Is Brave safe?
Brave
Brave is one of the most private mainstream browsers. It blocks ads and trackers by default, Apple's label shows no data linked to you, and its Leo AI does not keep your chats. The catches are past slips, such as affiliate codes in 2020 and a Tor leak in 2021, and crypto features most people do not need.
- Company
- Brave Software, Inc. (United States)
- Engine
- Chromium, with Brave's own privacy changes
- App Store privacy label
- Usage data and user ID, not linked to you; no tracking
- Browsing history
- Not collected by Brave (privacy policy)
- 2020 incident
- Affiliate code added to typed crypto exchange URLs
- 2021 incident
- Tor windows leaked .onion lookups to DNS servers
- Regulatory fines
- None found
- Age rating
- 16+ (App Store)
How the score breaks down
The overall score is the weighted average of these factors. Scoring rules
Privacy30% of score
88 out of 100, ExcellentApple's label lists only usage data for analytics and a user ID for app functions, neither linked to you, and no tracking. Brave's policy says it does not collect browsing history. Product analytics are on by default but can be switched off.
Security30% of score
78 out of 100, GoodBrave follows Chromium's security fixes, encrypts Sync with a key kept on your devices and proxies Google Safe Browsing on desktop. In 2021 Tor windows leaked .onion addresses to DNS resolvers until hotfix 1.20.108. Its HackerOne bug bounty is paused.
Transparency and control15% of score
78 out of 100, GoodThe privacy policy explains each feature's data use plainly, and ads, analytics and Leo can be turned off. But in 2020 Brave quietly autocompleted typed crypto exchange addresses with its own affiliate code, and new-tab ads are on by default.
Scams and harmful content15% of score
68 out of 100, FairA browser opens the whole web and the App Store rates Brave 16+. Safe Browsing warns about known bad sites. The built-in Brave Wallet makes DrainerA malicious website or script that tricks a crypto user into signing a transaction or approval that lets attackers empty the wallet.More in the glossary and phishing scams one click closer, and there are no parental controls.
Regulatory record10% of score
95 out of 100, ExcellentWe found no privacy or consumer-protection fine or order against Brave Software from the FTC, EU data protection authorities or other regulators.
Is Brave safe?
Yes, and it is one of the best choices for privacy among mainstream browsers. Brave blocks ads and trackers by default, says it does not collect your browsing history, and Apple's privacy label lists nothing linked to you. We score it 81/100, just below DuckDuckGo (85) and above NordVPN (79).
The reservations are about trust and clutter rather than surveillance. Brave has made a few embarrassing mistakes, and the browser comes loaded with an AI assistant, a crypto wallet, rewards tokens and ads that many people never asked for.
What does Brave collect?
Very little. Its privacy policy, updated in September 2026, opens by saying that "our company does not collect or retain a user's browsing history." Apple's label lists only usage data for analytics and a user ID for app functions, neither linked to you, and no tracking. Google Play's data safety section says Brave shares no data with third parties.
A few features do send data. Privacy-preserving product analytics report aggregated usage and are on unless you turn them off. Sync stores your bookmarks and passwords encrypted on Amazon's cloud, with the key only on your devices, so Brave cannot read or recover them. Google Safe Browsing checks run through a Brave proxy on desktop, but on Android and iOS they go through the operating system, which exposes your IP address to Google or Apple.
How does Brave make money?
Mostly from ads and subscriptions. Brave Ads show as new-tab images, notifications and search ads, and are chosen on your device rather than by a server profile. Brave says it only receives anonymous counts of ads seen and clicked. New-tab ads are on by default. If you turn on Brave Rewards, you earn Basic Attention Token (BAT) for viewing ads. Brave also sells VPN and Leo Premium subscriptions, and Brave Search carries ads.
What were the Brave controversies?
Affiliate codes, 2020. In June 2020 a user noticed that typing "binance.us" into Brave's address bar autocompleted to a link carrying Brave's own referral code, so Brave could earn a commission. Chief executive Brendan Eich admitted it on Twitter: "a typed-in URL should go to the domain named, without any additions. Sorry for this mistake." Brave removed the default. Nothing was stolen, but it was the kind of quiet monetisation privacy users choose Brave to avoid.
Tor DNS leak, 2021. Brave's private windows with Tor are meant to hide which .onion sites you visit. In early 2021 it emerged that Brave's CNAME ad-blocking feature was looking up .onion addresses through ordinary DNS, so an internet provider could see them. Brave shipped a hotfix, version 1.20.108, in February 2021. Brave's Tor mode is still a convenience, not a substitute for Tor Browser.
