Questions,
answered plainly.

A desktop web browser built on Chromium, with Google's services stripped out and the tools most people bolt on afterwards — content blocking, fingerprint defence, one-tap data wipe — built into the browser itself.

It renders pages exactly like Chrome does, because underneath it is the same engine. What differs is everything around that engine.

Because site compatibility is the feature nobody forgives you for missing. Chromium renders the web that developers actually test against, and it lets us keep the Chrome extension ecosystem — including the Manifest V2 extensions that Chrome itself is retiring.

Gecko is a fine engine. Building on it would mean fighting compatibility bugs instead of building the privacy features that are the point of the project.

Free to download and use, with no paid tier, no bundled search deal that pays per query, no crypto wallet, and no "rewards" programme. There is no telemetry to monetise either — see the privacy page for what that means in practice.

It is a joke about a certain motto, and about the fact that the browser doing the least on your behalf is often the one behaving best. Make of it what you like — the software is boringly well-behaved.

When the crash rate on internal builds sits where it needs to and the import path stops surprising people. No date is being promised, because dates promised this early are how browsers ship broken. Progress is logged on the changelog.

None. There is no analytics SDK, no crash reporter that uploads by default, no unique install identifier, and no first-run ping. The only outbound request the browser makes on its own is the update check, which sends a version string, a platform and a channel — and can be turned off.

It works against the commercial fingerprinting scripts that dominate the web: canvas, WebGL, audio and font probes all return per-session noise, so the identifier a tracker computes on Monday does not match Tuesday's.

It does not make you anonymous. Your IP address, your login cookies and your behaviour are all still yours. If your threat model includes a state actor, use Tor Browser — that is what it is for.

Saved passwords are stored locally, encrypted with a key held by the operating system's credential store — DPAPI on Windows, Keychain on macOS, kwallet or gnome-keyring on Linux. They never leave the machine, because there is no sync service to send them to.

That also means a copied profile directory will not decrypt elsewhere. Export deliberately if you are migrating.

Google's Safe Browsing service is removed, because in its default mode it tells Google about the URLs you visit. In its place, the badware and phishing filter lists ship with the blocker and are matched entirely on your machine — the protection stays, the reporting channel does not.

Yes, and quickly — upstream security releases are merged and shipped within 72 hours on every channel. Removing Google's services does not mean falling behind Google's patches; the sandbox, site isolation and the V8 hardening are all untouched.

Yes. Everything lives at github.com/evil-browser under BSD-3: evil-browser/evil is the browser — the full patch set against Chromium, the GN configuration and the packaging scripts — and evil-browser/evil.st is this website.

The de-Googling layer is ungoogled-chromium's patch set, used under BSD-3 and credited in the repository. They have maintained that work across upstream releases for years; reimplementing it would have taken months and been worse. evil adds the branding, the bundled extensions, the defaults and its own patches on top.

It is a patch set rather than a copy of the Chromium tree, which keeps the diff against upstream small enough that a person can actually read it. Five commands take you from clone to installer; the build documentation covers each platform. Reproducible builds are a v1 goal, not yet a promise.

Yes. Widevine ships with the official builds, so DRM-protected streaming works at the same resolution tiers as Chrome. YouTube works too — including with the ad blocker on.

Yes — from the Chrome Web Store, or as a local .crx. Both Manifest V2 and V3 extensions run, so the blockers and userscript managers that Chrome has been squeezing out keep working here.

Because an extension can be limited by the extension platform, and Manifest V3 limits exactly the capabilities that make a blocker good. Compiled in, the filtering engine sits below that policy layer: full filter syntax, unlimited rules, real cosmetic filtering, no rug-pull.

Not in v1. When it arrives it will be end-to-end encrypted with a key that never leaves your devices, and it will be optional. A browser that requires an account to be useful is the thing this project is a reaction to.

Android is planned after desktop v1 settles. iOS is not, and cannot meaningfully be: every iOS browser is required to use WebKit, so an "evil for iPhone" would be a skin over Safari with none of the engine-level protections that make this worth shipping.

Press Alt S, drop the shields for that site, reload. That resolves nearly everything. If it does not, the troubleshooting section walks through the fingerprinting and profile cases.

Yes. Separate application, separate profile directory, separate everything. Installing evil does not touch your other browsers, and uninstalling it does not take anything of theirs with it.

No — the import is read-only. It copies bookmarks, history, passwords and cookies out; it never writes back. Close the source browser first, though, or the locked database will make the import skip history and cookies.

A check every 12 hours, delta patches, signature verified, applied on next launch. No background updater service is installed. You can disable checks entirely in settings — and there is no nag screen waiting to punish you for it.

Stable, unless you enjoy filing bug reports. Beta runs roughly two weeks ahead with weekly builds; nightly is built from the tip of the tree and is regularly broken on purpose.

In the issue tracker. There are templates for a plain bug, for site breakage, and for a feature request — the site-breakage one asks whether the page works with shields off, which resolves most reports on its own.

Include the output of evil://version, and reproduce on beta before reporting a nightly bug. Website problems go to evil.st/issues instead.

Privately, please — use GitHub's private reporting or email security@evil.st, and give it a fix window before disclosure. The full policy, including response times, is in SECURITY.md.

Bugs in unmodified upstream Chromium belong in Chromium's tracker, which also pays a bounty. Anything where evil is less safe than the Chromium it is built on is ours.

Testing is the most useful contribution right now: unusual hardware, unusual distributions, unusual sites. Filter-list maintenance and documentation fixes are close behind — CONTRIBUTING.md lists what is actually wanted, in order.

Code contributions are welcome too, with one constraint worth knowing up front: the patch set has to be rebased onto a new Chromium every couple of weeks, so anything that can be a build flag or a runtime setting instead of a patch should be.