Scope and purpose
Font Autopsy is a local inspection tool for font files that the user deliberately selects or drops onto the extension page. Its single purpose is to help a person examine typography-related properties, render a specimen, and understand characteristics such as mapped characters, metrics, variable axes, measured width, rendered density, and browser-shaped kerning examples.
This policy describes the production version 1.0.0 behavior. It does not describe hypothetical cloud services, account features, synchronization, advertising, telemetry, or any other capability that the extension does not contain.
- The extension page is the only place where font-file examination occurs.
- The extension does not inspect ordinary webpages or browsing history.
- The extension does not provide an account system or cloud workspace.
How a font enters the extension
A font becomes available only after the user makes an explicit local-file choice. The user can press Choose Font and select a file, or drag a supported font file onto the designated drop area. The extension cannot enumerate folders, browse the filesystem independently, or silently reopen a previous font after the tab is closed.
The file picker is provided by the browser and operating system. Font Autopsy receives the chosen File object only after that user interaction. Supported input names are limited to TTF, OTF, WOFF, and WOFF2 extensions, and the production code rejects an empty file or a file above the local 80 MB safety limit.
File bytes and local parsing
After selection, the extension calls the browser File API to read the selected font into an ArrayBuffer in the current extension page. For SFNT-based TTF and OTF files, it reads a bounded set of standard table directories and table bytes needed for specimen information. For WOFF files, compressed table payloads can be decompressed locally with the browser DecompressionStream implementation.
The parser examines available name, head, hhea, maxp, OS/2, cmap, and fvar information when those tables are present and structurally valid. It performs range checks before reading table offsets and rejects malformed ranges rather than intentionally reading outside the supplied file buffer.
- Parsing occurs in the extension page process.
- No selected font bytes are transmitted to a server.
- No parser result is submitted to analytics or a third party.
WOFF2 handling and estimation
WOFF2 uses transformed and Brotli-compressed font data that this release does not reconstruct into exact SFNT tables. Chromium can still load a valid WOFF2 file through the FontFace API, so Font Autopsy supports visual specimen rendering for that format.
When exact cmap data is unavailable for WOFF2, the coverage view is explicitly labeled as an estimate. The estimate compares local canvas rendering behavior over selected character ranges. The extension does not claim that this heuristic is an authoritative substitute for a decoded cmap table.
FontFace and temporary object URLs
To render the selected font in the extension page, Font Autopsy creates a temporary blob object URL and a FontFace with a generated internal family name. The FontFace is added to the current document font set so the specimen, glyph cells, test pairs, and microscope can use Chromium’s text renderer.
When another font is loaded, when the user presses Clear File, or when the page is being unloaded, the production code removes the prior FontFace when possible and revokes the corresponding object URL. These mechanisms are local browser references; they are not public URLs and are not network destinations.
Text entered in the live specimen
The Live Specimen field accepts a short phrase typed by the user so that the current font can be viewed on chosen text. That phrase remains in the DOM of the open extension page. Version 1.0.0 does not save the phrase to localStorage, IndexedDB, chrome.storage, cookies, a server, or another tab.
The field is limited in length by the interface. Text entered there is used only for local rendering and is cleared when the extension page is closed or when the browser discards the page.
Character mapping and coverage
For formats where an exact cmap table is parsed, Font Autopsy constructs an in-memory mapping between Unicode code points and glyph identifiers. The glyph view uses that local map and caps the initially rendered field so a very large character set does not create an unbounded number of DOM elements.
The Coverage view compares the locally mapped code points against predefined Unicode ranges such as Basic Latin, Greek, Cyrillic, punctuation, currency, arrows, mathematical operators, and miscellaneous symbols. These calculations do not contact a Unicode service.
Width, density, and glyph microscope
The Width view measures selected characters with CanvasRenderingContext2D.measureText using the loaded local FontFace. The Density view renders a bounded glyph sample to a small off-screen canvas and counts local alpha coverage. These measurements are cached only in JavaScript memory for the lifetime of the open specimen.
