Built-in blocking.
Known ads and trackers are blocked at the network layer. Coverage is not universal; you can allow an individual site.
Privacy & security
Trust comes
with the details.
The choices, the connections, and the evidence behind Blanc.
Your choices, visible.
Fresh setup preselects search suggestions and usage measurement. You can turn either off before saving, or later in Settings.
Evidence you can inspect.
Source and authenticated release records are public. An independent external security audit has not been completed. Read the audit status and known Sync issues.
How Blanc works.
Chromium renders the web. Electron brings it to your desktop.
Blanc is a desktop browser built with Electron, which bundles Chromium for rendering websites. Blanc supplies its own interface, tab management, blocking and permission controls. Electron lets one application support macOS, Windows and Linux. Electron’s process model explains how the runtime and rendering engine fit together.
Chromium is the open-source browser engine used by several browsers. Blanc is not the Google Chrome application: it has its own features and update channel. Using Chromium does not, by itself, describe every connection a browser makes. Those connections are explained below.
Blanc uses official Electron releases. Engine changes arrive through a new Blanc release; the running app cannot independently swap in a newer Chromium.
An app update includes the browser engine.
Installed release builds check Blanc’s official GitHub Releases channel. An update includes the application and its bundled Electron/Chromium runtime. Applying it requires restarting Blanc; a new engine is not downloaded into the running browser separately.
On Linux, Blanc is distributed as an AppImage. Make the downloaded file executable and run it. Its updater replaces the application image when the environment permits; if automatic updating fails, download the new AppImage from the official channel. A writable location and a working AppImage environment are required. AppImage packaging does not keep Chromium updated independently.
macOS releases are signed and notarized. Windows installers carry timestamped Authenticode signatures. Linux AppImages are authenticated through the signed checksum manifest; they do not have the same OS-level signing model. Read the verification instructions and choose your download.
Blocking is built into Blanc.
Blanc Blocker applies network rules and cosmetic filters from bundled, hash-verified EasyList and EasyPrivacy snapshots. It does not fetch changing filter lists or remote scriptlet resources at startup. Reviewed list updates arrive with a new Blanc release.
The blocker is independent of an extension store. You can turn it off for a site when something breaks, or change its setting in the app. Lists target known ads and trackers; blocking cannot guarantee that every tracker is stopped. Explore Blanc Blocker.
What can leave your device?
This is an explanation of shipped behavior, not a live network monitor. Optional features have separate controls; ordinary website traffic is still part of browsing.
- Websites you open
- Browsing sends requests to those sites and their resources. Blocking reduces known ads and trackers; it cannot stop every form of tracking.
- App updates
- Installed builds contact GitHub Releases to check for and download Blanc updates. The update replaces the whole app, including its bundled Electron and Chromium.
- Search and suggestions
- A submitted search goes to your selected search engine. If suggestions are enabled, eligible typed prefixes also go to that provider. Suggestions are excluded from private tabs and recognized sensitive-looking input. Choosing Google makes Google a recipient.
- Usage measurement
- If enabled after setup, Blanc sends pseudonymous launch and bounded feature-use events to its Cloudflare-hosted collector. They contain random install/session IDs, version, platform, architecture, coarse OS major and fixed feature names—not browsing data. Where the optional Google Analytics mirror is configured, Google receives the keyed hash and allowed event fields.
- DNS
- Address lookups use your system resolver or the encrypted-DNS provider selected in Settings. Automatic may fall back to ordinary DNS. Encryption does not hide your browsing from every party.
- Optional Sync
- If you enable Sync, eligible Favorites, settings and optional open-tab snapshots are encrypted before reaching Blanc’s Cloudflare-hosted service. Cookies, passwords and browsing history are not synced.
- Optional Patron and 1Password
- Patron activation and subscription checks contact Polar. On macOS, the optional 1Password integration contacts your installed 1Password app when you choose Verify or request a fill. It does not provide a general extension runtime.
- Optional tab handoff
- A handoff transfers selected tab metadata after your request. The ChatGPT path processes that metadata through OpenAI; the Firefox/Safari companion encrypts locally. Neither path transfers logins or cookies.
This website has separate choices. Cloudflare counts page views without cookies, and the download redirect counts aggregate downloads. Google analytics and limited ad-conversion measurement load only after you choose Allow through the footer’s Privacy choices, or if you previously saved that grant. Declining or withdrawing prevents future optional measurement.
Choose what Blanc may send.
Search suggestions and usage measurement are presented on in fresh-install setup. Neither sends until your choices are saved, and you can turn either off before continuing. Later, search suggestions live in Settings → General; usage measurement lives in Settings → Privacy & Security. Your choices stay device-local.
