Best for: people who want a de-telemetried Firefox that still has working sync, an Android build, and an ad blocker on by default — and who don’t need Tor-grade fingerprinting resistance out of the box.

Pros

Telemetry is removed at build time, not just switched off — crash reports, health reports, and the Normandy/Shield/Nimbus experiment systems are stripped and locked, so no configuration change can be pushed to your browser remotely
A built-in ad and tracker blocker is on by default, using uBlock Origin filter syntax with core, privacy, and cookie-annoyance lists bundled so it works from the first launch offline
DNS resolves over Oblivious HTTP on new profiles: the relay (run for Waterfox by Fastly) sees your IP but not the query, and Cloudflare’s resolver sees the query but not your IP — a genuine step above a plain encrypted-DNS default
Google Safe Browsing is removed entirely, and certificate revocation uses bundled CRLite data instead of live OCSP calls, so new HTTPS sites don’t trigger a lookup to their certificate authority
Firefox Sync still works and is end-to-end encrypted through a Mozilla account, and there is an official Android build on Google Play
Unusually specific documentation: the privacy policy lists every network connection the browser makes on its own, who receives it, and the setting to stop it, and a governance page names the company, its registrations, and its sole director
A written policy against building large language models into the browser by default, with constrained on-device ML (translation, alt-text) kept and LLM features left to user choice

Cons

Anti-fingerprinting out of the box is Firefox-level: Resist Fingerprinting is an advanced about:config option Waterfox does not enable, so the default defense is the tracker-list blocking in Enhanced Tracking Protection, and a fresh install still tests close to unique
The built-in blocker allows ads on Waterfox’s own search-partner pages by default — a deliberate trade-off to fund the project, disclosed in the settings, but an exception a stricter blocker wouldn’t make
Development is one person — Alex Kontos, the founder, sole director, and owner of BrowserWorks — with occasional contributors, so the bus factor is a real long-term risk
Funding is admittedly thin: after Microsoft ended its Bing search partnerships the founder describes revenue as “okay, not much”, and the project is leaning on a new paid metasearch subscription to stay independent
No independent security audit of Waterfox has been published, and there is no bug-bounty or security-disclosure page — the shipped SECURITY file is the inherited Firefox one pointing at Mozilla’s Bugzilla
The browser was owned by the advertising company System1 from 2019 to 2023 before the founder bought it back; the current project is independent, but the episode is part of its history
No iOS build, and the discontinued Waterfox Classic branch still carries unpatched security advisories for anyone who kept it installed

Privacy Defaults

Waterfox starts from a better place than stock Firefox. Telemetry isn’t a toggle here — the modules are removed when the browser is compiled and the switches locked, and the experiment frameworks that let a vendor push changes to your browser are off and locked too. Google Safe Browsing and its download-reputation service are stripped out completely. The built-in ad and tracker blocker is on from first launch with bundled lists, so a fresh profile is already filtering. Enhanced Tracking Protection runs in its Standard mode with Total Cookie Protection, and certificate revocation is handled from bundled CRLite data, which means visiting a new HTTPS site doesn’t phone its certificate authority the way the upstream default can.

The standout default is DNS. New profiles resolve lookups over Oblivious HTTP: a relay — a Waterfox-branded endpoint that Fastly runs — sees your address but not what you asked, and Cloudflare’s resolver on the other side sees the question but not who asked it, so no single party has both halves. That’s a design most privacy browsers leave as a manual choice or don’t offer at all.

Two things keep this out of the top tier. The blocker ships with an exception that permits ads on Waterfox’s own search-partner pages — the project is upfront that this is how it funds itself, and it’s a setting you can flip, but it’s a carve-out. And search suggestions, when left on, send your keystrokes to a proxy Waterfox runs; the company says IP addresses are dropped immediately and nothing is logged against an identifier, which is a reasonable design, but it is still a connection the browser makes as you type.

Anti-Fingerprinting

This is where the “hardened Firefox” framing has a limit. Waterfox does not turn on Resist Fingerprinting — the browser’s own support article treats it as an advanced setting you’d go into about:config to check or disable, not something shipped on. Without it, the fingerprinting defense you get by default is what Enhanced Tracking Protection’s Standard mode provides: blocking scripts from domains on the Disconnect list that are known or suspected fingerprinters. That stops list-known actors from loading, but it doesn’t standardise canvas, WebGL, font enumeration, screen metrics, or audio characteristics, so a determined script can still read them.

The practical result is that a stock Waterfox tests close to unique on EFF’s Cover Your Tracks, the same as vanilla Firefox. Turning on Resist Fingerprinting is a one-preference change and Waterfox doesn’t fight you on it, but it brings the familiar trade-offs — a spoofed timezone, a forced light theme, canvas breakage — and it isn’t the default. If cross-site fingerprinting is part of your threat model, Waterfox as shipped is not built to blunt it.