The Glyph Microscope draws one selected character onto a local canvas together with metric guide lines. When exact font metrics are available they are used; otherwise the interface uses conservative rendering guides and labels browser-derived measurements separately.
Variable font axes
If the parsed fvar table exposes variable-font axes, Font Autopsy reads the axis tag, minimum, default, maximum, and name reference. The associated sliders change CSS font-variation-settings for the active local FontFace.
Axis positions exist only in the page’s current JavaScript state. They are not persisted between sessions, and moving an axis does not alter the original font file.
Kerning and shaping behavior
The Kerning view displays representative letter pairs using Chromium’s shaping and font-kerning behavior. It is intended as a visual comparison surface, not as a full dump of every GPOS pair or shaping rule.
The extension does not send glyph strings to a remote shaping API. Browser shaping happens in the local Chromium process using the font selected by the user.
Storage and retention
Font Autopsy 1.0.0 does not use chrome.storage, localStorage, sessionStorage, IndexedDB, cookies, Cache Storage, or a custom on-disk database for the selected font, analysis results, specimen text, or settings.
The active file buffer, table maps, measurement caches, and FontFace exist in volatile memory associated with the extension page. Clearing the file releases the extension’s references. Closing the page ends the session. Browser or operating-system memory management can retain process pages temporarily outside the extension’s direct control, but the extension does not deliberately create a retained archive.
Network behavior and third parties
The production extension contains no fetch, XMLHttpRequest, WebSocket, EventSource, analytics SDK, advertising SDK, remote script loader, or cloud API integration. It does not download executable code or font metadata from a CDN.
No third party receives the selected font through Font Autopsy. The extension uses Chromium-provided browser APIs and code included in the extension package.
Chrome permissions
The manifest declares an empty permissions array. Font Autopsy does not request host permissions, tabs, history, downloads, storage, clipboard, notifications, identity, geolocation, camera, microphone, or filesystem-wide access.
The action button opens the extension’s own local application page. Creating that extension page does not grant the application permission to inspect unrelated website content.
Security and malformed files
Local font files are untrusted input. The production parser checks table counts, table offsets, lengths, WOFF decompressed lengths, and file-size limits before using parsed values. Unsupported or structurally invalid files are rejected with a user-facing error instead of being silently interpreted as a different format.
No parser can guarantee that every malformed font will be harmless to every browser font engine. Users should still avoid opening suspicious files from untrusted sources. Font Autopsy reduces exposure by keeping processing local, by bounding its own parsing work, and by avoiding external execution or macros.
User controls and deletion
The Clear File command removes the current specimen from the interface, revokes the current blob URL, removes the active FontFace from the document font set when possible, and clears local JavaScript references and measurement caches.
Because version 1.0.0 does not create an extension database or cloud account, there is no separate server-side deletion workflow. Closing the extension tab also ends the local session.
Children and sensitive information
Font Autopsy is a general-purpose typography tool and is not directed specifically to children. It does not ask for a name, email address, date of birth, precise location, payment information, contact list, or advertising identifier.
A user could theoretically type sensitive text into the local specimen field. The extension does not transmit or persist that text, but users should still choose sample text appropriate for their own environment.
Changes to this policy
If a future version adds behavior that materially changes how files, specimen text, permissions, storage, network access, or third parties are handled, the privacy policy should be updated before or alongside that release. The effective date shown in this record applies to version 1.0.0.
Purely editorial corrections that do not change product behavior may be made without changing the technical data flow described here.
Contact and questions
Questions about this privacy policy or the behavior of Font Autopsy can be sent to hanhruiroc@gmail.com. When reporting a technical issue, users do not need to attach the private font file unless they independently choose to share it.
This policy is intended to describe the code path plainly: user-selected file in, local examination in memory, no network transfer, and no retained extension database.