How we browse safely

Someone wants to get into online banking quickly. Instead of typing the address, they search for their bank's name, and at the very top is a result that looks exactly as always: logo, colours, login form. Only it is an ad, and the page behind it does not belong to the bank.

This is how many online scams begin - not with a hacked computer, but with a click that feels right. The same pattern exists for parcel services, tax authorities, online shops and wallets.

We follow this case through the whole text and check at every step: what would the browser have caught, and what could it not have caught?

We use Brave. Not because it is perfect, but because it already has a lot switched on that you would have to find, install and maintain yourself in other browsers.

Open and on a proven foundation. Brave is open source: the source code is public on GitHub under the Mozilla Public License 2.0, and anyone can check what the browser does. Technically, Brave is built on Chromium, the open project that Google Chrome is also based on. That is why sites and extensions work as they do in Chrome, and Brave keeps taking over security fixes from Chromium. What Brave adds on top is the protection this text is about.

Protection out of the box. Brave's Shields are on for every site. They block ads, trackers, cross-site cookies and fingerprinting without any setup.

Warnings about dangerous sites. Brave uses Google Safe Browsing against phishing and malware, on by default on every device. On desktop it also checks downloads and extensions. Most checks happen locally, and where a lookup is needed on desktop it goes through a Brave proxy - so Google does not see your IP address.

Encrypted wherever possible. Brave tries to load every site over HTTPS. If you want, you can switch on HTTPS-only mode: then Brave asks before a site is loaded unencrypted.

Hard to recognise. Brave passes on traits such as graphics, audio, fonts and language settings slightly altered per site and per session. That makes a browser harder to follow across sites.

A cookie is nothing bad in itself. It is a small note a site leaves in the browser so that it remembers, for example, that you are logged in or what is in your basket.

It gets tricky with third-party cookies. An ad company embedded on thousands of sites can use the same note to see that the same browser visited the news today, a loan comparison tomorrow and a health site the day after. Many visits become a profile - and a profile is what targeted advertising and targeted scams work with.

What Brave does about it. Third-party cookies and storage are blocked by default. Where a site would not work without them, it only gets temporary storage that is deleted again. The cookies of the site you are actually visiting stay - which is why you stay logged in.

Forgetting on request. For single sites or for all of them, you can set Brave to delete a site's data as soon as its last tab is closed: cookies, stored values and cache. If you switch this on for all sites, you set exceptions for the sites where you want to stay logged in.

And the cookie notices? Brave hides many of the consent pop-ups that appear on almost every site. Where the pop-up is hidden, you click nothing - and so you do not agree to being tracked just to keep reading.

Brave blocks ads. At the same time, it offers to let you see ads voluntarily and get paid for it. That sounds like a contradiction, but it is the business model - and you can use it or ignore it entirely.

Only if you switch it on. Brave Rewards stays off until you activate it yourself. Then ads appear as an image on the new tab page or as a notification - not inside web pages and not as ads before videos. You choose which formats you want to see and how often.

The choice happens on the device. The browser works out locally, from your own history, which ad fits you. According to Brave, that history never leaves the device, and neither Brave nor the advertisers learn who you are or what you look at.

Paid in BAT. For ads you have seen you receive the Basic Attention Token, a cryptocurrency, and according to Brave at least as much of the ad revenue as Brave itself. To have the balance paid out, you need a payout account: either with a partner that manages the account and asks for ID, or your own wallet on the Solana network. Which options exist depends on the country, and on the iPhone Rewards is only available in a limited form.

It will not make you rich. With normal use, small amounts add up. You can keep them, exchange them or pass them on to sites and channels you want to support.

Back to Tuesday, with a twist: the fake site is new, is not on any warning list yet and arrives not through an ad but through a text message warning about a blocked card. Now the browser has nothing left to catch. The site loads, it looks real, and the input is your own.

Warning lists have limits: Google itself says that not every dangerous site is caught. No browser stops you from entering or signing something you should not. And Brave's private windows with Tor are handy, but they do not replace Tor Browser when real anonymity is what you need.

This is how we set up Brave. Most settings are under brave://settings/shields - you can type the address straight into the address bar.

1. Set blocking to aggressive. The setting for trackers and ads has Standard and Aggressive. Aggressive blocks more; if a site then does not work properly, you can relax Shields for just that site via the lion icon in the address bar.

2. Encrypted only. Switch on HTTPS-only mode. Brave then asks before a site loads without encryption.

3. Let sites be forgotten. Switch on forgetting on close for all sites and add the sites where you want to stay logged in as exceptions.

4. A separate profile for what matters. A second Brave profile just for the bank, insurance and, if you have one, the wallet. No extensions and no everyday browsing in it. You create profiles via the person icon at the top right.

5. Bookmarks instead of search. Save the real addresses as bookmarks in that profile and only open them from there - never from search results, ads or links in messages.

6. Leave out what you do not need. Hide or switch off Rewards, the VPN offer, the AI assistant and the wallet in the settings if you do not use them. And as few extensions as possible: each one can read every page it is active on.

7. Let updates run. Brave updates itself. A restart when it asks for one is the quickest security measure there is.

Brave is not beyond criticism. On Windows it installed the services for its VPN for a while without asking. They only ran after activation and purchase, and Brave acknowledged that this was not ideal.

Brave also comes with many features that have nothing to do with security. That is not a flaw, but it is a reason to switch them off deliberately if you do not need them. We still consider the browser the best foundation we know - and we keep watching.

Status: 20 October 2026. Browsers change quickly; we review this text when something important changes about Brave.

The features are described according to Brave's own information: the feature overview, the pages on Shields and Brave Rewards, the Privacy Updates series including the posts on HTTPS by Default, Forgetful Browsing and the end of strict fingerprinting protection, the help page on Safe Browsing the post on payouts on the Solana network and the source code on GitHub (brave-core), all retrieved on 20 October 2026. The VPN installation on Windows follows reports by Ghacks and TechRadar from 2023. Vendor information, not independently verified.