Receipts, not reassurance.

Chromium itself is not relicensed by NBrowser. The MIT license covers the browser shell and build scripts, not the Electron/Chromium binaries they bundle. The tracker list keeps its own MIT license at src/TRACKER-LIST-LICENSE.txt.

Every artifact has a published SHA-256 digest. Compare it before you run anything. The values below are generated from the same files that are served on the download page — if the page and the file disagree, stop.

Windows PowerShell

Get-FileHash .\NBrowser-Setup-0.3.0.exe -Algorithm SHA256
Get-FileHash .\NBrowser-Portable-0.3.0.exe -Algorithm SHA256

Command Prompt

certutil -hashfile NBrowser-Setup-0.3.0.exe SHA256

A match proves the bytes are the ones this page describes. It does not prove the build is safe — that would require reproducible builds and a signature. It does mean nobody swapped the file between the build and your disk without also editing this page.

Chunked delivery

Cloudflare caps a static file at 25 MiB, so both installers are split into 20 MB parts and reassembled in the browser. Each part is fetched with cache: no-store; the page verifies the assembled byte count and prints the digest when it finishes. If a part fails, nothing is saved.

There is no Authenticode certificate on this binary. A standard code signing certificate costs a few hundred dollars a year, and this project is funded out of a wallet with about two dollars in it. Rather than pretend otherwise, the build is published unsigned, with hashes and the exact source archive.

Windows SmartScreen will likely show “Windows protected your PC” on first run. If you downloaded from this domain and the hash matches, choose More info → Run anyway. If the hash does not match, delete the file.

NBrowser adds no analytics, crash reporting, account sync, ad auction, or update pings. There is no server component for the browser. On launch it opens a local file; it does not call a NIGHTMARE endpoint.

What remains is Chromium's own network stack. Pages you visit, their fonts, scripts and CDNs see the requests they would see in any Chromium browser — minus the requests the tracker shield cancels first. DNS resolution happens through the operating system in direct mode. In Tor mode the session proxy handles both HTTP and DNS.

The shield list is not fetched. It is compiled into src/tracker-hosts.js and shipped inside the app, so there is no list update request, no account, and no server-side filtering.

The landing page itself has no cookies, analytics or third-party requests. The screenshots are local PNGs; the fonts are system fonts.

Default search

DuckDuckGo is the default engine. You can switch to Brave, Startpage or Google in settings. Search suggestions are off; the omnibox sends a query only when you press Enter.

The shield registers a Chromium request hook on the default session. For each non-main-frame request, it extracts the hostname and checks it against an in-memory Set generated from the bundled list. A hostname matches if the exact host or any parent suffix is listed. Matching runs locally; the request URL is not sent anywhere for a decision.

A match is cancelled before the request is issued. The page report keeps per-tab counts of blocked and paused hosts, total requests and third-party hostnames. Those counters reset when the tab navigates. Only the lifetime number of blocked requests is persisted.

Pausing the shield for a site adds its hostname to a local allowlist. The allowlist is keyed on the initiating page host, capped at 200 entries, and survives a browsing-data wipe. This exists because blocking a site's own analytics host can occasionally break a login or checkout.

What it blocks

• Subresource requests whose hostname is in the bundled 77,310-host list.
• Exact hostnames and their subdomains, for example ads.example.com when example.com is listed.
• Same-site analytics endpoints when a site puts them on a listed hostname. The report names the host so you can pause the site if it breaks.

What it does not do

• It never blocks main-frame navigation. If a page itself is on a listed host, you can still open it.
• It does not hide ad placeholders, rewrite HTML, or act as a cosmetic blocker.
• It does not detect trackers hidden behind CNAME cloaking, server-side tagging, or an unknown hostname absent from the list.
• It does not update its list between releases. The list date is 14 November 2026 for this build.
• It does not stop fingerprinting, which happens through APIs rather than hostnames.

If a block breaks a site, open the shield panel and choose Pause on this site, then reload. The exception is local and can be removed from the same panel.

History, bookmarks, settings, the last session and lifetime shield counts live in one JSON file: %APPDATA%\NBrowser\nbrowser-data.json. History is capped at 5,000 entries; the saved session keeps up to 30 http(s) URLs and restores at most 12 tabs. There is no cloud copy, no encryption at rest, and no password. Anyone with access to your Windows account can read it.

Clear browsing data wipes history, the saved session, cookies, local storage and other site storage, the HTTP cache, the auth cache and Chromium's host resolver cache, then resets the lifetime block counter. It deliberately keeps bookmarks, settings and the shield allowlist. The current page reloads without cache.

Downloads go to your normal Downloads folder via Chromium's download manager. The portable build extracts its payload to a temp directory and leaves the data file in the same AppData location; deleting the .exe does not delete your history.

To wipe everything: close NBrowser, delete the data file, then delete %APPDATA%\NBrowser. The uninstaller removes the application; it deliberately leaves the data folder for you to inspect or remove.

The toggle configures a fixed SOCKS5 proxy at 127.0.0.1:9050 for the default session. Before enabling, it opens a TCP connection to that port. If nothing is listening, the toggle stays off. No bundled daemon, no hidden fallback.

When Tor mode is on, .onion navigation is allowed and proxy DNS is used. When it is off, .onion hosts are refused rather than sent to a public resolver. WebRTC hardware codecs are disabled at the command-line level.

What Tor does not do

• It does not make you anonymous against a compromised exit node or a site that fingerprints your browser.
• It does not isolate tabs into separate circuits. Every tab shares the session proxy.
• It does not stop a malicious page from exploiting Chromium or the OS.
• It does not protect a direct-mode session from your ISP or a local network observer.

If your threat model requires Tor Browser's anti-fingerprinting patches and circuit isolation, use Tor Browser. NBrowser is a convenience proxy, not an anonymity operating system.

• Exploits in Chromium, Electron or Windows. Staying current with Electron releases is the mitigation; 0.3.0 pins 33.4.11.
• Malicious extensions — none are supported, so there is no extension attack surface, but also no uBlock Origin.
• Phishing, credential theft, or a site asking for permissions you grant.
• Fingerprinting. NBrowser changes no canvas, font, or timing surfaces.
• Physical access. The data file is plaintext.
• Every tracker on the internet. The shield is a static hostname list, not a research-grade content blocker.

This is a browser by a small studio, not a hardened research project. The honest claim is narrow: no account, no telemetry added by the shell, local history, a bundled tracker shield, session restore, a real data wipe, optional Tor routing, published hashes.

Security reports, hash mismatches, shield false positives, and build problems: security@nuxple.shop. Include the version, the filename, and the SHA-256 you measured. Please do not attach live malware; a description and a link are enough.

There is no bug bounty. There is a real inbox and a person who will read it. Coordinated disclosure is appreciated; if the report is valid, the fix ships in the next build and the release notes say so.

The mailbox alias is part of the nuxple.shop domain. If it bounces, the domain's catch-all routing is not live yet — try again or send through NMAIL to the same address once routing is confirmed.