Brave

Best for: people who want strong ad and tracker blocking out of the box on a browser that still behaves like Chrome — and who are willing to turn off the crypto features and telemetry they didn’t ask for.

Pros

• Shields block third-party ads, trackers, and cookie-consent pop-ups on every site by default, with no extension to install or configure
• Built on Chromium, so Chrome extensions, DRM video, and site compatibility all work the way people expect
• Available on all five major platforms — Windows, macOS, Linux, Android, iOS
• Brave Sync is end-to-end encrypted with no account: a device chain is set up from a BIP39 seed phrase, and Brave’s servers never see plaintext or even know how many devices are connected
• Fully open source under MPL 2.0, a Chromium fork with Google’s telemetry and account hooks removed
• Fingerprint randomisation (farbling) is on by default and produces a non-unique result on single-session tests
• HTTPS upgrades, a built-in blocker, and optional Tor windows are all available without add-ons

Cons

• Telemetry is opt-out, not absent: privacy-preserving analytics (P3A), crash reports, and a daily usage ping all run until you turn them off in settings
• Ships with crypto features most people won’t use — Brave Rewards, a wallet, and the BAT token; they’re opt-in and off by default, but Brave has been criticised for pushing them in the UI over browser improvements
• Two trust-history marks for a privacy browser: a June 2020 episode where the address bar added Brave’s affiliate code to typed crypto-exchange URLs without asking, and a 2021 bug (CVE-2021-21323) where DNS lookups from Tor windows leaked to the user’s DNS provider for months. Both were reported, acknowledged, and fixed
• Its anti-fingerprinting is randomisation, not a shared profile — effective against casual tracking but shown by 2025 research to be fragile against determined trackers
• Shields occasionally break sites — checkout forms, embedded video — though the fix is a one-click toggle
• No published independent security audit of the browser itself — Brave relies on its open codebase, a HackerOne bug bounty, and internal reviews (the 2024 third-party audits cover its separate paid VPN, not the browser)
• Funded by venture capital (including Founders Fund) and a 2017 token sale, and monetised through its own ad platform — a very different model from a non-profit or a donation-funded project

Privacy Defaults

Brave’s headline feature is Shields, on by default on every site: it blocks third-party ads and tracking scripts, strips many cross-site cookies, upgrades connections to HTTPS where possible, and dismisses cookie-consent banners. For a mainstream browser this is a genuine step up from installing an ad blocker yourself, because it’s the default rather than an opt-in, and it covers fingerprinting randomisation in the same package.

The gaps are around the edges. Telemetry is opt-out: P3A analytics, crash reporting, and a daily usage ping are enabled on a fresh install and have to be switched off in Settings → Privacy and Security → Data Collection. Brave argues P3A is designed to be non-identifying, but it’s still data leaving your machine by default. The crypto layer — Rewards, the BAT token, the wallet — is opt-in and off until you turn it on, which is the right default; the friction is that it still occupies space in the UI. None of this is hidden, but it means the out-of-the-box state isn’t quite the most private state — a few minutes in settings gets you the rest of the way.

Anti-Fingerprinting

Brave’s approach is randomisation, which it calls farbling: each session, and separately for each site, the browser feeds slightly randomised values to the APIs commonly used for fingerprinting — canvas readback, the Web Audio API, WebGL, and others. On a single-session test like EFF’s Cover Your Tracks, a fresh Brave install typically comes back with a randomised, non-unique fingerprint, which is a real improvement over an unprotected browser.

The limitation is structural. Randomisation makes you look different each time rather than making you look like everyone else, and a tracker that expects randomised output can sometimes recognise the randomisation itself. A 2025 research paper specifically analysed and defeated canvas-fingerprinting defenses including Brave’s farbling, concluding that no fully deployable defense currently exists and that randomisation-based techniques are comparatively brittle. For casual commercial tracking, farbling helps. Against a determined adversary, it’s weaker than a shared-profile model.

