The manual,
such as it is.

Installing

evil ships as a normal desktop application. No package manager gymnastics, no post-install script that wants your root password.

Windows

1. Run the installer Double-click evil-1.0.0-x64.exe. It installs per-user by default — no admin prompt.
2. Machine-wide install Run it from an elevated prompt with /allusers to install into Program Files.
3. Silent install evil-1.0.0-x64.exe /S /D=C:\Apps\evil for deployment; /S must come first.

macOS

1. Open the disk image Drag evil into Applications, then eject the image.
2. First launch Gatekeeper verifies the notarized signature — it may take a few seconds the first time.
3. Homebrew brew install --cask evil once the cask lands, post-1.0.

Linux

# AppImage — no install, just run
chmod +x evil-1.0.0-x86_64.AppImage
./evil-1.0.0-x86_64.AppImage

# Debian / Ubuntu
sudo apt install ./evil_1.0.0_amd64.deb

# Fedora / RHEL
sudo dnf install ./evil-1.0.0.x86_64.rpm

The .deb and .rpm packages register the apt/dnf repository so updates arrive through the system updater. The AppImage updates itself instead.

First run

The first launch asks three questions and then gets out of the way. Every answer is changeable later in evil://settings.

• Import from — pick an existing browser, or skip.
• Shield level — Standard (recommended), Strict, or Off.
• Search engine — DuckDuckGo is the default; Google, Brave, Startpage, Kagi and Mojeek are one click away.

There is no account step, because there are no accounts. Nothing is uploaded during setup, and the browser makes no network request at all until you type something into the omnibox.

Importing your data

evil reads profile data directly from other installed browsers — nothing is exported to a file first, and nothing passes through a server.

Import runs again any time from evil://settings/importData. Re-importing merges rather than duplicates: bookmarks are matched on URL + folder, passwords on origin + username.

Shields & blocking

uBlock Origin is compiled in rather than installed as an extension, so it isn't subject to the Manifest V3 restrictions that gutted content blocking elsewhere. Full filter syntax, full dynamic rules, real cosmetic filtering.

Levels

• Standard — EasyList, EasyPrivacy, uBO filters, badware and annoyance lists. Blocks ads, trackers and cookie banners. Nothing breaks.
• Strict — adds third-party frame blocking, remote font blocking and strict CSP injection. Expect a handful of sites to need an exception.
• Off — per-site or globally. Off is off; no "acceptable ads" arrangement exists here.

Per-site control

Click the shield in the toolbar (or press Alt S) for the current site's counters and toggles. Changes are scoped to the eTLD+1 and persist until you clear them.

Custom filters

Paste your own lists into evil://settings/shields/filters. Anything valid in uBlock Origin is valid here, including ## cosmetic rules, $removeparam, and scriptlet injections.

! Kill a specific overlay
example.com##.paywall-modal
! Strip tracking parameters site-wide
*$removeparam=fbclid
*$removeparam=utm_source

Fingerprint protection

Blocking trackers stops the obvious surveillance. Fingerprinting is the quieter kind: a site measures how your machine renders a canvas, what audio pipeline you have, which fonts are installed, and stitches those into an identifier that follows you without a cookie.

evil injects deterministic per-session noise into the surfaces that leak most:

The noise seed rotates per session and per eTLD+1, so two tabs on different sites can't be correlated, but a single site sees a stable machine for the length of your visit — which is what keeps logins and canvas-based captchas working.

Burn-all

One control, one keystroke: Ctrl Shift Del (⌘ Shift Del on macOS), or the flame in the toolbar.

A burn clears, across every profile:

• Cookies, localStorage, sessionStorage, IndexedDB and Cache Storage
• Browsing and download history
• HTTP cache, DNS cache and the socket pool
• Service workers and their registrations
• Autofill session data and form state

It deliberately does not clear bookmarks, saved passwords or settings. Configure exceptions — sites whose cookies survive a burn — in evil://settings/burn.

Burn on exit

Turn on burn on exit and every close is a clean close. Combine with restore session for the mildly contradictory but very popular setup where tabs come back and nothing else does.

Profiles & containers

Profiles are fully separate browser instances: their own cookies, extensions, history and settings. Containers are lighter — separate cookie jars inside one window, colour-coded per tab.

• Ctrl Shift M — profile switcher
• Ctrl . — reopen the current tab in a container
• Right-click a link → Open in container to route it permanently

Container assignment rules live in evil://settings/containers: map a domain to a container and every navigation to it lands in the right jar, no matter where the link came from.

Extensions

evil runs Manifest V2 and V3 extensions from the Chrome Web Store and from local .crx files. Two ship pre-installed:

• Tampermonkey — userscripts, with the full V2 API surface intact.
• Cookie-Editor — inspect, edit, and export cookies per site.

Neither is mandatory; remove them like any other extension. Sideloading unpacked extensions needs developer mode in evil://extensions.

Search & the omnibox

No search suggestions are sent anywhere unless you turn them on — the omnibox is inert until you press Enter. Prefix a query with a bang to jump engines for one search:

!g   Google          !ddg  DuckDuckGo
!w   Wikipedia       !gh   GitHub
!yt  YouTube         !a    Archive.today

Add your own in evil://settings/search, including any OpenSearch-capable site with a %s placeholder.

Performance

The build strips Google's update service, Safe Browsing pings, field trials and crash reporting, then rebuilds Chromium with link-time optimization and profile-guided optimization on top.