Transparency & Audits

Waterfox is genuinely open. The full tree — Mozilla platform code plus Waterfox’s product code, branding, and packaging — is on GitHub under the Mozilla Public License, and it builds with the standard Mozilla ./mach commands. The changelog is public and detailed. The privacy policy is the most thorough in this section by a wide margin: it enumerates every host the browser contacts on its own, why, and how to switch it off, and invites you to verify the list yourself with network logging. A governance page names BrowserWorks Ltd, its Companies House and ICO registrations, and its sole director. There’s a written stance against default LLM features. On disclosure, this is a strong record.

What holds the score down is the shape of the project. Development is one person with occasional help, which makes continuity a real question. Funding is precarious by the founder’s own account — search revenue dropped when Microsoft wound down its Bing partnerships, and the project is now leaning on a paid metasearch subscription to stay independent. There is no published independent security audit of Waterfox, and no bug-bounty or dedicated security-contact page; the shipped security document is the inherited Firefox FAQ pointing at Mozilla. There’s also no reproducible-build tooling, so you can’t verify the released binary matches the public source. And the history includes a stretch under an advertising company, System1, from 2019 to 2023 before the founder bought the project back. None of these is a scandal, and the absence of an audit alone isn’t a mark against a small project — but together they describe a trustworthy-looking browser resting on a thin base.

Usability & Compatibility

Because it’s Firefox underneath, Waterfox behaves like Firefox: the engine and performance are the same, Firefox extensions install and run, and DRM video works once you allow it. On top of that Waterfox adds things Firefox doesn’t ship — a built-in ad blocker with a filter-list manager, tree-style tabs with split view and group tabs, and a deep interface-customisation pane with over a hundred options. Extensions don’t have to be signed, which helps anyone running niche or self-built add-ons. Sites render as they do in Firefox, so day-to-day breakage is minimal.

The trade-off runs the opposite way from an aggressive privacy build: little breaks, but there’s a lot of surface area, and the pace of change can bite. A recent release rewrote most of the customisation system because a codebase update had broken it, and shipped a few weeks after the version that removed those controls — the kind of churn a one-person project produces. For a user who just wants a quieter Firefox and doesn’t touch the customisation pane, none of that matters; for someone who leans on the deep settings, expect the occasional reshuffle.

Cross-Platform & Sync

Waterfox has official builds for Windows, macOS, Linux, and Android. The Linux side is served through a package repository plus direct tarballs, including ARM64; Windows has separate ARM64 and x64 installers. Android is available only through Google Play, and there is no iOS build.

Sync is Firefox Sync through a Mozilla account, off until you sign in, and end-to-end encrypted — Mozilla holds ciphertext, not readable data. That’s a solid position: better than the forks that remove sync entirely, and the Android build means the account can actually span devices, which desktop-only privacy browsers can’t offer. The dependency it introduces is Mozilla’s account service, which is the same trade every Firefox Sync user makes.

Our Rating

Category	Score	Notes
Privacy Defaults	8/10	Telemetry removed at build time, ad/tracker blocker and Oblivious-HTTP DNS on by default, Safe Browsing stripped; blocker permits ads on the vendor’s own search-partner pages by default
Anti-Fingerprinting	4.5/10	Resist Fingerprinting is not enabled by default; the out-of-the-box defense is tracker-list blocking, and a fresh install tests close to unique
Transparency	6/10	Fully open under MPL, unusually detailed privacy and governance docs; but a one-person team, thin funding, no independent audit or reproducible builds, and a 2019–2023 stretch under an ad company
Usability & Compatibility	8/10	Firefox engine and extensions, plus a built-in blocker, tree tabs, and deep customisation; fast-moving releases from a small team can reshuffle settings
Cross-Platform & Sync	7.5/10	Windows/macOS/Linux plus an Android build; Firefox Sync is end-to-end encrypted but off by default, and there’s no iOS version
Overall	6.7/10	Weighted: Privacy Defaults 30% · Anti-Fingerprinting 25% · Transparency 20% · Usability & Compatibility 15% · Cross-Platform & Sync 10%

Waterfox does the un-glamorous part well: it’s a real Firefox fork with telemetry compiled out, an ad blocker and Oblivious-HTTP DNS on by default, working sync, and an Android build — a genuinely more private Firefox that still behaves like one. Where it lands mid-pack is the two things that carry the most weight. Fingerprinting resistance out of the box is Firefox-level, because the strong defense is an option the browser doesn’t enable. And the transparency picture, strong on documentation, is undercut by a project resting on one developer and uncertain revenue. If you want a quieter Firefox that syncs and runs on your phone, Waterfox is a reasonable pick. If you want the browser to also make you hard to fingerprint, or you need the reassurance of an audited, well-funded project behind it, look further down the list.

Affiliate Disclosure

Waterfox has no affiliate program for sites like ours, and this review carries no tracked link — the “Visit Site” button points to Waterfox’s own download page and earns PrivacyPick.com nothing. The browser is funded by search partnerships, an optional paid metasearch subscription, and donations; our rating and what we write are unaffected either way.

Rating: 6.7/10