Transparency & Audits

The code is fully open. brave-core — the buildable source for desktop and mobile — is public on GitHub under MPL 2.0, and Brave is a Chromium fork with Google’s telemetry and sign-in services removed. Anyone can inspect what the browser does.

Two things keep this category from scoring higher. First, the external review picture is thin. There is no published independent security audit of the browser itself — the audits Brave points to (a software audit in February 2024, an infrastructure audit in April 2024) are of its separate Guardian-operated paid VPN. What the browser has instead is the open brave-core codebase, a public HackerOne bug-bounty program, mandatory internal security and privacy reviews for new features, and a SOC 2 Type II attestation that covers the Brave Search API. That’s a reasonable posture, but it isn’t a third-party audit of the browser’s own privacy code.

Second is trust history, and there are two entries. In June 2020 Brave’s address bar was found auto-completing typed cryptocurrency-exchange URLs to versions carrying Brave’s affiliate referral code, enabled by default without notifying users — CEO Brendan Eich called it a “serious error of judgement” and Brave shipped a fix. In 2021, a regression (CVE-2021-21323) caused DNS requests from Private Windows with Tor, including .onion lookups, to bypass the Tor proxy and reach the user’s DNS provider; it went unnoticed for months before being reported via HackerOne and fixed in version 1.20.108. Neither has recurred, and both were handled openly — but on a browser sold on privacy, they’re real data points. Worth knowing too: Brave is funded by venture capital (including Peter Thiel’s Founders Fund) and a 2017 token sale, with revenue from its own advertising platform.

Usability & Compatibility

This is where Brave is strong. Because it’s Chromium underneath, Chrome extensions install and work, sites render the way they do in Chrome, and DRM-protected video (Netflix, Spotify) plays normally. There’s a built-in password manager, sync across devices, and the general experience is that of a mainstream browser with the ads removed — no learning curve, no broken workflows.

The main friction is that Shields sometimes over-blocks: a checkout form won’t submit, an embedded video won’t load, a login loops. The fix is a single click on the Shields icon to lower protection for that site, which is quick once you know to look for it but catches new users off guard. Brave also nudges toward its Rewards and wallet features in the UI, which reads as clutter if you’re not interested in crypto.

Cross-Platform & Sync

Brave covers all five major platforms — Windows, macOS, Linux, Android, and iOS — with official builds. Sync is the standout: it’s end-to-end encrypted and account-free. You create a sync chain on one device, which generates a 32-byte seed rendered as a BIP39 word list; other devices join by entering that phrase or scanning a QR code. The phrase is stretched with scrypt into an AES key, and Brave’s servers store only ciphertext — they can’t read your bookmarks, history, or passwords, and don’t know how many devices are on the chain. It’s one of the better sync implementations in any browser, and it applies here without the caveats that hold back the privacy categories.

Our Rating

Category	Score
Privacy Defaults	8/10
Anti-Fingerprinting	7/10
Transparency	6.5/10
Usability & Compatibility	8.5/10
Cross-Platform & Sync	9/10
Overall	7.6/10

Weighted: Privacy Defaults 30% · Anti-Fingerprinting 25% · Transparency 20% · Usability & Compatibility 15% · Cross-Platform & Sync 10%.

Brave is the most practical private browser for someone coming from Chrome: the blocking is real and on by default, extensions and sites just work, and sync is genuinely private. It loses ground on the things a privacy purist cares about most — telemetry that’s on until you turn it off, a randomisation-based fingerprinting defense that research has picked apart, no independent audit of the browser, a 2020 affiliate-link episode, and a crypto-advertising business model. If you want blocking without leaving the Chromium world and you’re willing to spend ten minutes in the settings, Brave is a strong pick. If you want the browser’s defaults to already be the private option, it isn’t quite that.

Affiliate Disclosure

Brave has no affiliate program a site like ours can join, and this review carries no tracked link — the “Visit Site” button points to Brave’s plain download page and earns us nothing. Our rating and what we write are unaffected either way.

Rating: 7.6/10