Sync, 1Password and tab handoff require separate actions. Optional website measurement is controlled through this site’s footer. The privacy policy lists data fields, recipients and retention in more detail.
Understand the trade-offs before choosing.
Blanc has no general extension runtime or built-in AI assistant. Private tabs stay out of Blanc’s history and session restore; they do not make you anonymous to websites or your network. Blocking cannot guarantee that every tracker is stopped.
Memory use depends on the workload, engine version and platform. Published measurements are specific runs, not a promise for every computer. Read the benchmark qualifications.
Blanc-owned code is MIT licensed. Names and logos remain reserved, and bundled third-party material keeps its own terms. Read the license, identity carve-outs, and third-party notices.
App explanations checked against public Blanc v1.25.0. Read its source and release evidence. Signed manifests authenticate downloads; they do not establish reproducible builds. More questions?
public v1.27.0 · October 3, 2026
Verify the package for your platform.
| Platform | What is checked | Artifacts and evidence |
|---|---|---|
| macOS | Developer ID signature, notarization, Gatekeeper assessment and the app’s stapled ticket. | Official DMG · Mac verification steps · v1.27.0 verification record |
| Windows | Valid, timestamped Authenticode signature with the exact expected publisher; installer digest bound to windows-signature.json. | Official installer and signature report · Windows verification steps · v1.27.0 native checks |
| Linux | AppImage checksum authenticated by the Sigstore-signed SHA256SUMS manifest. Linux has no equivalent OS-level publisher signature here. | Official AppImage, manifest and Sigstore bundle · Manifest verification steps · v1.27.0 public-download checks |
These checks authenticate the publisher and downloaded bytes. They do not establish that the application is free of security flaws or provide an independent review of its architecture. The release record distinguishes hosted checks, physical-machine confirmations and owner waivers.
independent review
An external audit is still pending.
The status, plainly
No independent external security audit has been completed. Internal and AI-assisted security reviews are maintainer evidence. The next step is preparing a scope and funding proposal, without promising an audit date.
Known work belongs in the scope
Sync v1 encrypts data, but possession of its account locator authorizes ciphertext retrieval, replacement and deletion. Concurrent writes and deletion can race. Merged request-size limits are not yet deployed. These unresolved findings remain part of the public maintainer assessment.
Look closer
Security & release evidence
what runs, and what does not
The browser itself is the security layer.
Blocking lives in the network layer.
Blanc Blocker runs inside the browser, not as an extension. Reviewed EasyList and EasyPrivacy snapshots are hash-pinned into each Blanc release; the browser does not fetch changing filter scriptlets at startup. The shield shows what was blocked on each page. How blocking works.
Every page runs sandboxed.
Web pages run inside Chromium’s sandbox, isolated from the browser and from your files. Blanc’s own pages — settings, history, favorites — live on a privileged internal scheme that ordinary web content cannot link into, and the browser re-checks who is calling on every internal request.
No general extension installation.
Blanc does not support installing arbitrary browser extensions. The bundled uBlock Origin provider is an optional blocking integration for regular tabs on supported builds, not general Chrome Web Store support. Private tabs use Blanc Blocker.
the sensitive parts
How Blanc handles sensitive data.
Sync the server cannot read.
Sync is off by default. Favorites, eligible settings, and optional open-tab snapshots are encrypted on your device. The current v1 server stores ciphertext under an opaque account locator and cannot read or merge it. The passphrase is never stored or sent, and the retained key is wrapped by the operating system credential service.
Passkeys live in the Secure Enclave.
On a Mac with Touch ID, Blanc creates device-bound passkeys inside Apple’s Secure Enclave. The private key never leaves the chip, and Blanc is signed with an Apple-issued Developer ID and provisioned to hold its own keychain access group. macOS only for now.
Permissions ask first.
Camera, microphone, location, notifications — each request raises a Blanc prompt, and each decision is remembered for that site. Decisions made in a private tab are never written to disk.
Usage measurement waits for your choice.
A fresh profile presents usage measurement on, but sends nothing until you save the choice and lets you turn it off before continuing. If left enabled, packaged builds count launches and a fixed allowlist of local feature actions using the narrow pseudonymous payload listed in the privacy policy—never URLs, searches, page content, game state, or private-tab feature activity. The choice stays device-local and can be switched off at any time.
on the network
Respecting the VPN you already chose.
WebRTC stays in its lane.
WebRTC can reveal network addresses that sidestep a proxy. Blanc limits it to your default connection by default, and an optional “disable direct UDP” mode blocks a specific direct-UDP path around an application proxy. It is not a promise of anonymity — it reduces one well-known proxy-bypass risk.
