The browser engineered not to leak.
Standard Searxly gives you a privacy dial. Maximum takes the dial away. It runs in Maximum Privacy, over Tor by default, it can never be turned down, and every check it makes is on screen where you can read it.
One payment. One Mac. No subscription, no account, no renewal.
In standard Searxly, Maximum Privacy is a rung you can climb to and step back down from. In this edition there is no ladder.
The strongest posture is the only posture.
In standard Searxly, Maximum Privacy is a rung you can climb to and step back down from. In this edition there is no ladder.
The strongest posture is the only posture.
Welded on
The app forces Maximum Privacy over Tor at every launch, before the first window opens. Every route that could lower it is closed in code, including the one through onboarding.
Fails closed
If Tor is not up, the request does not go. There is no quiet fall back to your real address, because the fall back is the leak. You get a blocked page and a reason.
A licence, not an account
You buy a key, not a subscription. One activation exchanges it for a licence sealed to your Mac; after that there is no server to check in with, and a reinstall comes back offline.
When the line drops, the door is already shut.
Tor circuits fail. That is normal, and it is the moment that decides whether a browser is actually private. Here is that moment, slowed down.
The circuit is up. Every request leaves through Tor, and names resolve at the exit, never on your Mac.
The circuit drops mid-session. This is where an ordinary setup quietly falls back to your real address.
Maximum blocks instead. The request is stopped and told why. Nothing is sent in the clear, because nothing is allowed to leave.
A fresh circuit comes up and traffic flows again on its own. No toggle to remember, nothing to re-arm.
When the line drops, the door is already shut.
Tor circuits fail. That is normal, and it is the moment that decides whether a browser is actually private. Here is that moment, slowed down.
The circuit is up. Every request leaves through Tor, and names resolve at the exit, never on your Mac.
The circuit drops mid-session. This is where an ordinary setup quietly falls back to your real address.
Maximum blocks instead. The request is stopped and told why. Nothing is sent in the clear, because nothing is allowed to leave.
A fresh circuit comes up and traffic flows again on its own. No toggle to remember, nothing to re-arm.
Eight layers, each built to fail closed.
Not a settings checklist. The actual behaviour, and the way an identity gets out that each one removes.
Routing
SOCKS5hTor by default. Unless you deliberately switch the lane to the Searxly VPN, every tab and every search leaves through the bundled Tor client, with names resolved at the exit rather than on your machine, so there is no DNS leak left to watch for.
Identity
stream isolationA fresh circuit per tab. Each tab carries its own Tor stream token, so two tabs on the same site ride separate circuits instead of one shared line. Bridges (obfs4 and Snowflake) get you connected where Tor itself is blocked.
Fingerprint
strict farblingScrambled, then folded into the crowd. Canvas, WebGL, audio and font readouts are farbled, the viewport is letterboxed, timezone and locale are masked, and WebRTC is neutered so it cannot leak your address around Tor.
Traces
RAM onlyAmnesic by design. An optional memory-only mode keeps history, tabs, cookies and cache in RAM, gone the moment you quit. Downloads are the one thing that touches disk before the session is swept. Bookmarks and saved passwords stay.
At rest
data-protection KeychainEncrypted where it sits. A fresh install turns history off, opens new tabs private, encrypts stored data and arms App Lock where the Mac can do it. The password vault holds credentials in the Keychain and never syncs, to us or to anyone.
Forensics
xattr stripNothing tattooed on disk. Downloads lose the where-from tag macOS writes onto every saved file, and open windows are not persisted for restore, so a recovered Mac does not recount your session.
Supply chain
signature checkA runtime you can trust. Every session, the bundled Tor binary’s signature is verified before it is allowed to run. If the check fails, Tor does not start and the self-test tells you, in those words, not to trust the build.
Proof
ledger + self-testWatch it work. A live network ledger names each page destination, search and blocked attempt with the lane it took, and a one-tap self-test fetches your address through Tor and reads it back to you.
Tor by default. Unless you deliberately switch the lane to the Searxly VPN, every tab and every search leaves through the bundled Tor client, with names resolved at the exit rather than on your machine, so there is no DNS leak left to watch for.
A fresh circuit per tab. Each tab carries its own Tor stream token, so two tabs on the same site ride separate circuits instead of one shared line. Bridges (obfs4 and Snowflake) get you connected where Tor itself is blocked.
Scrambled, then folded into the crowd. Canvas, WebGL, audio and font readouts are farbled, the viewport is letterboxed, timezone and locale are masked, and WebRTC is neutered so it cannot leak your address around Tor.
Amnesic by design. An optional memory-only mode keeps history, tabs, cookies and cache in RAM, gone the moment you quit. Downloads are the one thing that touches disk before the session is swept. Bookmarks and saved passwords stay.
Encrypted where it sits. A fresh install turns history off, opens new tabs private, encrypts stored data and arms App Lock where the Mac can do it. The password vault holds credentials in the Keychain and never syncs, to us or to anyone.
Nothing tattooed on disk. Downloads lose the where-from tag macOS writes onto every saved file, and open windows are not persisted for restore, so a recovered Mac does not recount your session.
A runtime you can trust. Every session, the bundled Tor binary’s signature is verified before it is allowed to run. If the check fails, Tor does not start and the self-test tells you, in those words, not to trust the build.
Watch it work. A live network ledger names each page destination, search and blocked attempt with the lane it took, and a one-tap self-test fetches your address through Tor and reads it back to you.
Then it checks itself, in front of you.
Settings holds a self-test. Ten checks, run on your Mac, ending with the live one: it fetches your address through Tor and reads back what the internet can see.
Then it checks itself, in front of you.
Settings holds a self-test. Ten checks, run on your Mac, ending with the live one: it fetches your address through Tor and reads back what the internet can see.
The list is the shipping build’s own, in the app’s own words and order. This page stages a pass run; on your Mac each check reports its actual state, and you can run it any time from Settings.
The expensive part of a free browser is what it wants from you.
Maximum is worth paying for mostly because of what it does not do. These are not switches left in the off position. They are surfaces this build does not have.
One thing is included rather than gone: the Searxly VPN. Tor is the default and always free, and every Maximum licence comes with 45 days of the VPN if you ever want the faster lane instead. It is opt in, it is a deliberate switch in Settings, and the kill switch covers whichever lane you are on.
The closest thing to it costs more.
Brave Origin is the nearest comparison anyone actually ships: a paid, stripped, no-telemetry build of a serious browser. Both are strong. Only one makes Tor and total localness the default you cannot switch off, and lets you watch it work.
Engineered not to leak.
Built to prove it.
Searxly Maximum, $25.00.
One payment. Your key arrives by email and licenses one Mac. There is no account to create and no renewal to forget.
- One Mac, one activation, then offline
- Every future update included
- 45 days of Searxly VPN included
- Support by ticket, from the people who build it
Your key arrives by email, one long line. Keep that message.
Download Maximum, open the DMG, drag it into Applications.
Launch it and paste the key. One activation seals it to your Mac; reinstalls come back offline.
macOS 15 or later · Apple Silicon · Tor by default · no account · no telemetry