the quiet parts
Blanc’s privacy is structural: what the browser blocks, what it refuses to run, and how it handles the data you care about.
what runs, and what does not
Ad and tracker blocking runs inside the browser, not as an extension. Reviewed EasyList and EasyPrivacy snapshots are hash-pinned into each Blanc release; the browser does not fetch changing filter scriptlets at startup. The shield shows what was blocked on each page. How blocking works.
Web pages run inside Chromium’s sandbox, isolated from the browser and from your files. Blanc’s own pages — settings, history, favorites — live on a privileged internal scheme that ordinary web content cannot link into, and the browser re-checks who is calling on every internal request.
Extensions are privileged third-party code running inside your browser. Blanc removed the runtime entirely, which removes that class of risk outright — and a common reason to install one, ad blocking, is already built in at a deeper layer. If you need a specific extension, we are honest about it: Blanc is not your browser today.
the sensitive parts
Sync is off by default. Favorites, eligible settings, and optional open-tab snapshots are encrypted on your device. The current v1 server stores ciphertext under an opaque account locator and cannot read or merge it. The passphrase is never stored or sent, and the retained key is wrapped by the operating system credential service.
On a Mac with Touch ID, Blanc creates device-bound passkeys inside Apple’s Secure Enclave. The private key never leaves the chip, and Blanc is signed with an Apple-issued Developer ID and provisioned to hold its own keychain access group. macOS only for now.
Camera, microphone, location, notifications — each request raises a Blanc prompt, and each decision is remembered for that site. Decisions made in a private tab are never written to disk.
A fresh profile presents the usage ping on, but sends nothing until you save the choice and lets you turn it off before continuing. If left enabled, a packaged launch sends the narrow pseudonymous payload listed in the privacy policy—never URLs, searches, or page content. The choice stays device-local and can be switched off at any time.
on the network
WebRTC can reveal network addresses that sidestep a proxy. Blanc limits it to your default connection by default, and an optional “disable direct UDP” mode blocks a specific direct-UDP path around an application proxy. It is not a promise of anonymity — it reduces one well-known proxy-bypass risk.
Blanc can send DNS lookups over an encrypted connection (DoH) to Cloudflare, Quad9, Mullvad, or a provider you name — or stay out of the way and leave DNS to your system or VPN. Encryption hides your lookups from the network in transit; it does not hide the sites themselves, and it makes the resolver a party you choose to trust. Automatic mode upgrades opportunistically and is not a guarantee.
verify a release
Blanc releases on GitHub include a SHA256SUMS manifest covering every artifact, a Sigstore bundle authenticating that manifest, a software bill of materials, and platform signatures — an Apple Developer ID on macOS, an Authenticode signature on Windows. Step-by-step verification instructions live in the repository.
Release manifests are signed keylessly via Sigstore. A genuine Blanc release verifies against exactly this identity and issuer — published here, independently of any release, so a tampered download cannot vouch for itself:
anthony@bnfy.me via https://github.com/login/oauth
ready when you are
