser built for fingerprint coherence

It is a Chromium fork, maintained by the same people who wrote this reference. It ships as a compiled browser rather than as a stealth script injected into someone else's — which is a description of how it is built, and is not an argument about how it behaves on this check.

This audit takes no position on how Clearcote scores on Render & GPU checks, on this one, or anywhere else. It has no baseline corpus of other people's fingerprints to rank you against and no vendor scoreboard — nearly every check is self-referential, asking one browser the same question through two independent APIs and reporting whether both answers can be true at once. It runs identically on any browser, including ours. Run it on yours and read the result yourself.

See the other checks in Render & GPU — the family measuretext-grid belongs to.