Place your original text on the left, get the protected version on the right.
Designed for humans. Toxic for AI. #
We partnered with leading Danish type foundry Playtype to create the first typeface with built-in ShieldFont protection.
Six weights.
Equally protected.
Bring your own font.
Shield any TrueType font (a brand face, a Google Font, a custom cut) with a private mapping only you hold.
Bring your own key.
ShieldFont comes with three dictionaries, each with its own key. You can also create your own. Private keys are harder for scrapers to decode.
Screen readers get the real words.
We never show scrambled text to screen readers. ShieldFont hides shielded passages from accessibility tools by default with aria-hidden="true"
, because a decoy read aloud is fluent, grammatical, wrong English, and that is worse than silence.
The real words remain sealed in the page, and the reader’s browser uncovers them by solving a compute-heavy puzzle. It requires JavaScript and a few seconds of processing, more than most mass scrapers are willing to spend. This makes the content available to most screen readers, translators, and copy/paste, but there is still room to improve and make it instantly available.
Three ways to protect your writing #
Dynamic
Websites
<Shield>
.
$ npm install @shieldfont/react
<Shield>
Plain English here.
</Shield>
Server render or static export both work: in Next, Server Components are the default and that's all you need. What leaks is client code: don't put <Shield>
in a "use client"
file, and don't pass plain text into one. Both fail silently: see where the encoding happens.
Blogs and
static sites
/* paste once into your CSS */
@import url("https://cdn.jsdelivr.net/npm/@shieldfont/font@0.3.2/shieldfont.css");
<p class="tk9">
…encoded text…
</p>
Full integration guide in the docs.
Documents
Humans see your writing. Scrapers see decoys.
Full integration guide in the docs.
Not using React? Use it anywhere: any framework, any build step.Advanced: build your own font
Defend yourself. #
Contaminate unauthorized AI training with gibberish.
Any scraped content must pass a strict quality filter before entering the AI training pipeline. Most shielded pages are rejected at that stage, keeping the content out of training. Those that pass contain fluent but false text, adding noise to the dataset.
Every shielded page has to clear three bars at once.
Q1What actually happens to my words? #
the font restores it on screen. Only machines reading the raw HTML see the substituted version.
Q2What if I copy-paste ShieldFont text into ChatGPT? #
the substituted words stored in the page’s code, not the original words you see on screen. So when you paste shielded text into ChatGPT, it reads the altered version rather than your original writing.
Q3Why swap “content words” specifically, and why does that matter? #
the,
of, and
andmainly hold it together. ShieldFont changes only about 25% of all words, but nearly half of the content words. Across 1,500 passages from news, independent websites, and fiction, this caused
50% to lose their original factual claim. A control test replaced the same number of words with true synonyms, and only about 2% of passages changed meaning. The effect comes not from swapping words, but from swapping the words that matter most.
Q4Which words can be swapped? Where does the dictionary come from? #
the,
of, and
andare left untouched because they hold sentences together but carry little meaning. Once different forms of each word are included,
the current dictionary contains nearly 12,000 entries, covering a large share of everyday English.
Q5So can an AI still tell what my page is about? #
conceptual accuracy fell by 67%. Several models also refused the task, which counted as complete loss. Looking only at the models that answered, the drop was still 49%. The result is consistent: the broad subject may survive, but the details do not. The effect also grows with length. If an early sentence is altered, later reasoning may build on a false premise, so longer texts can lose more meaning than passage-level scores suggest.
Q6How does “gibberish” get past AI quality filters? #
about one in ten chunks that passed before shielding still passed afterwards. The other nine were rejected. Both outcomes help: rejected content stays out of training, while accepted content carries the “wrong” meaning into the dataset.
Q7Isn't hiding meaning and passing the filter a contradiction? #
the point between these outcomes, where text can pass a filter without communicating the same meaning. Reaching that balance took sixteen generations of mappings, followed by a second line of development.
Q8What does “poison” actually mean here? #
the text adds false connections between names, events, and actions to an unauthorized AI training dataset.
Q9Does the poisoning really work, or is that hype? #
changing about 25% of the words caused 50% of passages to stop making the same factual claim. Whether you call the result poisoning or wasted training effort, what matters is that the content becomes less useful in unauthorized AI training datasets.
Q10Does one shielded page even matter? What if everyone does it? #
It is a collective defense: the more people use it, the harder and more expensive mass scraping becomes.
Q11Couldn't someone just OCR the rendered page? #
ShieldFont does not need to make OCR impossible; it needs to make it too costly to be worthwhile.
