Glossary

Brave's built-in protections, on from first launch. Shields block ads, cross-site trackers, cross-site cookies and fingerprinting scripts, and strip known tracking parameters from URLs, with no configuration required. Brave pairs them with fingerprint randomization.

See also: Fingerprint Randomization, Enhanced Tracking Protection

Identifying a browser from the characteristics it reveals, such as canvas, audio and WebGL readouts, font metrics, window size and time zone, instead of from cookies. Clearing cookies does nothing against it. Privacy browsers resist it in one of two opposite ways: uniformity or randomization.

See also: Fingerprint Uniformity, Fingerprint Randomization, resistFingerprinting (RFP)

A company or people-search site that compiles and publishes personal information. Data removal services find your listings and file opt-out requests on your behalf, but brokers re-list information, so removal runs as recurring maintenance on 60-to-90-day cycles rather than a one-time fix.

See also: Metadata

A failure in which your device's DNS lookups travel outside the VPN tunnel, showing every domain you visit to your ISP or network operator even though page traffic is encrypted. Leaks can come from poor DNS routing, a fallback to the system's DNS settings, or uncovered IPv6. A DNS leak test shows which resolvers handled your queries.

See also: Kill Switch, WebRTC Leak

Encryption applied on the sender's device so only the recipient can decrypt the message, and the service carrying it cannot read it. Signal and WhatsApp encrypt message content this way by default, Telegram only in opt-in Secret Chats, and Proton Mail and Tuta for supported exchanges within their own services.

See also: Forward Secrecy, Zero-Access Encryption, Metadata

Firefox's built-in tracker blocking, which works from a maintained list of known trackers along with cryptominers and, in stricter modes, fingerprinting scripts. Standard is the balanced default; Strict blocks more and can break some pages, which you can fix per site from the shield icon in the address bar.

See also: Total Cookie Protection, resistFingerprinting (RFP)

The anti-fingerprinting approach that adds subtle noise to canvas, audio and WebGL readouts so each site and session sees a different device. Brave calls it farbling. It stops a tracker linking your visits, but you never blend into a crowd the way uniformity-first browsers do.

See also: Browser Fingerprinting, Brave Shields, Fingerprint Uniformity

The anti-fingerprinting approach that makes every user of a browser report the same values, so no individual stands out. Tor Browser and Mullvad Browser are built around it. It only helps if the crowd is large, and personalizing the browser with extra extensions or a custom window size removes you from that crowd.

See also: Browser Fingerprinting, Letterboxing, resistFingerprinting (RFP)

Groups of countries that share intelligence. Five Eyes is the US, UK, Canada, Australia and New Zealand; the Nine Eyes and Fourteen Eyes arrangements add further countries, including Sweden in the Fourteen Eyes group. A provider based in a member country faces more structural exposure, which raises the bar for its no-logs evidence rather than ruling it out.

See also: Jurisdiction

A property of the Signal Protocol in which each message uses a new key derived from a ratcheting system, so a compromised key affects only the messages encrypted with that key, not past or future ones.

See also: End-to-End Encryption (E2EE)

The country whose laws govern a privacy provider. It decides whether the provider can be compelled to log and hand over user data, and which intelligence-sharing alliances it sits inside. A court order can only extract data that exists, so jurisdiction is a tiebreaker behind an audited no-logs posture, not a substitute for one.

See also: Five, Nine and Fourteen Eyes, No-Logs Policy

A VPN feature that cuts your internet connection if the tunnel drops, so your real IP address is not exposed. Kill switches that work at the operating-system or firewall level are more reliable than ones inside the app, and many providers ship the feature switched off by default.

See also: DNS Leak, WebRTC Leak

Adding grey margins around the page so the window size a site can read is quantised to a common set of dimensions. Tor Browser and Mullvad Browser use it; in Firefox and LibreWolf it is a separate preference, privacy.resistFingerprinting.letterboxing. Maximizing or dragging the window to an unusual size hands trackers a distinguishing measurement.

See also: Fingerprint Uniformity, resistFingerprinting (RFP)

Information about communication rather than its content: who you message, when and how often, your contacts, device identifiers and IP address. WhatsApp encrypts message content but collects this metadata; Signal says it holds only your phone number, the date you registered and the date you last connected.

See also: End-to-End Encryption (E2EE), Data Broker

An independent third-party examination of whether a VPN's logging infrastructure matches its no-logs policy. Check who ran it, when, and what it covered: an old audit, or one limited to servers in a single country, is weaker evidence than a recent audit of all infrastructure, and a general application-security audit is a different engagement.

See also: No-Logs Policy, Transparency Report

A VPN provider's published statement that it does not record what you do through its service. Any provider can write one, so the policy alone is a claim, not evidence. Specific policies that list exactly what is and is not collected are more useful than vague promises about aggregate data.

See also: No-Logs Audit, Transparency Report, Jurisdiction

The design behind Tor, which sends traffic through three relays with layered encryption: an entry guard that sees your IP but not your destination, a middle relay that sees neither, and an exit relay that sees the destination but not your IP. No single relay sees both ends, although an observer watching both ends can still attempt traffic correlation.

See also: Tor Bridge, Onion Service

A site reached through a connection design that stays inside the Tor network, without a conventional exit relay to the public web. Tor Browser can reach onion services; a conventional VPN alone cannot.

See also: Onion Routing

A Firefox about:config preference, privacy.resistFingerprinting, inherited from the Tor Browser project. It switches Firefox to uniformity: a standardised UTC time zone, rounded new-window sizes, a fixed font list and normalised hardware reporting. It breaks some sites, so it is off by default in Firefox; LibreWolf ships with it on.

See also: Fingerprint Uniformity, Letterboxing, Enhanced Tracking Protection

An alternative entry point into the Tor network, documented in the Tor Browser manual alongside pluggable transports. Bridges help hide the fact that you are using Tor at all, which matters where Tor itself is blocked or treated as suspicious.

See also: Onion Routing

Firefox's cookie isolation, on by default for every user since June 2022, which gives each website its own cookie jar. A tracker embedded on twenty sites gets twenty unrelated identities instead of one linked profile, and the protection covers new tracking domains that no blocklist has caught yet.

See also: Enhanced Tracking Protection, Browser Fingerprinting

A provider's published record of the law-enforcement requests it has received and how it responded. It shows the provider's work in a way a policy statement cannot. IVPN is one VPN provider that publishes one.

See also: No-Logs Audit, Jurisdiction

Exposure of your real IP address at the browser level while a VPN is connected. Run a WebRTC leak test with the VPN on: your real IP address should not appear.

See also: DNS Leak, Kill Switch

A VPN protocol with a published whitepaper that this site treats as the current performance and security standard. Providers also offer OpenVPN, IKEv2 and their own protocols; NordVPN's NordLynx is built on WireGuard.

See also: Kill Switch

Storage encryption designed so the provider cannot read the mail it holds, as in Proton Mail's mailbox storage. It is a different property from encryption in transit and at rest, which protects the connection and the disk but still leaves a provider such as Fastmail able to handle readable mail.

See also: End-to-End Encryption (E2EE)