How a Laser Printer Is Made: Drums, Toner, Firmware and Tracking Dots

A laser printer is made from a light sensitive drum, a laser and spinning mirror that write an invisible charge image onto it, toner powder that sticks to that image, rollers that transfer the toner to paper, and a fuser that melts it in place with heat and pressure. A controller board running an embedded operating system turns your document into that image and talks to the network. Many colour laser printers also add faint machine identification codes to every page, and the Electronic Frontier Foundation advises assuming that all recent colour laser printers do.

This post goes one level deeper than our build of a 3D printer, which shares the same pattern of mechanics plus a networked controller, and it links to our posts on photo metadata (another way documents carry hidden identifying data) and NIST 800-53 MP-6 media sanitization (what to do with a printer's disk at end of life). For the storage inside larger multifunction printers, see how a hard disk drive is made and how an SSD is made.

Printer makers do not publish drum recipes, toner formulations, fuser temperatures or yields. Where no primary source gives a fact, we describe the step in general terms and invent no numbers.

Key takeaways

• Laser printing is electrophotography, the process Chester Carlson patented as "Electrophotography" in US Patent 2,297,691, filed in April 1939 and granted in October 1942. A computer controlled laser replaced the light reflected from an original, an idea the Computer History Museum credits to Gary Starkweather, who built the first laser printer at Xerox PARC within a year of moving there in 1971.
• Every page goes through six stages: charge the drum, expose it with a laser scanned by a spinning polygon mirror, develop the latent image with toner, transfer the toner to paper, fuse it with heat and pressure, then clean and discharge the drum for the next turn.
• The consumables are engineered products in their own right. The drum is a metal tube coated with thin photoconductive layers, toner is a fine plastic powder with pigment, wax and charge control additives, and the fuser is a heated roller or film sleeve pressed against a rubber roller.
• The controller is a small computer. It runs an embedded operating system, a web admin page, print protocols such as IPP, and often scan to email, address books and job storage on flash or a disk. That makes the printer a network host that needs patching like any other.
• IPP Everywhere, a Printer Working Group standard, lets computers and phones print without vendor drivers. The PWG says 98% of printers sold today support IPP/2.0 and DNS-SD. RFC 7472 defines IPP over HTTPS and the ipps URI scheme.
• Cartridges usually carry a chip. The US Supreme Court's 2017 Impression Products v. Lexmark opinion records a maker using microchips to stop discounted cartridges being reused.
• The EFF decoded one colour laser printer family's yellow dot code in detail: a 15 by 8 grid of tiny dots repeated over the page, encoding the serial number, date and time. Its later warnings say tracking may not use yellow dots at all, and that its list of printers is no longer updated.
• IEEE lists IEEE 2600-2008, the hardcopy device security standard, as Inactive-Reserved; evaluations now run through Common Criteria protection profiles.
• The practical baseline is short: change admin defaults, turn off protocols you do not use, require IPPS and HTTPS, update firmware from the maker's signed channel, isolate printers on their own network segment, and wipe stored data before a printer leaves your control.

Raw material to finished printer: the step table

This is the map for the rest of the post. It lists the check at each stage rather than a pass rate, because no maker we could find publishes one.

The steps are where things are made, not one factory's order; drums, toner and laser units often come from specialist suppliers. Step 10 is where security defaults are decided. A printer that leaves the factory with a unique admin password and encrypted protocols turned on is far easier to run safely than one that ships with everything open.

How does laser printing work, step by step?

Laser printing is a version of xerography. Carlson's patent describes forming an electrostatic image on a photoconductive layer, dusting it with powder that sticks only where the charge is, and transferring that powder to paper. A laser printer keeps those steps and swaps the optical copy of an original for a laser that a computer switches on and off.

1. Charge

The drum's surface is a photoconductor: an insulator in the dark and a conductor when light falls on it. A charge roller or a corona wire puts a uniform electric charge across the surface as the drum turns. Many desktop machines use a charge roller in contact with the drum rather than an older corona wire.

2. Expose with a laser and a polygon mirror

A laser diode produces a beam that is switched on and off for each dot. A motor spins a multi faceted polygon mirror at high, tightly controlled speed. Each facet sweeps the beam once across the drum, writing one scan line. An f-theta lens corrects the geometry so the spot moves at constant speed and stays in focus from edge to edge, and a beam detect sensor at the start of each line tells the controller exactly when to begin sending dots.