Tab management

• Background tabs are frozen after five minutes idle and discarded under memory pressure.
• Discarded tabs keep their title, favicon and scroll position; they reload on focus.
• Pinned tabs, tabs playing audio, and tabs holding an active WebSocket are never discarded.

Low-memory mode

Under 4 GB of RAM, evil lowers the renderer process cap, shortens the freeze timer and disables tab preview thumbnails. Force it on any machine with --force-low-memory, or off with --no-low-memory.

Command-line flags

All standard Chromium switches work. These are the ones evil adds:

Enterprise policy

evil reads Chromium's policy format from the usual places, plus its own EvilShields, EvilBurn and EvilUpdate keys.

Windows  HKLM\SOFTWARE\Policies\evil\
macOS    /Library/Managed Preferences/st.evil.browser.plist
Linux    /etc/evil/policies/managed/*.json

{
  "EvilShields": "strict",
  "EvilBurnOnExit": true,
  "EvilUpdateChannel": "stable",
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": ["cjpalhdlnbpafiamejdnhcphjbkeiagm"]
}

Active policies are listed at evil://policy, with a per-key note on where each value came from.

Updates

Updates are checked once every 12 hours against updates.evil.st. The request carries the current version, platform and channel — no identifier, no cookie, no history.

• Downloads are delta patches where possible, full packages otherwise.
• Every package is signature-verified before it is applied.
• Nothing installs while the browser is running; the swap happens on next launch.
• Turn the whole mechanism off in evil://settings/updates — no nag screens.

Security fixes from upstream Chromium are merged and shipped within 72 hours of the upstream release, on every channel.

Building from source

evil is open source under BSD-3, the same licence as Chromium. The browser lives at evil-browser/evil and this website at evil-browser/evil.st.

The repository is a patch set, not a copy of the Chromium tree: a few hundred kilobytes of patches, GN arguments and packaging scripts. Chromium itself is fetched at build time and pinned in CHROMIUM_VERSION. That is what keeps the diff against upstream small enough to read, and what lets a Chromium security fix ship as a version bump rather than a merge.

Five commands

git clone https://github.com/evil-browser/evil.git
cd evil
make bootstrap    # depot_tools, prerequisite checks
make sync         # fetch Chromium at the pinned tag
make patch        # apply patches/series
make build        # gn gen + autoninja
make package      # installers into dist/

make help lists every target. Each one wraps a script in scripts/ that takes more options than the Makefile exposes.

What you need

• About 100 GB of free disk, and 16 GB of RAM.
• A first build of 2–6 hours; incremental builds take minutes.
• Platform prerequisites: Xcode 15 on macOS, Visual Studio 2022 on Windows, or the packages listed in the Linux page of the build docs.

Reading the patch set

Patches are grouped by what they do and applied in the order given by patches/series:

patches/build/      toolchain and GN changes
patches/branding/   product name, icons, the evil:// scheme
patches/privacy/    Google service removal, fingerprint defences, burn-all
patches/features/   content blocker, containers, tab management

If you want to check a specific claim from the privacy page — that nothing is sent, that a burn really clears the socket pool — the patch implementing it is in one of those directories, and the verification procedure is in docs/TESTING.md.

Full instructions, including cross-compilation and the common failure modes, are in docs/BUILDING.md. Contribution guidelines are in CONTRIBUTING.md.

Keyboard shortcuts

Chromium's shortcuts are unchanged. These are the additions — Ctrl is ⌘ on macOS.

File locations

Where your profile lives, for backups and for the times you need to delete it by hand.

Windows  %LOCALAPPDATA%\evil\User Data\
macOS    ~/Library/Application Support/evil/
Linux    ~/.config/evil/            (config)
         ~/.cache/evil/             (cache)

Copying the whole User Data directory to another machine on the same OS is a supported migration path. Passwords are encrypted with an OS-provided key, so they will not decrypt on a different machine or user account — export them separately.

Troubleshooting

A site is broken

Set shields to Off for the site (Alt S) and reload. If that fixes it, step back up to Standard — most breakage comes from Strict's frame and font blocking. If it persists with shields off, try --no-fingerprint-noise: a small number of sites hash a canvas for anti-bot checks.

Video won't play

Widevine ships with the official builds, so Netflix, Spotify and friends work out of the box. If a stream refuses, check evil://components — the Widevine CDM downloads on first use and can fail behind a restrictive firewall.

The browser won't start

Launch with --user-data-dir=/tmp/evil-test. If a fresh profile starts, the old one is damaged: rename User Data, start once, then copy back Bookmarks and Login Data.

Everything is slow

evil://memory ranks tabs and extensions by resident set. Extensions are the usual culprit; disable all of them, confirm, then re-enable one at a time.

Collecting a log

evil --enable-logging=stderr --v=1 2> evil.log

The log contains URLs you visit — read it before you send it anywhere.

Uninstalling

# Windows — Settings > Apps, or:
"%LOCALAPPDATA%\evil\Application\uninstall.exe" /S

# macOS
rm -rf /Applications/evil.app ~/Library/Application\ Support/evil

# Linux
sudo apt remove evil        # or: sudo dnf remove evil
rm -rf ~/.config/evil ~/.cache/evil

The Windows uninstaller asks whether to keep your profile; the answer defaults to keep. Nothing is reported back when you uninstall, which is either a privacy feature or a business mistake depending on who you ask.