SlimBrave Neo

Debloat and harden Brave Browser on Linux, macOS, and Windows.

SlimBrave Neo uses Chromium enterprise managed policies to disable telemetry, bloat, and unwanted features in Brave Browser. No browser extensions, no hacks, just clean policy enforcement that Brave respects natively.

---

The Linux/macOS TUI: collapsible categories with a live count of what each one is managing, / to search, ? for keys. Zero dependencies, runs in any terminal.

git clone https://github.com/ChaoticSi1ence/SlimBrave-Neo.git
cd SlimBrave-Neo
sudo python3 slimbrave-linux.py

That's it. No pip install, no jq, no external dependencies. Just Python 3 and root.

With no flags the script opens a curses interface: seven collapsible categories — Telemetry & Reporting, Privacy & Security, Site Permissions, Access Controls, Brave Features, Shields & Content Protection, Performance & Bloat — followed by a DNS Over HTTPS section, with an Import / Export / Apply / Reset / Quit button row underneath.

Each category header carries a disclosure marker and a live n/m on count of the settings under it that are actually managed — a ticked checkbox, or a selector sitting off Not managed. The count updates as you toggle, so a folded section still tells you whether anything inside it is set. Left folds a header, Right unfolds it, Space or Enter does either, and c folds every section at once — or unfolds them all when they are already folded. On launch the folds reflect what is already applied: a section holding a managed setting opens, the rest stay folded — so a clean machine opens on a short overview and a configured one opens on what it is enforcing.

/ filters the list by row name. Matches narrow as you type, the hint line reports how many rows matched, and only matching rows and the headers owning them stay on screen. Folded sections are searched too, so a fold cannot hide a match. Esc clears the filter and puts the fold states back as they were before the search.

The eight tri-state permission rows render as Web Notifications: < Block > and are cycled with Left/Right, the same way the DNS mode selector has always worked; Space or Enter steps forward through the same states. A row sitting off Not managed is highlighted and counts toward the header above it.

? opens a key overlay over the list.

CLI mode (non-interactive):

sudo python3 slimbrave-linux.py --import "./Presets/Maximum Privacy Preset.json"
sudo python3 slimbrave-linux.py --export ~/SlimBraveNeoSettings.json
sudo python3 slimbrave-linux.py --reset

Multiple Brave channels (Stable / Beta / Nightly): Brave hardcodes the managed-policy directory to /etc/brave/policies for every channel, so a single policy file applies to all of them — no per-channel selector is needed. If multiple channels are installed, leaked Shields exceptions are scrubbed from each channel's user-data directory and "Brave is running" detection covers all installed channels.

After applying, restart Brave and verify at brave://policy.

git clone https://github.com/ChaoticSi1ence/SlimBrave-Neo.git
cd SlimBrave-Neo
sudo python3 slimbrave-mac.py

Requires root. Policies are written to /Library/Managed Preferences/com.brave.Browser.plist by default; with --persist on an Apple Configuration Profile is installed instead.

The TUI is the same one described under Linux — same categories and live counts, same collapsing, / search, paging and ? overlay, same Left/Right selectors — plus the two Apply-time prompts below.

Persistence on macOS (Apple Silicon / macOS 13+). On modern macOS, cfprefsd and mdmclient may clear directly-written /Library/Managed Preferences/*.plist files at reboot when no Configuration Profile backs them, so policies don't always survive a restart. SlimBrave Neo offers two modes:

When --persist is omitted on the CLI, the mode currently installed on the Mac is reused, so a re-run never silently demotes an installed profile back to plist-only. A fresh install defaults to off.

When you click Apply in the TUI, SlimBrave Neo asks two macOS-only questions in order: which Brave channels to manage (only when more than one is installed), then whether to persist across reboots. Both prompts have a sticky default — Enter keeps whichever scope and mode are currently installed.

sudo python3 slimbrave-mac.py --import "./Presets/Maximum Privacy Preset.json" --persist on
sudo python3 slimbrave-mac.py --import "./Presets/Maximum Privacy Preset.json" --persist off
sudo python3 slimbrave-mac.py --reset

Finishing the Configuration Profile install (macOS 26). With --persist on, SlimBrave Neo writes a .mobileconfig and opens System Settings, but macOS 11+ disallows CLI-driven profile installs so you finish the step in the GUI: a "Profile Downloaded" notification appears; in System Settings click General → Device Management, scroll down to Downloaded, double-click SlimBrave Neo - Brave Policy, click Install, and enter your login password. Policies then take effect immediately and persist across reboots. To uninstall, run --reset or remove the profile under the same Device Management pane. Reference: Apple — Install configuration profiles on Mac.

CLI mode (non-interactive):

sudo python3 slimbrave-mac.py --import "./Presets/Maximum Privacy Preset.json"
sudo python3 slimbrave-mac.py --export ~/SlimBraveNeoSettings.json
sudo python3 slimbrave-mac.py --reset
sudo python3 slimbrave-mac.py --import preset.json --channels stable,beta
sudo python3 slimbrave-mac.py --import preset.json --persist on

After applying, restart Brave and verify at brave://policy.

git clone https://github.com/ChaoticSi1ence/SlimBrave-Neo.git
cd SlimBrave-Neo
powershell -ExecutionPolicy Bypass -File .\SlimBrave.ps1

The Windows GUI: one-click presets across the top, three independently scrolling columns, and three-state dropdowns for the permission settings.