Wherever the laser hits, the photoconductor conducts and the charge leaks away. The drum now carries an invisible latent image: discharged spots where the page will be dark, charged surface where it will stay white. Some designs replace the laser and mirror with a row of LEDs that writes a whole line at once; the rest of the process is the same.

3. Develop

The developer unit brings toner close to the drum. Toner charges by rubbing against a developer roller and metering blade, or against magnetic carrier beads in dual component systems. A bias voltage makes it jump to the discharged areas of the drum, not the charged background. The latent image becomes a visible powder image.

4. Transfer

Paper, or in most colour machines an intermediate belt, passes a charged transfer roller that pulls toner off the drum. In a tandem colour printer, four drums (cyan, magenta, yellow and black) lay their images onto the belt in register, the belt transfers all four to paper in one pass, and sensors read test marks to correct colour misalignment.

5. Fuse

The image is still loose powder held by static. In the fuser, heat melts the toner's resin and pressure pushes it into the paper fibres, where it cools into a permanent film. That is why pages come out warm.

6. Clean and discharge

A cleaning blade scrapes leftover toner into a waste area, and light or an erase field neutralises the drum for its next rotation.

What are the parts, and how are they made?

The photoconductor drum

The drum starts as an aluminium tube. It has to be very round and very smooth, because every scratch or wobble shows up as a repeating defect on paper. After machining and cleaning, organic photoconductor (OPC) drums are dip coated: the tube is lowered into a coating solution and drawn out at a controlled speed, so the thickness of the film depends on the pull rate and the solution's viscosity. A typical OPC drum has a thin undercoat that blocks charge from the metal, a charge generation layer that absorbs the laser light and creates charge carriers, and a thicker charge transport layer that moves those carriers to the surface and protects the layers beneath.

Organic drums wear as the cleaning blade and paper rub them, so they are consumables, often built into the toner cartridge in desktop printers. Some longer life designs use amorphous silicon instead, deposited as a hard film. They cost more to make and last much longer, which is why they appear more often in machines designed around separate toner and drum replacement.

Toner

Toner is a plastic powder, not ink. The resin, often a styrene acrylic or polyester, is what melts in the fuser. Pigment gives colour (carbon black for black toner), a wax helps the melted toner release cleanly from the fuser roller, a charge control agent sets how strongly and with what polarity the particles charge, and surface additives such as fine silica keep the powder flowing.

There are two broad ways to make it:

• Pulverised (conventional) toner. The ingredients are melt mixed, cooled into a solid, crushed and then jet milled into fine, irregular particles. A classifier removes particles that are too small or too large.
• Chemical toner. The particles are grown in a liquid by emulsion aggregation or suspension polymerisation. This produces smaller, rounder, more uniform particles, which helps with fine detail and transfer efficiency.

Particle size and charge are matched to each printer's developer design, which is why toner is model specific.

The fuser

A fuser has two main parts. One side is heated: either a metal roller with a halogen lamp inside, or a thin film sleeve that slides over a flat ceramic heating element. The other side is a pressure roller with a thick silicone rubber layer that presses the paper against the heated side. The heated surface carries a non stick release coating, commonly a fluoropolymer, so melted toner does not cling to it.

Temperature control is a safety function. A thermistor reports to the controller, firmware switches the heater, and an independent thermal cut out breaks the circuit if the temperature runs away whatever the firmware does. Film sleeve designs warm up quickly because there is little mass to heat.

The laser scanner unit

The laser scanner unit is a sealed optical box. It holds the laser diode, lenses, polygon mirror, fold mirrors and beam detect sensor, aligned in the factory. Laser printers are designed so the beam is fully enclosed during normal use; interlocks cut the laser when covers are opened.

The paper path

The paper path is plastic mouldings, steel shafts and rubber rollers driven by motors and clutches. Pickup rollers separate one sheet, registration rollers time it to meet the image, and sensors along the way tell the controller where each sheet is, which is how it knows where a jam happened.

The controller board

The controller, sometimes called the formatter, is the printer's computer. A modern one has a system on chip with one or more processor cores, a raster image processor in software or dedicated hardware, RAM for page buffers, flash storage for the operating system and settings, and network, Wi-Fi and USB interfaces. Larger multifunction printers add a hard disk or SSD for job spooling, scanned images, fax archives and document storage. A separate engine controller usually runs the motors, heaters and sensors in real time and takes instructions from the formatter.

What runs a modern printer?

