How it's engineered not to leak.
One idea, taken to its limit: your real identity should never leave the machine, and you shouldn't have to trust us that it doesn't. This page walks the whole mechanism: the life of one request, the kill switch, the exact fingerprint surfaces we scramble, a complete list of what leaves your Mac and when, the ten-check self-test, and an honest map of where a WebKit browser's guarantees end.
One switch you can't turn off.
Standard Searxly lets you raise privacy to Maximum when you choose. Maximum removes the choice: the app boots into Maximum Privacy and stays there, over Tor by default. Every request either leaves through the protected lane, or doesn't leave at all. The lane can be switched (Tor, or the Searxly VPN with an active pass); the posture cannot.
What happens when you press Return.
The clearest way to explain the machine is to follow one page load through it, from the keystroke to the wire and back. Step 5b is the one that defines the edition.
Before the load may open a single connection, PrivacyGate checks the lane: is Tor verified up (or the VPN tunnel, if you switched lanes)? This happens per navigation, inside the engine's own decide-policy callback, so there is no window where a request slips out first and gets checked later.
Three locked shields groom the request: http:// is upgraded to https://, 49 named tracking parameters and six prefix families (utm_, pk_, …) are stripped from the URL, and the Sec-GPC: 1 header plus the JavaScript Global Privacy Control signal are attached. In Maximum these three cannot be switched off.
The tab carries a random Tor stream token, and before the load proceeds the token is re-keyed to the site you are visiting. The result: two tabs on the same site ride separate circuits, and one tab moving between sites changes circuit as it crosses each boundary. Tor's IsolateSOCKSAuth does the enforcement.
The hostname is handed to Tor in the SOCKS handshake, not to your Mac's resolver, so no DNS query reveals where you are going. The search engine's upstream config carries the literal socks5h:// scheme, and the visible proof for tabs is that .onion addresses, which no public DNS can resolve, load at all.
The request crosses the Tor circuit and exits from a relay that knows the destination but not you. The site sees the exit's address. What protects the content itself is TLS or an onion service, which is why the app leans on HTTPS-only and .onion upgrades.
This is the moment that defines the edition. The load is refused: a monochrome page titled "Traffic blocked to protect you" appears with the live reason, and the gate remembers the address. There is no quiet fallback to your real connection, because no clearnet code path exists to fall into. The instant the lane verifies again, the blocked page reloads itself.
Before the page's first script runs, in every frame, the hardening script is already there: the canvas readouts it will probe are noised, the viewport it will measure is letterboxed, the clock says UTC, the locale says en-US, the machine says 8 cores, and RTCPeerConnection does not exist to leak your address around Tor.
There is little to clean because little was ever written: every tab's store lives in memory, history is off by default, window state is never persisted. The amnesic downloads folder is swept, the clipboard is cleared, and the next launch sweeps again in case the last quit was a crash.
Eight defenses. Each fails closed.
The actual behavior, mechanism by mechanism: what it does, the leak it removes, and, where there is one, the honest edge.
Tor by default, over SOCKS5h
The bundled client is the Tor Project's own tor-expert-bundle, the same binary Tor Browser ships, version-pinned and launched through the app's helper on a dedicated port chosen never to collide with a Tor you might already run. It starts client-only, with disk writes avoided.
Everything that legitimately leaves rides it: every tab's data store carries the SOCKS proxy, the local search engine's upstream traffic is proxied through the same port, and the app's own fetches that carry no identity (result thumbnails, a page read for your local AI) go through a dedicated Tor lane. Requests that would carry identity, like wallet RPC, are not proxied; they are refused outright.
Blocked, never leaked
One gate, three lanes, each with its own test: web navigations require the protection verified up, native fetches are held to a stricter standard still, and even the loopback hop to the local search engine is gated on its upstream being proxied. Every blocked attempt is logged to the ledger with the reason.
The gate is event-driven, not polled: it re-evaluates the moment Tor's status changes, the VPN tunnel flips, or the lane is switched, and it remembers the last blocked address so recovery is a reload, not a shrug. It also self-heals: if the chosen lane cannot come up, it falls back to the stricter one rather than staying dark.
A fresh circuit for every tab, and every site
Isolation is layered three deep. Tor itself separates circuits by destination. Each tab adds its own random stream token, so two tabs on the same site ride separate circuits. And within a tab, the token is re-keyed per site as you move, so one long-lived tab doesn't stitch your day together. A New Identity command (⌘⇧U) closes every tab, wipes site data, and requests fresh circuits for everything.
Where Tor itself is blocked, pluggable-transport bridges disguise the connection: Snowflake works out of the box, and obfs4 accepts the bridge lines you paste. If a direct connection stalls at bootstrap, Maximum retries once through Snowflake on its own.
