Font Tools
Font Tools is a GPL-3.0-or-later, local-first browser workbench for inspecting TTF, OTF, TTC, OTC, WOFF and WOFF2 fonts. It inventories SFNT and OpenType-layout tables, names, metrics, Unicode coverage, variable axes and OS/2 embedding restrictions; provides a browser shaping/comparison lab; generates inert CSS; and can rebuild a deliberately simple static outline subset when machine-readable restrictions permit it.
Files never leave the browser. Parsing and subsetting run in a disposable worker
with an 8-second operation limit. Preview rendering is contained in a scriptless
sandboxed frame. WOFF2 inspection uses Fontkit's pinned browser build and local
Brotli decoder under the strict no-unsafe-eval CSP; it never calls a
conversion service. TTC/OTC 1.0 and 2.0 headers, up to 64 unique aligned face
offsets, every selected SFNT directory and optional DSIG boundaries are
validated before Fontkit exposes the face list. Selecting a face rebuilds a
bounded standalone SFNT only for the sandboxed in-memory preview.
WOFF2 and collection static subset export remain disabled until those paths can
preserve the same source-metadata guarantees as the SFNT/WOFF writer. Font
Tools does not export a selected collection face or rebuild TTC/OTC containers:
shared tables, face ordering and DSIG data would require a dedicated
round-trip-safe writer. Generated collection CSS uses format("collection"),
but CSS cannot portably address the selected face by numeric index; verify
family/style matching or deploy an authorized standalone face prepared by
suitable tooling.
Limits: 16 MiB input, 64 MiB declared or reconstructed SFNT size, 64 collection faces, 128 tables per face, 65,535 glyphs, 250,000 Unicode mappings, 20,000 preview characters and 1,024 subset glyphs. Suspicious WOFF ratios, invalid WOFF2/TTC declarations and SFNT table bounds are rejected before the font library sees the data. Shaping comparisons use the browser engine and therefore reflect that browser rather than a portable HarfBuzz reference result.
Run npm ci, then npm run check, npm run test:browser, and
npm run package:release -- --force. Copyright © 2026 Albrecht Degering.