Key facts

• ShieldFont is a web font that makes a page show one set of words while its HTML contains another set.
• The project began in October 2025 and receives support from type foundry Playtype.
• Human readers see the original text in the browser, while AI scrapers and search engines receive decoy words.
• Copy-paste and find-in-page also reveal the swapped text, not what is visually rendered.
• The creators recommend shielding only part of a page to reduce the negative effect on search rankings.

ShieldFont is a web font that creates two different versions of the same page: one for human eyes and one for machines. A person reading in a browser sees the words a writer originally chose. A scraper pulling the HTML receives different words that keep the same grammar and roughly the same commonness, so the text still reads naturally but does not carry the author's intended meaning. The project launched in October 2025 with support from the type foundry Playtype, and its creators, Isaque Seneda and Gabriel Abrucio, believe it can help writers and artists fight back against unlicensed AI training.

The idea draws on a long-standing feature of digital fonts. Fonts have always had substitution rules that let a typeface display something different from the exact characters in the code. The classic example is the ligature: when a text contains the letters f and i next to each other, a font can replace the pair with a single combined shape. That rule exists to make typography cleaner. ShieldFont applies the same principle to entire words. The build process first swaps each protected word in the page's HTML for a decoy of the same part of speech. Then the custom font renders that decoy with a glyph that looks like the original word.

This means the page source code is not a secret store of hidden text. The decoy is the only text present. The real words exist only as glyph outlines inside the font file, mapped to the decoy characters. Because a typical scraper never draws the page, it never sees the real words. Search engines and AI crawlers receive the same bytes as a browser, so they index the decoy content. Copy-paste also yields the encoded form, and find-in-page cannot locate words that are visible on screen because the text in the document object model is the swapped version.

Why the swap happens before the page loads

The word replacement must happen on the writer's own machine or server. If the job were left to the reader's browser, the font file would have to contain a complete dictionary that maps every decoy back to the real word. That would turn the supposedly protected page into a plain-text file in a font wrapper. By doing the swap in advance, the served HTML contains only decoys, and the font file contains the shapes needed to draw the original words. The split keeps the two layers separate: one for people, one for software that never opens the page visually.

The swap is not random. Each protected word is replaced with another word of the same kind, and the substituted word is chosen to be roughly as common as the original. This helps the decoy text remain grammatical and natural enough to pass as ordinary Web content. If the decoy text were nonsense, a human scanning the source code could spot the trick immediately, and a language model might become suspicious. But because the words fit the surrounding syntax, the altered page still looks like a coherent article to a machine that only reads text.

Readers become part of the defense

One of the biggest deployment obstacles is accessibility. Screen readers rely on the same document model that scrapers read, so they would encounter the decoy text instead of the real article. The project has addressed this by hiding the protected region from screen readers entirely. That prevents users from hearing a nonsense version of the article read aloud, but it also removes the content from assistive technology. The alternative offered by ShieldFont asks the reader's browser to solve a short puzzle to unlock the real words. VoiceOver on macOS has been verified, while NVDA and JAWS support are still pending. Authors who are not building with React have to construct the accessible alternative themselves.

For Seneda, this friction is not a bug. It is a way to enlist readers in the fight against content scraping. He argues that human brains are far more efficient than machines at certain visual and auditory tasks, such as recognizing letters rendered in a custom font or finding a button on a page. The puzzle that unlocks the real text asks a human to do something a machine would find expensive at scale. In his view, readers can donate that "brain compute" to help keep content from being harvested without permission.

The economics of making scraping harder

ShieldFont's authors are careful not to call it a perfect defense. They state that anyone who has the font file can reverse the substitution. The project ships an inverter that can extract all 11,962 word pairs from the font alone. Headless browsers that render fonts will read the visible text, and OCR or vision-language models that work from screenshots will also see the real content. Frequency analysis across a large corpus can also be used to break a static dictionary. The protection is aimed at the cheapest and most widespread form of scraping: the tools that pull raw HTML and never draw the page.

The underlying attack has been demonstrated in security research. In March 2026, LayerX Security published a paper called "Poisoned Typeface" in which researcher Roy Paz created a page that showed one thing to humans and another to AI assistants. The technique used a substitution-cipher font and CSS that shrank the decoy text to a single pixel. Eleven AI assistants read the page and called it safe, including ChatGPT, Claude, Gemini, and Perplexity. Microsoft was the only vendor to release a fix, and Google closed its own case after six weeks. That research helps explain why font-based deception can be an effective way to confuse machines that assume text is honest.

The measured damage to AI performance is significant. When about a quarter of a page's words are swapped, the meaning fails to survive in 55.8% of news passages tested. General web text lands close to half, and fiction sits near a third. The creators are quick to say that these numbers are not necessarily a measure of how well the encoded text passes quality filters. They also admit that their own damage estimates were measured with the wrong instrument, so the real effect on trained models remains uncertain. What is clear is that a high swap rate can break the semantic coherence of an article, making it less useful as training data.

Seneda frames the project in economic terms. Scraping raw HTML costs almost nothing, while scraping pages protected by ShieldFont would require rendering each page in a browser or running OCR on every screenshot. That gap, measured in cents per page, can become a real burden at scale. He hopes the cost will keep increasing. The roadmap includes more complex cybersecurity puzzles that a scraper would need to solve for every page, as well as dictionary rotation. The repository already offers four mapping variants and a script that creates a private mapping from a seed chosen by the author. Per-deploy rotation, such as unique seeds per site or per time window, is planned for the near future.

Rotation matters because font inversion works no matter what seed is used. A new seed requires a newly built font, which forces an attacker to start over. The authors also mention bring-your-own-key, meaning a site can use its own secret value to generate the decoy mappings. These features are meant to raise the cost of automated extraction while keeping the system easy enough for artists and writers to adopt.

Who should and should not use it

Abrucio says ShieldFont is for people who want to join a creative resistance movement and are willing to pay a small price. The main cost is reach through search engines, because Googlebot and other crawlers index the decoy text. To reduce that cost, a site can shield only key parts of a page and leave the rest available for indexing. This selective approach gives writers a way to protect their most distinctive sentences while preserving some search visibility. Abrucio also warns that anyone who needs to minimize friction, especially when profit or clarity is the main goal, should stay away. Traditional design rules favor user comfort, but he argues that the rulebook sometimes needs to be rewritten when the goal is resistance.

The project is not a complete answer to copyright concerns. It does not stop a crawler that renders the page like a browser, because such a crawler will see exactly what a human sees. ShieldFont only covers the cheaper end of the scraping market: tools that extract text from source code and never draw the page. That is also the end that runs across millions of pages, which is where the authors believe a small deterrent can have a large cumulative effect.

From a cultural perspective, Seneda and Abrucio see the tool as a way to restore the incentive to share work online. Mass scrapers that bypass copyright law discourage makers from publishing, which weakens the collaborative nature of the internet. By making unauthorized scraping more expensive and riskier, they hope to give writers more bargaining power against large technology companies. They compare the friction to CAPTCHAs and paywalls, which are already accepted costs of the web. For them, ShieldFont is an investment in human creativity.

ShieldFont is available for free on GitHub. The code can be copied and modified, but the font that ships with it remains the property of Playtype. A designer who wants a font of their own to give away must build it on an open base. The project sits at the crossroads of typography, security, and content licensing, and it is already stirring debate about whether fonts can be a legitimate line of defense against AI data collection.

Source: Help Net Security News