Embedded operating system

Printer controllers run an embedded operating system: a real time OS on small models, and a Linux based or proprietary OS on larger ones. On top sit the page description language interpreters (commonly PCL, PostScript, PDF and PWG Raster), the scan and fax pipeline, a web server for the admin page, and network services. All of that code, including the open source components inside it, is shipped and updated by the printer maker.

The embedded web server and management protocols

Almost every network printer serves an admin page that shows status to anyone and, behind a login, controls network settings, protocols, address books and firmware. Printers also commonly speak SNMP for monitoring, and fleet tools use SNMP or vendor web APIs to read counters and push settings. Treat the admin page like any other web application login: the default credential is the first thing anyone on the same network will try.

IPP, IPPS and IPP Everywhere

The Internet Printing Protocol (IPP) is the modern way computers send jobs to printers. RFC 8011, published in January 2017, defines the IPP/1.1 model and semantics, and RFC 8010 defines its encoding and transport over HTTP. RFC 7472 defines IPP over HTTPS and the ipps URI scheme, so a client can require TLS from the start. The PWG's IPP guide describes how IPP organises printers, jobs and documents as objects with attributes, and how a client asks a printer what it supports with a Get-Printer-Attributes request.

IPP Everywhere is the PWG standard built on top. The PWG describes it as letting computers and mobile devices find and print to network and USB printers without vendor software. Its required features are IPP/2.0, DNS-SD for discovery, and the PWG Raster and JPEG formats (JPEG only for colour printers), with PDF and IPP-USB recommended. The PWG lists ChromeOS, CUPS, Linux, macOS and Windows among clients and says 98% of printers sold today support IPP/2.0 and DNS-SD.

Discovery uses DNS-Based Service Discovery, specified in RFC 6763. Printers advertise service types such as _ipp._tcp and _ipps._tcp on the local network, which is how your laptop lists printers without you typing an address. The same mechanism means anyone on that network segment can see the printer, so segmentation matters.

On the computer side, CUPS is the open source print system used by Linux and macOS. Its documentation says CUPS creates a self signed certificate for the scheduler automatically and uses a trust on first use policy by default, like SSH. A client can be set to require encryption, refuse unknown roots and validate certificates instead.

Legacy protocols

Most printers still offer raw printing on TCP port 9100, LPD on port 515, and sometimes FTP, Telnet or SMB printing, generally with no authentication or encryption. If your clients all support IPPS, switch these off.

Scan to email, scan to folder and address books

Multifunction printers scan to email over SMTP, to folders over SMB, and look up recipients in LDAP. Each feature means the printer stores a credential, often the most sensitive data on the device. Use dedicated, least privilege accounts with TLS for SMTP and LDAP.

Storage on flash or disk

Printers keep job spools, held jobs, scans, fax logs, address books, certificates and credentials, in flash on small models and often on an internal disk on large ones. Switch on storage encryption and overwrite where offered, and plan sanitisation before the device leaves your control.

How are cartridges chipped and authenticated?

Most current toner cartridges carry a small chip. In general terms it stores identifying data (model, region, capacity), counters such as pages printed or toner used, and status flags such as whether the cartridge is empty. Many printers read the chip to report supply levels and to decide whether to accept a cartridge. Some chips go further and perform a cryptographic challenge and response with the printer, so the printer can check that the chip holds a secret only the maker should have.

The legal record shows how central these chips became. In Impression Products v. Lexmark, decided by the US Supreme Court on 30 May 2017, the opinion describes a maker selling cartridges at full price with no restrictions, or at roughly 20 percent off through a "Return Program" in which buyers agreed to use the cartridge once and return it only to the maker. To enforce that, the opinion says, the maker installed a microchip on each Return Program cartridge that prevented reuse once the toner ran out, and remanufacturers developed methods to counteract the chips. The Court held that the maker's sale of an item exhausted its patent rights in that item, whatever restrictions it attached and whether the sale happened in the United States or abroad. The case was about patent law, not chip design, but it is a primary record of chips used to control reuse.

Two practical points follow. Cartridge acceptance is a firmware decision, so an update can change which cartridges a printer accepts; read the release notes first. And a chip that authenticates a cartridge does nothing for the printer's network security.

What is the firmware update and rollback story?

