ShieldFont fights AI scraping by handing crawlers the wrong words

Isaque Seneda and Gabriel Abrucio built a web font that draws one set of words on screen and leaves a different set in the page’s source code. A person reading in a browser sees the writing as written. A scraper pulling the HTML gets different words in the same grammar, at the same URL, off the same bytes.

ShieldFont started in October 2025 with support from the type foundry Playtype. The site that deploys it pays for the protection. Search engines index the decoy, since Googlebot and an AI scraper receive identical bytes. Copy-paste yields the encoded form, and find-in-page comes up empty for a phrase the reader can see on screen.

“We think this font is for people who want to join a creative resistance movement and are willing to pay a small price to do so. Mostly writers and artists, but more broadly anyone who wants to protect their creativity. The main cost is reach through SEO. To reduce that, you can shield only key parts of your content and leave the rest available for indexing,” Abrucio told Help Net Security.

He draws a boundary around it. “Who should walk away from it: people who need to minimize friction at all costs, especially when profit or clarity is the main goal. Traditional design rules say those experiences should be optimized for user comfort. But in a changing world, the rulebook sometimes needs to be rewritten, especially when the goal is resistance.”

The words get swapped before the page loads

Fonts have always been allowed to draw one thing when the code says another. Type f and then i, and most fonts merge the pair into a single joined shape so the letters stop colliding. Those substitution rules exist for typographic tidiness. ShieldFont points them at whole words.

A build step swaps the words in the page’s code first, exchanging each one for a different word of the same kind and roughly the same commonness. The font then draws the swapped word to look like the word the writer chose. Anything reading the code without drawing the page keeps the swap, which covers scrapers, copy-paste into a text tool, and language models digesting raw HTML.

The swap has to happen on the writer’s own machine or server. Hand the job to the reader’s browser and the entire dictionary ships alongside the page, real words included. The site looks protected. The plain text sits in a file anyone can open.

Readers do the work the machines cannot

A blog’s RSS feed leaks the whole post in plain English, on most platforms by default, because feeds are built from the source data before any font touches it.

Screen readers get the protected region hidden from them, so nobody hears a decoy read aloud. The alternative on offer makes the reader’s browser grind out a puzzle for a few seconds to unlock the real words. VoiceOver on macOS is verified. NVDA and JAWS are pending, and authors working outside React have to build the alternative themselves.

“The project’s friction is actually an invitation for users to donate their ‘brain compute’ to help keep this content from being stolen,” Seneda says. “One of the core insights for ShieldFont is that there are certain compute tasks the human brain can solve at a much lower cost than machines right now – not only processing the pixels of a rendered font, but also tasks like finding a button, whether through vision or audio, which are expensive for machines at scale. And we want to allow everyone to help with their brains, no matter their ability.”

He puts a price on it. “We don’t think people realize how efficient biological brains are. Humans have compute, and that compute is worth money, and we can use it and put it into this fight. It comes down to a battle of commodities: human compute vs. machine compute.”

Anyone holding the font can undo it

Every one of the 11,962 pairs came back out of the shipped font, using the font alone, given an inverter already built. Headless browsers that render fonts read the page as a person does. OCR and vision-language models working from screenshots do the same. Frequency analysis across a large corpus works against a static dictionary.

The reading gap has offensive research behind it. In March 2026, LayerX Security published “Poisoned Typeface,” in which Roy Paz built a page that showed a human one thing and handed AI assistants another, using a substitution-cipher font alongside CSS that shrank the decoy text to a single pixel. Eleven assistants read the page and called it safe, including ChatGPT, Claude, Gemini and Perplexity. Microsoft was the only vendor to see a fix through, and Google closed its own case after six weeks.

The measured damage

Swap about a quarter of a page’s words and the meaning fails to survive in 55.8% of news passages tested. General web text sits close to half, fiction near a third. Seneda and Abrucio decline to claim the encoded text sails through quality filters, and they demote their own numbers on damage to a trained model as measured with the wrong instrument.

The bet is on the price of a page

Seneda puts the economics in cents. “We think about the gap between what scraping costs today (raw HTML scraping) and what it would cost in a scaled ShieldFont scenario (OCR scraping). That is real money, even if it is still only cents per page. It already serves as a small deterrent at scale, but we believe we can find more ways to increase that cost.”

He wants that number to keep climbing. “ShieldFont already includes dictionary rotation and bring-your-own-key, and we can imagine a future where a scraper must solve a different, highly complex cybersecurity puzzle for every page.”

The repository ships four mapping variants and a script that mints a private mapping from a seed of the author’s choosing. Per-deploy rotation, meaning per-site seeds and time windows, sits under near-term roadmap priorities. Font inversion survives any seed, and a new seed requires a newly built font, so rotation raises the attacker’s cost.

What the price buys, in his account, is leverage. “That could give writers real bargaining power against big tech and help restore the incentive to share work online. One of the biggest risks of mass scrapers bypassing copyright laws is that it discourages makers from publishing (we are already seeing people become more protective of their work, weakening the internet’s collaborative nature). So the benefit is primarily cultural.”

Abrucio places the cost alongside things publishers already charge readers for. “We understand that every form of protection introduces friction, from CAPTCHAs to paywalls (e.g. news websites that choose to hide their body text from search engines). We see ShieldFont’s trade-offs as an investment in human creativity: a movement that sparks debate around the ethics of AI training while offering a tool that can make unauthorized scraping more costly and riskier.”

What it stops and what it does not

The code is free to take and build on. The font that ships with it stays Playtype’s property, so a designer wanting a font of their own to give away has to build one on an open base.

A crawler that draws the page the way a browser does reads a shielded article exactly as a person reads it. ShieldFont covers the cheaper end, meaning the tools that grab text out of the code and never draw anything. That is also the end that runs across millions of pages.

ShieldFont is available for free on GitHub.