DNS you can encrypt — or hand to your VPN.
Blanc can send DNS lookups over an encrypted connection (DoH) to Cloudflare, Quad9, Mullvad, or a provider you name — or stay out of the way and leave DNS to your system or VPN. Encryption hides your lookups from the network in transit; it does not hide the sites themselves, and it makes the resolver a party you choose to trust. Automatic mode upgrades opportunistically and is not a guarantee.
your existing password manager
1Password login fill on macOS.
Optional 1Password fill on macOS.
Use matching Login items from your installed 1Password desktop app and account. Blanc’s narrow SDK integration is off by default, and credential lookup and fill require your explicit action. It is not automatic fill, an extension runtime, or a Blanc password store.
A local hint, before any lookup.
A small hint can appear when the visible page has a current-password field. It uses bounded structure-only metadata, never field values or page text, and makes no request to 1Password. Settings can explicitly verify your saved 1Password account identifier.
calls and permissions
See when your microphone or camera is in use.
Access you can see and stop.
The Island shows microphone and camera use across the window’s tabs and popups. Open the indicator’s popover to see the active surfaces and stop their access. Closing a capturing tab ends its access immediately.
A choice for choppy call playback.
Call audio buffering offers Automatic, Stable, and Resilient receive-buffer modes for WebRTC calls. Stable targets about 400 ms; Resilient targets about one second. Extra buffering trades conversational responsiveness for more tolerance of choppy playback. It cannot guarantee a fix for network, source, Bluetooth, driver, or hardware faults.
when something goes wrong
A clearer explanation and a choice about recovery.
Certificate failures get their own explanation.
Blanc shows a dedicated certificate-failure surface with site-trust details, so a connection problem does not disappear into a generic navigation error.
Restore tabs or start fresh.
After an unclean shutdown, Blanc offers explicit recovery choices. Recovery runs locally and does not upload browsing data.
Diagnostics you choose to share.
Settings → Export diagnostics creates a local file for troubleshooting. Review it before sharing it with support; exporting does not send it anywhere.
documented practice
A public security baseline.
Blanc’s current OpenSSF self-assessment records all 24 Level 1 controls and all 19 Level 2 controls as met. The public record covers how the project handles source, changes, dependencies, vulnerability reports, build provenance, and releases.
Read the OpenSSF assessment
verify a release
Check that a download is really ours.
Every release ships its evidence.
Blanc releases on GitHub include a SHA256SUMS manifest covering every artifact, a Sigstore
bundle authenticating that manifest, a software bill of materials, and platform
signatures — an Apple Developer ID on macOS, an Authenticode signature on
Windows. Step-by-step verification instructions live in the repository.
The signing identity, on the record.
Release manifests are signed keylessly via Sigstore. A genuine Blanc release verifies against exactly this identity and issuer — published here, independently of any release, so a tampered download cannot vouch for itself:
anthony@bnfy.me via https://github.com/login/oauth
Ad & tracker blocking
the blocker is part of the browser
Start protected, not set up.
Built around the web, not a browser store.
Blanc Blocker loads its lists directly in the browser. You do not need to find, install, or manage an extension before browsing.
Know the site, not just the count.
Open the shield to see whether the page uses HTTPS and how many requests Blanc blocked. It reports only what the address proves, without turning the browser into a security dashboard.
Let a site through when you choose.
Need a site exception? Use the switch in the shield popover, or type /allow-ads. Blanc keeps the choice specific to that site instead of making it an
all-or-nothing setting.
help improve coverage
An ad got through? Send a reproducible example.
A page we can test
Report a missed ad with its page URL, Blanc version, operating system, blocker settings, expected result and the ad you observed. A screenshot is optional. For examples containing private information, email support@blancbrowser.com.
Reports help distinguish filter coverage, a blocker integration defect and an ad format the blocker does not support. A report is closed with reproduction and verification evidence, or a documented limitation.
what blocking is worth
Blocking saves memory, not just noise.
Ads and trackers cost real memory to render. With six ad-heavy news sites open, blocking them at the network layer is worth gigabytes.
| Browser | Memory used |
|---|---|
| Blanc | 1.3 GB |
| Brave | 1.7 GB |
| Zen | 3.2 GB |
| Chrome | 5.6 GB |
| Vivaldi | 5.9 GB |
Private tabs
what stays private
Use a private tab, then leave no history behind.
Not in history.
Pages you visit in a private tab stay out of Blanc's browsing history, so they do not become part of the local record.
Not waiting after a restart.
Private tabs are excluded from session restore and reopen-closed. They do not quietly return the next time you open Blanc.
One simple exit.
The private chip on the island is a quick way to close the active private tab when you are finished.