Privacy Browsers Guide

Most people spend more time inside a browser than inside any app except messaging. That makes the browser a high-value surveillance target: cross-site trackers, fingerprinting, long-lived cookies, permission prompts you clicked once in 2019 and never revoked.

In security research circles we repeat a uncomfortable truth: your browser decides which JavaScript runs when you visit a site. That matters for banking, it matters for webmail, and it matters enormously for any tool that encrypts client-side — including PrivateNote. A privacy-hostile browser does not break AES. It breaks the assumptions around AES.

So I do not treat browser choice like picking a color theme. I treat it like picking a trust anchor.

When I evaluate a browser for daily use, I look for:

Extensions help, but they load after the browser core makes policy decisions. I prefer defaults that are privacy-preserving before I install uBlock Origin — though on Firefox I still install uBlock Origin.

I use Brave for ordinary browsing because it ships aggressive Shields without asking me to maintain a PhD in filter lists. Chromium compatibility means fewer “this site only works in Chrome” rituals, which sounds trivial until you are on a government portal at deadline hour.

Brave is not purity cult software. It has attracted fair criticism over the years — BAT, search partnerships, whatever the current forum thread is angry about. I stay because the default path is still more privacy-preserving than Chrome’s, and because optional Tor windows are a nice escape hatch when I want isolation without launching the full Tor Browser bundle.

Tor Browser is slower, stricter, and occasionally CAPTCHA hell. I still keep it installed because there are sessions where hiding your origin IP and blending into a uniform fingerprint is not paranoia — it is the point.

Researchers, journalists, activists, and anyone probing sensitive services should know Tor’s rules: do not log into personal Google inside the same profile; do not treat it like Chrome with a VPN sticker; accept that latency is the price of multi-hop routing designed to resist traffic analysis.

The Tor Project’s threat model is one of the few that has been beaten on in public for years and survived with honest documentation. That matters more to me than a slick onboarding animation.

Mozilla has taken real punches over the years. Firefox is still the browser I trust when I want open source, nonprofit governance, and containers that keep Facebook’s pixels in a cardboard box labeled “not today.”

Firefox is not privacy-maxed out of the box. Enhanced Tracking Protection in Standard mode is a good start; Facebook Container and Multi-Account Containers are genuinely clever; uBlock Origin still belongs in your toolkit. I recommend Firefox to developers who want tweakability without feeding Google’s browser monoculture.

Practical split: Brave or hardened Firefox for email, banking, documentation, and the boring internet. Tor Browser for sessions where linking my home IP to the activity would be a mistake. Never the two shall meet in the same logged-in identity.

Incognito mode is not a privacy strategy. It is a local history wipe. Your ISP, your employer’s proxy, and the site you visit still see the session. Private windows do not make you private; they make you tidy.

Google Chrome and Microsoft Edge are fast, polished, and deeply integrated with ecosystems that profit from knowing what you do. I use Chrome for testing compatibility, not for living. The security community’s critique is not that Chromium is poorly engineered — it is that the default policies optimize for advertising and data collection, and most users never touch the settings that would fight back.

A hardened browser stops a lot of passive tracking. It does not stop you from pasting a password into Slack. Combine transport privacy with channel discipline.