Printer firmware is updated through the admin web page, a fleet management tool, a USB stick, a print job containing the update, or automatic downloads from the maker. The principles that matter are the same as for any platform firmware, and NIST SP 800-193, Platform Firmware Resiliency Guidelines (May 2018), groups them into three: protect firmware from unauthorised changes, detect when it has been corrupted or tampered with, and recover to a known good state.

For a printer, that translates into questions to ask the maker:

• Are updates signed, and does the device verify the signature before installing? An update path that accepts unsigned images lets anyone with admin access, or with access to an unauthenticated update channel, install arbitrary code.
• Is there a hardware root of trust that verifies the boot chain? Secure boot means the bootloader checks the operating system and the operating system checks its components at every start.
• Is there rollback protection? Without it, an attacker with admin access can install an older signed image that still has a known flaw. With it, the device refuses images older than a stored minimum version.
• How long will the model receive security updates? NIST IR 8259A (May 2020), the IoT device cybersecurity baseline, lists software update capability and device configuration among its core capabilities. A maker's published support period tells you when the model stops receiving fixes.

Rollback cuts both ways for owners. Anti rollback protection is good security, but it also means that if an update changes behaviour you dislike, including cartridge acceptance, you usually cannot go back. Test an update on one device before rolling it across a fleet.

What are machine identification codes, or yellow tracking dots?

What is publicly known

Machine identification codes are patterns that some colour laser printers and copiers add to every page so that a printout can be traced to the device that produced it. The best public documentation comes from the Electronic Frontier Foundation's Machine Identification Code Technology project.

The EFF's DocuColor decoding guide explains how to read the date, time and printer serial number from the tracking code printed by one colour laser printer family. According to the guide, that family prints a rectangular grid of 15 by 8 tiny yellow dots on every colour page, repeated across the whole page with slight offsets. The dots encode up to 14 bytes of 7 bits each, plus row and column parity for error checking; typically around four bytes were unused, leaving 10 bytes of useful data. The dots are hard to see under white light, and the guide notes that they become visible under magnification or blue light, which makes yellow dots appear black.

The EFF's printer issue page frames the concern: in its words, the US government persuaded "some color laser printer manufacturers" to encode each page with identifying information, purportedly to identify counterfeiters, and no law limits how such codes may be used.

What the EFF now says about the list

The EFF kept a list of colour laser printers that did or did not show yellow dots. It has since added two warnings. The 2015 note says documents it obtained through FOIA suggested all major colour laser printer makers agreed with governments to make output forensically traceable, and that it is probably safest to assume all modern colour laser printers include tracking information linked to the serial number. The 2017 note goes further, saying it appears likely that all recent commercial colour laser printers print some kind of forensic tracking code, not necessarily yellow dots, including models the list showed as not producing dots. The list is no longer updated, and the EFF notes that "no" on the list only meant it could not see dots.

So the honest summary is: one scheme was decoded and published in detail; the existence of tracking codes on colour laser output is widely assumed; the exact methods on current models are not publicly documented. Do not rely on any online list to tell you a current printer is untracked.

How counterfeit deterrence features work

Tracking dots are not the only anti counterfeiting feature in imaging equipment. The Central Bank Counterfeit Deterrence Group (CBCDG), which describes itself as a group of 37 central banks and note printing authorities organised at the request of the G10 central bank governors, developed a Counterfeit Deterrence System (CDS). According to the CBCDG, the CDS has been voluntarily adopted by hardware and software makers and prevents personal computers and digital imaging tools from capturing or reproducing the image of a protected banknote. The CBCDG also states that the technology "does not have the capacity to track" the use of a computer or imaging tool.

So there are two mechanisms: counterfeit deterrence refuses to process a banknote, while machine identification codes mark every page for later tracing. The first is documented by the body that runs it, the second mainly by outside researchers.

Privacy implications for ordinary documents

For most office printing, tracking codes are irrelevant. They matter when someone needs a printed document to be anonymous, such as a whistleblower or a journalist's source. The practical lessons are general:

• Assume a colour laser printout may identify the printer, and that the printer may be linked to an owner through sales or service records.
• Monochrome output from other technologies is not covered by the EFF's list, but the EFF notes that forensic investigation of other printing technologies is still possible.
• Scans of a printout can preserve dots, and digital files carry their own metadata, covered in our photo metadata guide.

What security baselines exist for printers and MFPs?