Scrambled, and folded into the crowd
A hardening script is injected into every page before its own scripts run, in every frame, and each shim is native-code-masked so Function.prototype.toString can't reveal the tampering. The noise is drawn fresh at every read: a tracker hashing your canvas gets a different answer every time, which breaks the stable identifier it is trying to build. That is a deliberate design choice, and its trade-off is stated honestly below.
Accept-Language header still leak bits, a WebKit ceilingThree positions, enforced twice
Like the Tor Browser, Maximum has a security slider. Standard keeps the full web working, farbling included. Safer engages WebKit's Lockdown Mode, the real JIT-off, and removes WebGL, WebGPU, WebAssembly and OffscreenCanvas. Safest additionally refuses to run remote JavaScript at all; the local search UI keeps its scripts, because it never leaves your Mac.
Every position is enforced at two levels: inside the engine where the build allows it, and as a JavaScript floor that holds regardless. The self-test then probes the landed result from a page's point of view, which is the view that matters.
Amnesic in session, encrypted at rest
In Maximum, every tab's store is memory-only to begin with. Amnesic mode goes further: history and open-tab snapshots are never written, search-history entries are dropped, and the mode is snapshotted once at launch so a session can't end up half-amnesic. Downloads are the one thing that touches disk: they land in a session folder that is swept on quit and again at every launch, and each file offers a "Keep" escape into your real Downloads folder. Bookmarks, saved passwords and settings persist; amnesia forgets what you did, not what you own.
What does stay is encrypted: browsing data with AES-GCM under a key that lives in your Mac's Keychain and is never synced anywhere, and the search-query history refuses to fall back to plaintext if that key is unavailable. App Lock puts Touch ID (with your device password as fallback) in front of the app, with an inactivity auto-lock.
Anti-forensics the OS doesn't give you
macOS tags every download with the URL it came from and when (kMDItemWhereFroms, kMDItemDownloadedDate) and writes your open windows to disk to restore them. Maximum strips both metadata tags off saved files while deliberately keeping the Gatekeeper quarantine flag, so security scanning still happens, and disables window-state persistence outright.
Smaller habits, same idea: the clipboard is cleared when you quit, the address bar turns on secure keyboard entry so keystroke loggers read nothing, and opening a downloaded document first warns you that the document itself may fetch resources outside Tor once another app has it.
A runtime you can trust
Before the Tor binary is ever executed, its code signature is verified and its Team ID must match the team that signed the app itself; every bundled transport and library is held to the same test. A swapped or patched binary is refused and Tor does not start. The check pins authenticity rather than a fixed hash, and the self-test reports it in its own row.
Updates are the honest edge here. The updater built into Maximum fetches its feed and the download over Tor and verifies the file against the app's signing key independently of any transport, and it stages the verified update rather than installing behind your back. That channel is built, but its feed is not published yet: a shipped Maximum build today does not update itself at all, and new versions are installed by hand from the download page.
What leaves your Mac, and when.
A privacy claim is only checkable if it is a list, so here is the list. On the Tor lane, this table is everything: a network call that is not on it has no code path in this edition.
check.torproject.org)The self-test, check by check.
Settings holds a self-test you can run any time; nothing runs unless you press the button. Eight checks ship in both editions; the last two exist only in Maximum. The titles below are the app's own strings.
Reads the live posture: the mode the app is actually in, not the one that was requested.
Asks the helper process whether the bundled client is bootstrapped and running right now.
The live one: fetches check.torproject.org/api/ip through the bundled SOCKS proxy and requires the answer to confirm a Tor exit. It rides the same fail-closed lane as everything else, so the test itself cannot leak: if Tor isn't up, it cannot run.
Verifies the local engine's upstream proxying is reconciled and switched on, so queries leave through Tor rather than directly.
Records the gate's armed state for the posture you are in; the blocking behavior itself is the same code path every page load already passes through.
Builds a real tab through the same factory as your browsing, loads a blank in-memory page with no network, and reads what a page's JavaScript actually sees: the clock must say UTC, the locale en-US, the hardware 8 cores, plugins empty, voices empty, timers coarsened.
Same probe: RTCPeerConnection must not exist, in any spelling.
Asks macOS whether the data volume is encrypted. Off or undeterminable is reported as a warning, not a failure: it is your Mac's setting, and the app tells you instead of pretending.
At Safer and Safest, the probe must find WebGL and WebAssembly unreachable from a page; at Standard it records the level you chose.
Re-runs the supply-chain check on demand: every bundled binary must carry a valid signature from the same team that signed the app, or Tor refuses to start.
Proof, not a privacy promise.
