Read a font file and see how it renders FONTLENS

What a font file will tell you about its own licence

Somebody hands you a .ttf and asks if you can use it in a client's logo. The font itself has the beginning of an answer, in its name records: the copyright string, the designer, the foundry, the licence description, and a licence URL. Those are fields 0, 7, 8, 9, 13 and 14 of the name table, they are text the foundry wrote deliberately, and almost nobody reads them.

They are worth reading because they are frequently the only trace of where a file came from. A font that has passed through three agencies and a shared drive has lost its receipt, its folder and any memory of who bought it, and still carries the foundry's own URL in field 14.

Then there is fsType in the OS/2 table, which is reported here as exactly what it is: two bytes in which a foundry recorded an intention about embedding. It is not the licence. It has no legal force on its own, no application enforces it consistently, and a font marked installable can still be under terms that forbid what you are about to do. It is one signal, and a tool that presented it as an answer would be lying.

Read byte by byte, and why

The sfnt table directory, the name records, head, hhea, OS/2, post, maxp, cmap, fvar and the feature lists inside GSUB and GPOS are all parsed here from the file's own bytes. Borrowing a font library would mean shipping a megabyte of somebody else's code to read a few hundred bytes of header, and would leave nobody on this side able to say where a number on the screen came from.

Two compression formats sit in front of those tables. WOFF wraps each one in zlib, which is undone here. WOFF2 uses Brotli and reorders some tables as it goes, and no browser exposes a Brotli decoder to a page, so a WOFF2 gets its header and table directory read and nothing further. The specimen still renders in both cases, because the browser's own font engine is handed the original bytes and does its own decompression.

Coverage, which is the other question

The cmap tells you which characters the font actually has glyphs for, and this is where a project goes wrong quietly. A font that looks complete in English has no idea what to do with Polish, Turkish, Vietnamese or Greek, and the failure is not an error message: the browser silently substitutes a different font for the missing characters, so one name on a certificate is set in something else and nobody notices until it is printed.

The variable-font axes from fvar and the feature lists from GSUB and GPOS answer the related question of what the font can do: whether the small caps, the old-style figures or the tabular numerals you were promised are in the file, rather than being synthesised badly by the application.

Nothing is uploaded, which for fonts is worth stating plainly: a licensed font is a purchased asset, and uploading one to an inspection site is a distribution of it.