IEEE 2600 family

IEEE 2600-2008, "IEEE Standard for Information Technology: Hardcopy Device and System Security", defines security requirements for printers, copiers and multifunction devices, covering authentication, authorisation, confidentiality, integrity and audit. IEEE's own page says it was board approved on 27 March 2008, published on 30 June 2008, and inactivated on 7 November 2019. Its status is Inactive-Reserved, which means IEEE no longer maintains it, though it remains a useful reference. Companion documents such as IEEE 2600.2-2009 turned the requirements into Common Criteria protection profiles for different operating environments.

Common Criteria protection profiles

Common Criteria is the international framework for evaluating security products against a protection profile, a document that lists the threats, objectives and functional requirements for a product type. The Common Criteria Portal lists, under Multi-Function Devices, the IEEE Standard Protection Profile for Hardcopy Devices in IEEE Std 2600-2008, Operational Environment B (IEEE 2600.2-2009), certified at EAL2+ in 2010 by the German scheme, and the Protection Profile for Hardcopy Devices 1.0, certified in 2017 by the Japanese scheme. In the United States, NIAP maintains the approved protection profiles for products used in national security systems.

These profiles typically cover user authentication, access control on stored jobs, stored data encryption, encrypted protocols, image overwrite, audit logs, signed updates and self tests. For a regulated purchase, ask for the certification report and the exact profile version, then check the current NIAP and Common Criteria lists yourself.

Other baselines that apply

NIST SP 800-88 Rev. 2 (September 2025) covers sanitising printer storage, NIST SP 800-53 Rev. 5 control MP-6 applies to printers as system components, NIST IR 8259A gives a device capability baseline that maps well onto printer features, and NIST SP 800-193 gives the firmware model described above.

Laser, inkjet and 3D printers compared

The 3D printer column reflects our separate 3D printer build.

Dated timeline

Step by step: secure a network printer

These steps assume you own or administer the printer and are working on your own network. Commands are shown for Linux or macOS with CUPS installed; adjust the host name printer.example.lan to your device.

Step 1: Inventory what you have

Find the printers on your network segment through DNS-SD.

# Linux (Avahi): list IPP and IPPS printers with details
avahi-browse -rt _ipp._tcp
avahi-browse -rt _ipps._tcp

# macOS
dns-sd -B _ipps._tcp

Record each printer's model, serial, firmware version, location and owner from its configuration page.

Step 2: Ask the printer what it supports

CUPS ships ipptool, which sends IPP requests from a test file. The bundled get-printer-attributes.test asks for the printer's capabilities.

# Query over IPPS (TLS). Use ipp:// only if IPPS fails, to compare.
ipptool -tv ipps://printer.example.lan/ipp/print get-printer-attributes.test | \
  grep -Ei 'printer-firmware|printer-make|uri-security|document-format-supported|ipp-versions'

Look for uri-security-supported values of tls, the IPP versions offered, and the firmware version attributes if the printer reports them.

Step 3: Check which services are listening

Scan only devices you are authorised to test.

# Common printer ports: web admin, IPP, LPD, raw 9100, SNMP
nmap -sT -p 21,23,80,443,515,631,9100 printer.example.lan
sudo nmap -sU -p 161 printer.example.lan

Turn off every port you do not need.

Step 4: Check the TLS certificate on the admin page and IPPS

openssl s_client -connect printer.example.lan:443 -servername printer.example.lan </dev/null 2>/dev/null | \
  openssl x509 -noout -subject -issuer -dates
openssl s_client -connect printer.example.lan:631 </dev/null 2>/dev/null | \
  openssl x509 -noout -subject -issuer -dates

A self signed certificate with a far future expiry is the factory default on many devices. Replace it with one issued by your internal certificate authority so clients can validate it.

Step 5: Change admin defaults

In the embedded web server:

1. Set a unique, long admin password, stored in your password manager.
2. Require login for configuration pages and for the control panel's admin menu.
3. Restrict who can reach the admin page by source network if the device supports an access list.
4. Turn on audit logging, sent to your log collector if supported.

Step 6: Disable unused protocols and enable IPPS

Turn off, unless you have a named need for each: FTP, Telnet, raw 9100, LPD, SMB printing, SNMP v1 and v2c (use SNMPv3 if you need monitoring), WS-Discovery and any cloud printing services you do not use. Turn on IPPS and HTTPS, and redirect HTTP to HTTPS.