Leo AI and the crypto wallet
Leo, Brave's built-in AI assistant, has some of the strongest privacy terms among AI tools we cover. The policy says Brave does not collect your IP address with Leo requests, does not keep prompts or responses beyond brief caching, and does not train models on conversations. Chat history stays on your device. Compare that with Microsoft Copilot, where personalised ads can draw on your chat history.
Brave Wallet is a Self-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary crypto wallet built into the browser. Brave strips IP addresses from wallet traffic and blocks transfers to US-sanctioned addresses, but a Hot walletA crypto wallet connected to the internet, such as an app or an exchange's online wallet. It is convenient, but more exposed to hacking.More in the glossary in a browser is exactly what phishing sites and "approve this token" DrainerA malicious website or script that tricks a crypto user into signing a transaction or approval that lets attackers empty the wallet.More in the glossary target. If you do not use crypto, leave it unset.
Who should be careful
- Parents. The App Store rates Brave 16+, and there are no parental controls. Use Screen Time or Google Family Link.
- People who need anonymity. Use Tor Browser, not Brave's Tor windows.
- Crypto holders. Keep large balances on a Hardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary, not in a browser.
How to set Brave up well
- Turn off product analytics and new-tab ads in settings if you want nothing sent at all.
- Set Shields to block trackers aggressively for stronger protection, and relax it per site if a page breaks.
- Ignore or hide Rewards, Wallet and Leo if you do not use them.
- Keep Brave updated, since Chromium security fixes arrive through Brave's releases.
How we scored it
Regulatory record (95) and privacy (88) are Brave's strongest factors. Scams and harmful content (68) is the weakest, because a browser opens the whole web and the built-in wallet invites crypto scams. Security (78) and transparency (78) lose points for the 2021 Tor leak, the 2020 affiliate-code episode and a paused bug bounty programme.
Questions people ask
Is Brave really more private than Chrome?
Yes. Brave blocks third-party trackers and ads by default, says it does not collect your browsing history, and its App Store label shows no data linked to you. Chrome is made by Google, whose business is advertising. Both use the same Chromium engine, so the difference is in what the company collects and blocks, not in core security.
Is Brave's Leo AI private?
Brave's privacy policy says Leo does not collect your IP address, does not store prompts or responses on Brave's servers beyond a few minutes of caching for large prompts, and does not use conversations for training. Chat history stays on your device. If you ask Leo about a page, that page's text is sent to its servers to answer.
Is the Brave crypto wallet safe?
Brave Wallet is a Self-custodyHolding crypto in a wallet where you alone control the private keys, rather than leaving it with an exchange or another company.More in the glossary wallet built into the browser. Brave strips your IP address from wallet requests and says it does not track wallet actions, but whoever holds your Seed phraseA list of 12 to 24 words that can restore a crypto wallet and all its funds. Anyone who has it controls the wallet.More in the glossary holds your funds. Browser wallets are a common target for phishing sites and fake token approvals. If you do not use crypto, ignore it; if you hold real money, a Hardware walletA small dedicated device that stores crypto private keys offline and signs transactions inside the device, so the keys never touch your computer.More in the glossary is safer.
Does Brave sell your data?
Brave says it does not collect your browsing history, so it has no profile to sell. Its ads are matched on your device, and Brave receives only anonymous counts of ad views and clicks. Ads on the new tab page are on by default and can be turned off in settings.
Is Brave's Tor mode as safe as Tor Browser?
No. Brave's private windows with Tor route traffic through the Tor network, but they lack most of the privacy protections built into Tor Browser, and a 2021 bug leaked .onion lookups to ordinary DNS servers. For real anonymity, use Tor Browser.
Sources
- 1.Brave App Store listing and App Privacy label (opens in a new tab) · Apple App Store, 2026
- 2.Brave Browser Privacy Policy (last updated 23 September 2026) (opens in a new tab) · Brave Software, 2026
- 3.Brave data safety section (opens in a new tab) · Google Play, 2026
- 4.Brave browser CEO apologizes for automatically adding affiliate links to cryptocurrency URLs (opens in a new tab) · The Verge, 2020
- 5.Privacy bug in Brave browser exposes dark-web browsing history of its users (opens in a new tab) · The Hacker News, 2021
- 6.Brave Software bug bounty program (opens in a new tab) · HackerOne, 2026