Profiles and sessions
Profiles, cookies and site storage are kept on your computer, and what syncs to your other computers is encrypted on your device before it leaves. You sign in with a Browz account to use the app.
Security & privacy
Encrypted end to end. Yours.
Your profiles run on your computer. What syncs through your Browz account (profiles, proxies, settings and browser state) is encrypted on your device first, with a key that comes from your password, so the server stores only ciphertext it cannot open. Nothing in the app can reach your data without your token.
What protects your data
Your data, your keys.
Sealed credentials
Proxy passwords are encrypted at rest when you save them and are never sent back to the app window.
Encrypted archives
Profiles you export are encrypted with your passphrase using scrypt and AES-256-GCM.
Controls
Built to be locked down.
The controls that keep each profile, and the app itself, under your control.
Loopback-only APIThe local API listens on 127.0.0.1 and nowhere else
Rotating tokenEvery request needs a bearer token you can rotate from the app
Origin allowlistOnly the Browz app itself may call the API from a web page
Profile passwordsLock any profile, or many at once, behind its own password
Website blocklistsRefuse chosen sites per profile, before a connection is made
Launch guardsRefuse to start a profile with a broken or moved exit
Remote DNSDNS resolves at the proxy by default, not on your network
Server-blind syncThe account server keeps ciphertext and wrapped keys it cannot open
Local action logA record of creates, launches, stops and deletions
Acceptable use
What Browz is for, and what it isn’t.
Browz is dual-use. The same isolation that keeps an agency’s client accounts apart could be misused, so we name the uses we support and the ones we don’t, and we enforce it.
Built for
- Agencies and freelancers managing client accounts
- Sellers running storefronts on platforms that permit it
- QA and web engineering
- Research and data collection within terms and the law
- Separating personal, work and public identities
Not allowed
- Fraud of any kind, including payment and refund fraud
- Taking over accounts you do not own
- Bulk fake accounts where a platform forbids them
- Evading a ban imposed for abuse
- Malware, phishing, spam, harassment or attacks
Read the full Acceptable Use Policy. We can act on account and payment signals and on evidence in reports. We cannot see your browsing, and we will not build the ability to. Escalation runs from warning to suspension to termination, with immediate termination for the most serious abuse. Suspended accounts can export their data, and appeals are answered by a person.
Report a problem
Found a vulnerability or abuse?
Tell us. Reports of security issues and abuse are acknowledged and investigated.