Then add the printer to CUPS with the IPP Everywhere driver over IPPS:

# Add a queue using the driverless "everywhere" model over TLS
sudo lpadmin -p office-mfp -E -v ipps://printer.example.lan/ipp/print -m everywhere
lpstat -v office-mfp

To require validated certificates on a client instead of trust on first use, CUPS documents client settings in client.conf:

# /etc/cups/client.conf (per CUPS "Managing Encryption" documentation)
AllowAnyRoot No
AllowExpiredCerts No
Encryption Required
TrustOnFirstUse No
ValidateCerts Yes

Copy your internal CA certificate to the client before you switch this on, or printing will stop.

Step 7: Segment the network

Put printers on their own VLAN. Let clients reach IPPS (port 631, the IPP default in RFC 8010), let printers reach only the SMTP relay, directory and shares they need, and block outbound internet except for updates you use. Never expose a printer to the public internet.

Step 8: Update firmware from the maker's signed channel

1. Note the current firmware version from Step 2 or the configuration page.
2. Download firmware only from the maker's support site or its built in update service, and read the release notes.
3. Update one test device, confirm printing, scanning and login, then roll out to the fleet.
4. Schedule regular checks and record each model's end of support date.

Step 9: Use least privilege for scan accounts

Create a dedicated SMTP account for scan to email, a dedicated service account with write access to one share for scan to folder, and a read only LDAP bind account. Require TLS for SMTP and LDAP. Rotate these credentials when staff with admin access leave.

Step 10: Wipe stored data before disposal

Before a printer is returned at lease end, sold, recycled or sent for repair:

1. Print or export the configuration so you have a record.
2. Use the device's built in secure erase, data overwrite or "initialise all data" function from the admin menu. The names differ by maker; follow its documentation.
3. Remove your certificates, delete address books and change or revoke any service account passwords the printer stored. The accounts still exist on your side even after the printer forgets them.
4. If the device has a removable disk and your policy or NIST SP 800-88 calls for purge or destroy, remove the drive and handle it with your media sanitisation process.

If you sanitise a removed drive on a workstation, the next block destroys data. Warning: the commands below erase the entire drive. Run them only on the drive you removed from the printer, and confirm the device path first.

# 1. Identify the drive. Check the model, size and serial against the label on the drive you removed.
lsblk -o NAME,SIZE,MODEL,SERIAL,TRAN
# 2. Confirm the device path (replace /dev/sdX) and that it is not mounted.
sudo hdparm -I /dev/sdX | grep -iE 'model|serial|supported: enhanced erase|frozen'
findmnt /dev/sdX || echo "not mounted"

Only when the model and serial match, follow your organisation's approved purge method for that drive type, such as the ATA or NVMe sanitize command, as described in NIST SP 800-88 Rev. 2 and in our media sanitization post. Keep a record of the device serial, method, date and person who did it.

Common mistakes

• Printers on a flat network with default passwords. A printer on the same segment as laptops and servers, with a factory admin password, gives anyone inside a place to read stored scans, harvest the scan to email password and pivot. Segment printers and change the admin password on day one.
• Never updating firmware. Printers sit in corners for years. Their firmware contains web servers, TLS libraries and parsers for complex file formats, all of which receive security fixes. Track firmware versions alongside your other assets.
• Disposing of multifunction printers with disks intact. Leased devices go back, old ones go to recyclers. If the internal storage was never wiped, it can hold scanned contracts, fax logs and stored credentials.
• Leaving legacy protocols on because nobody knows who uses them. Turn one off, watch for complaints, then turn off the next.
• Trusting the default self signed certificate everywhere. Trust on first use is better than nothing, but it does not stop a spoofed printer on a shared network. Issue proper certificates.
• Assuming a monochrome or listed "no dots" printer is untraceable. The EFF warns its list is out of date and not proof of absence.

FAQ

How does a laser printer work in simple terms?

A laser writes your page as a pattern of electric charge on a rotating drum. Toner powder sticks to that pattern, gets pressed onto paper, and is melted in place by a hot fuser. The drum is then cleaned and recharged for the next page.

Do all colour laser printers have tracking dots?

Nobody has published a complete answer. The EFF decoded one family's yellow dot code and now says it is likely that all recent commercial colour laser printers print some kind of forensic tracking code, not necessarily yellow dots. Its list of printers is no longer updated.

Can you see printer tracking dots?

On the decoded printer family, the dots were hard to see under normal light but visible with magnification or under blue light, which makes yellow dots look black, according to the EFF's guide.

Can a printer be hacked?