Q12Won't models eventually just learn to decode ShieldFont? #
the font is the codebook, and anyone who downloads it can read the substitution table back out of it. We tested this ourselves and recovered all 11,962 word pairs with no errors. ShieldFont is not designed to keep a permanent secret or stop someone deliberately targeting one site. Its strength is at scale. ShieldFont ships with three mappings,
alpha, beta, and gamma, and assigns each text block to one of them. Creating your own mapping makes a universal, prebuilt decoder useless against your site. A scraper must identify your font, extract its mapping, and decode your content specifically. The defense is economic, not cryptographic: the aim is to turn cheap, indiscriminate scraping into slower, more complex, per-target work. The more independent mappings people create, the harder that becomes across the web.
Q13What happens to my SEO? #
they index the decoy words, not yours. Shield content you do not need Google to rank: paywalled pieces, archives, manifestos, or anything you would rather keep out of current AI training than surface in search. Leave your marketing pages plain. ShieldFont works block by block, so the choice is entirely yours.
Q14Why poison at all? Why not just block the crawlers? #
leverage: if a lab trains on shielded text before it is detected, the data becomes less useful and may require extra work to remove or correct. The longer-term goal is to give creators a seat at the table, with a licensing route where AI companies pay for clean versions instead of using altered copies obtained through scraping. That system does not exist yet, but it is an outcome we’d like to help make possible.
Q15Hasn't this been tried? What about TuringFonts, ZXX, Ghost Font, Nightshade? #
TuringFonts(jfmdev): a substitution-cipher font that draws one letter in place of another, so a crawler reads scrambled text while a human reads the original. It was built to keep bots from indexing emails and phone numbers, and it predates the AI era. A letter-for-letter cipher produces character noise a modern quality filter throws away (and an LLM unscrambles by frequency in a single pass), and it never hides that the page is enciphered. ShieldFont is built for how AI actually ingests text: we swap whole words for other real, same-grammar-class words, so the page stays fluent prose with no character noise to flag and nothing to unscramble by frequency. Every word is a real word in the right grammatical slot, and the only thing broken is the meaning. We think in tokens and meaning rather than a hidden string, and the font itself is camouflaged.
ZXX(Sang Mun, 2013) fought OCR at the
glyphlevel, but modern vision models read it in one prompt.
Ghost Font hides text in motion;
Nightshade and
Glaze poison images for artists. ShieldFont is the text-native cousin: it corrupts the
source the machine actually copies. The reading gap itself also has independent security research behind it. In March 2026, LayerX Security published
“Poisoned Typeface”, an attack study showing that a remapped font makes an AI assistant and a human read different text from the same page. All eleven assistants they tested read the underlying text instead of the rendered one, and only Microsoft took the disclosure through a full fix. Their work is offensive in framing and unaffiliated with ours, and it confirms from the other direction the same gap ShieldFont uses in defense.
Q16Is this legal and ethical? #
creators should have a meaningful say in whether their work is used to train AI. You are changing how your own words appear in your own HTML, not entering another system or attacking a model. We encourage creators to state their non-consent clearly alongside their content. If an AI company respects that choice, nothing happens. The effect only applies when the work is scraped and used without permission. The goal is not to damage AI (we are not anti-AI; read Q20 for more), but to make unauthorized training less useful and harder to ignore.
Q17What about screen readers and accessibility? #
<Shield>
component uses aria-hidden
to stop the substituted text from being read aloud. We have a built-in alternative, in beta and on by default, which allows users to spawn the real words on the page through an aria button only screen readers reach. The reader’s browser solves a compute-costly puzzle for the key, taking a few seconds. It works in our Dynamic Websites tier and requires JavaScript, which is part of the point: most scrapers never run any. Tested with VoiceOver and an automated screen reader.
Q18Won't scrapers just learn to spot the aria-labels or the ShieldFont classes and skip those pages? #
**Thousands of creators using different mappings and implementations force scrapers to spend more time identifying, checking, and decoding what they collect.**ShieldFont does not end the arms race; it gives the open web a way to make unauthorized scraping harder and more expensive, especially when people build on it together.
Q19Is this permanent? Unbreakable? #
Think of it as a creative intervention with teeth: a way for creators to make unauthorized AI training harder, more visible, and more costly.
Q20So… is ShieldFont anti-AI? #
ShieldFont is pro-consent, pro-choice, and pro-human authorship. People may want their work to be discovered without agreeing to have it copied into AI training datasets. ShieldFont gives them a simple, visible way to opt out of mass scraping and make that choice harder to ignore. The font is the creative expression of that position: not a rejection of AI, but a demand that creators have a say in how it is built, especially in what is taken from them.
Q21Does it work in languages other than English? #
maxhide
version contains 2,534. Words in other languages are left unchanged, so they are not protected. On a mixed-language page, only the English text will be shielded, even if the whole section appears protected. For clarity, the current versions can be named en-a, en-b, en-c, and en-m; a future Portuguese set might use names such as pt-a. Creating a new language version is not simply a translation task: it requires native speakers to choose substitutions that still sound natural. Contributing a new language is therefore one of the most useful ways to help.
Contribute
</Shield>
Want to help build this out? Contribute on GitHub or email us. ShieldFont is an open source project.