The strongest claim is one you don't have to believe. Maximum ships three things you can check yourself, inside the app:
- ✓A live Network Ledger: each page destination, search and blocked attempt with the lane it took, held in memory only and capped at 300 entries, plus a status board of eight live readouts
- ✓The ten-check self-test above, ending with a live fetch of your address through Tor that reads back what the internet can see
- ✓A runtime-integrity check that shows the bundled Tor binary is the one Searxly signed, re-runnable on demand
The lane is a choice. The posture is not.
Protection in Maximum always runs through one of two lanes, and the fail-closed gate covers whichever one you are on. Switching lanes never lowers the posture; it changes who carries the traffic, and that trade deserves to be stated plainly.
The strictest lane, and the default.
Free forever, no account, nothing to configure. Your traffic crosses three relays run by strangers who each know only their neighbor, and exits among everyone else's.
- A fresh circuit per tab and per site
- Identity-bearing native fetches stay refused, permanently
- .onion services, bridges where Tor is blocked
- The trade: slower than a direct line
The faster lane, opt-in, never required.
One hop through a Searxly-run exit, on macOS's own built-in VPN client. Every licence includes 45 days of it; after that it is only there if you choose to buy a pass. The gate still fails closed, and onion tabs still open over Tor.
- Faster, for the sites and hours where Tor drags
- The trade, stated: one operator (us) carries your traffic instead of three strangers
- Native fetches reopen on this lane; the strictest posture is Tor
- When a pass lapses, the app returns itself to Tor
The safest feature is the one that isn't there.
Whole categories of egress either have no doors in this edition or no code at all, so they can't be re-enabled, exploited, or leak by accident.
No wallet doors
The crypto wallet's surfaces are not reachable in this edition: no sidebar entry, no settings pane, and its network calls are refused by the gate on the Tor lane. Nothing on-chain, nothing address-keyed.
No cloud AI
Searxly ships no model and no AI backend, in either edition. The only intelligence is the one you bring; the local tool server it can talk to is loopback-only and off by default.
No lookups on your behalf
Knowledge panels and the news home are switched off at the code level in Maximum, so no third party is consulted about what you type beyond the search you explicitly run.
No telemetry or feedback
No analytics, no crash beacons, no feedback pane, no account. There's simply no code left that phones home about you.
Where the guarantees end.
Security isn't marketing. Maximum raises the cost of tracking you a long way, and the honest way to sell that is to draw the edges exactly where the code draws them.
It is not the Tor Browser
Tor Browser ships a patched engine tuned for one uniform fingerprint. Maximum uses Apple's WebKit, so its defenses are shims injected ahead of page scripts: strong against trackers, but a determined script can detect shims, and module workers and TLS-level fingerprinting sit beyond what any WebKit app can reach. For the very hardest threat models, the Tor Browser remains the reference, and we say so.
Some fingerprint bits remain
Readouts are farbled, but a script measuring a full-width element's real geometry, or reading the Accept-Language header, still recovers bits (the header pins to en-US from the next launch after install). The timezone mask covers the APIs trackers use, not every date string. And because the noise is drawn fresh per read, two reads differ, which defeats stable identifiers at the cost of being itself detectable. Letterboxing and masking narrow the surface; only a modified engine closes it.
The OS keeps some notes
Amnesic mode and the provenance strip cover what the app and Finder record. System crash reports and the macOS quarantine database are written outside the app's reach, and amnesic deletion is removal, not secure erase. FileVault is the mitigation for both, which is exactly why the self-test checks it and warns instead of posing.
Tor is Tor
You inherit Tor's own model: a malicious exit can see unencrypted traffic (so stick to HTTPS and .onion), and Tor is slower than the clear web. Captive portals, which need a clearnet hello, cannot be signed into from inside Maximum at all. The edition would rather be slow and private than fast and traceable.
It protects Searxly, not the whole Mac
The kill switch is the app's own gate, not a system-wide firewall: other apps on the machine keep their own connections and make their own choices. If you need every process on the Mac forced through Tor, that is an operating-system-level tool, and no browser should claim to be one.
Activation is one clearnet call
Binding a fresh licence key is a single HTTPS call to our server carrying the key and a salted hash of a hardware identifier, from your real IP, and payment runs on Stripe's rails. We store the email only as a hash, but a purchase and a machine hash can be related through the payment records; we would rather tell you that than pretend otherwise. Reactivating a bound key, and everything else the app ever does, is offline from our side.
Updates are not flowing yet
The Tor-routed, signature-verified update channel is built into the app, but its feed is not published: a shipped Maximum build today does not update itself, and new versions are installed by hand from the download page. For a security product that is a real gap, we treat it as one, and this page will change the day the channel opens.
Built so there's nothing to trust.
Always on, fail-closed, and open to inspection. See the overview and the price, or read how the rest of the architecture is built, every layer documented the same honest way.
Available now · no account · no telemetry · engine source published for review