A network printer is a computer with a web server, network services and stored credentials, so it can be attacked like any other networked device. Changing default passwords, turning off unused protocols, updating firmware and segmenting the network removes most of the common exposure.

What is IPP Everywhere?

A Printer Working Group standard that lets computers and phones discover and print to printers without installing vendor drivers. It requires IPP/2.0, DNS-SD discovery and the PWG Raster and JPEG formats, and recommends PDF and IPP-USB.

What is the difference between IPP and IPPS?

IPP is the printing protocol. IPPS is IPP over HTTPS, defined in RFC 7472 with the ipps URI scheme, so the connection is encrypted from the start. Prefer IPPS for any network printing.

Do printers store copies of documents?

Many do, at least temporarily. Multifunction printers can keep job spools, held jobs, scans and fax logs, sometimes on an internal disk. Use the device's overwrite and encryption features and wipe it before disposal.

Is IEEE 2600 still current?

IEEE lists IEEE 2600-2008 as Inactive-Reserved since 7 November 2019. Printer security evaluations today are done against Common Criteria protection profiles; check the NIAP and Common Criteria Portal lists for the current version.

Where Safeguard fits, honestly

Safeguard does not analyse printer hardware, scan printer firmware images, manage printers or generate hardware bills of materials, and it has nothing to say about drums, toner or fusers. The honest overlap is the software around printing that your team builds. Print servers, release station portals, scanning workflows that push documents into storage, and internal tools that call IPP or a printer's web API are code with open source dependencies. If that code lives in a repository or a container image, Safeguard can scan it (for example safeguard scan --dir . on a checkout, or safeguard scan --image followed by an image name), match components against vulnerability databases, rank findings with reachability analysis, and open fix pull requests when you switch autonomous remediation on. It does not replace any of the printer steps above.

A rebuilt print server or scanning service pulls every dependency again, and printer firmware itself is assembled from open source components that its maker has to keep patched. The same supply chain hygiene you apply to web services applies to the code you write around printers, which is where the section below comes in.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation categories include dependencies, licenses, security posture and findings, and each one is set separately. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds.

3. Gold Registry: start from components that are already fixed

Gold Registry provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs and a completed license check, with signed build provenance (signed with Safeguard's key and verifiable with cosign, SLSA Build Level 3 as the design target) and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. Ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session asked to fix a lodash CVE: it reads the finding and advisory, asks before any command that changes something, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, and pushes nothing. The same flow fits a print release portal or scanning dashboard your team maintains in a JavaScript repository.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code and scans from the terminal. That suits an IT team that keeps print server configuration, CUPS automation and scanning scripts in repositories it prefers to scan locally.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and shows how you choose which tools Claude can use. A team that asks an assistant about its print infrastructure code can keep that assistant limited to the read and scan tools it actually needs.

Click through it at your own pace, or open it full screen.

To try it on your own repositories, download Safeguard and follow the CLI documentation.

Quick check

Sources

• Electronic Frontier Foundation, Is Your Printer Spying On You?
• Electronic Frontier Foundation, List of Printers Which Do or Do Not Display Tracking Dots
• Electronic Frontier Foundation, DocuColor Tracking Dot Decoding Guide
• Printer Working Group, IPP Everywhere
• Printer Working Group, How to Use the Internet Printing Protocol
• RFC 8011, Internet Printing Protocol/1.1: Model and Semantics
• RFC 8010, Internet Printing Protocol/1.1: Encoding and Transport
• RFC 7472, IPP over HTTPS Transport Binding and the 'ipps' URI Scheme
• RFC 6763, DNS-Based Service Discovery
• IEEE SA, IEEE 2600-2008 Hardcopy Device and System Security
• Common Criteria Portal, Protection Profiles
• NIAP, Protection Profiles
• NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization
• NIST SP 800-193, Platform Firmware Resiliency Guidelines
• NIST IR 8259A, IoT Device Cybersecurity Capability Core Baseline
• NIST SP 800-53 Rev. 5
• Central Bank Counterfeit Deterrence Group, Rules for Use
• Supreme Court of the United States, Impression Products, Inc. v. Lexmark International, Inc. (2017)
• CUPS documentation, Managing Encryption
• CUPS documentation, cupsd.conf
• CUPS documentation, ipptool
• Google Patents, US 2,297,691 Electrophotography
• National Inventors Hall of Fame, Chester F. Carlson
• Computer History Museum, Timeline of Computer History, 1971

Last reviewed: 25 October 2026.