No git? One line:

iwr "https://raw.githubusercontent.com/ChaoticSi1ence/SlimBrave-Neo/main/SlimBrave.ps1" -OutFile "SlimBrave.ps1"; .\SlimBrave.ps1

This pulls the current main. If you'd rather pin an exact, unchanging version and check it against a published checksum before running, SECURITY.md covers tagged releases and SHA-256 sums.

Requires Administrator privileges; the script re-launches itself elevated. Hover over any option in the app for a plain-English description of what it does and the exact policy it writes. The app follows your Windows light/dark theme.

The window is a fixed size chosen to fit a 1366x768 display, and it never resizes or reflows. The options sit in three side-by-side columns — Privacy & Security with Telemetry & Reporting, Site Permissions and Access Controls with Brave Features, Shields & Content Protection with Performance & Bloat — and each column scrolls on its own, so a long category scrolls inside its own panel while the DNS row and the buttons underneath stay exactly where they are.

A Quick Presets row sits above the columns, with one button per bundled preset: Maximum Privacy, Balanced Privacy, Performance Focused, Developer, Strict Parental Controls. A preset button only fills in the controls below — nothing reaches the registry until you click Apply Settings, so you can untick whatever you don't want first. The presets are embedded in SlimBrave.ps1 itself, so the buttons work for the one-liner download above too, with no Presets/ directory on disk. A status line at the right of the same row names what the last action did.

The button row underneath is Export Settings, Import Settings, Re-sync Registry, Apply Settings and Reset All Settings. Re-sync reads the policy currently in the registry back into the controls, discarding any on-screen selections you have not applied. It writes nothing, and it goes through the same reader that fills the form at startup, so a re-sync can never disagree with a fresh launch.

Every row of Site Permissions is a dropdown rather than a checkbox: Not managed / Ask / Block, plus Allow on the keys where Chromium accepts it. Not managed is the default and writes nothing at all. The Permissions & Access section below covers what each state does and which keys offer Allow.

• Disable Metrics Reporting (needs a restart)
• Disable Safe Browsing Reporting
• Disable URL Data Collection
• Disable P3A Analytics
• Disable Stats Ping
• Limit Variations to Critical Fixes, or Disable Variations / Griffin Experiments outright (mutually exclusive). Griffin is the remote seed Brave fetches to flip features in a browser that is already installed; "Limit" keeps the emergency security killswitches working, "Disable" blocks those too.
• Disable Enhanced Spell Check — mutually exclusive with Disable Spellcheck below; this row keeps offline checking and only drops the Google lookup

• Disable Safe Browsing (security downgrade — Brave proxies these lookups through its own servers, so Google never sees them either way; excluded from every preset)
• Disable Autofill (Addresses & Credit Cards)
• Disable Password Manager
• Disable Password Leak Detection (the online breach-list credential check)
• Disable Browser Sign-in (needs a restart)
• Enable Global Privacy Control
• Enable De-AMP (strip Google AMP wrappers)
• Enable Debouncing (skip known tracking redirect hops)
• Strip Tracking URL Parameters
• Reduce Language Fingerprinting
• Disable WebRTC IP Leak
• Disable QUIC Protocol (needs a restart)
• Disable Network Prediction (no DNS prefetch / preconnect for links you never click)
• Block Third Party Cookies
• Block Payment Method Probing (sites' canMakePayment always answers "none saved")
• Disable Alternate Error Pages
• Block Remote Debugging (closes the CDP port and pipe automation tools drive the browser through — "Disable Developer Tools" does not cover it; breaks Puppeteer, Playwright and brave://inspect)
• Disable DNS Interception Probes (three random hostnames resolved at every launch and network change, visible to your ISP or DoH resolver)
• Require HTTPS for Basic Auth (breaks logins on legacy HTTP-only routers, printers and appliances)

Content-setting defaults sites are granted. These rows are not checkboxes — Chromium models these keys as an enum rather than a boolean, so the tool now exposes the enum instead of hardcoding "block". Each is a dropdown in the Windows GUI and a < Block >-style selector in the TUI, with the same states everywhere:

• Not managed — the default. Writes nothing at all, so Brave's own default and your per-site choices stand. An untouched row behaves exactly like the unticked checkbox it replaced.
• Ask — pins the permission prompt as managed policy: no site is silently granted, and the setting can't be weakened from brave://settings or per-site.
• Block — what ticking the box used to do. No prompt, no access, for any site.
• Allow — grants the permission to every site, and is offered only on the keys where Chromium actually accepts it.

That last point is not uniform, and it isn't assumed to be. Web Notifications, Location Access and Motion Sensors have an allow member (1) in their enum. WebUSB, Web Serial, WebHID, Local Font Enumeration and Window Management do not — DefaultWebUsbGuardSetting, DefaultSerialGuardSetting, DefaultWebHidGuardSetting, DefaultLocalFontsSetting and DefaultWindowManagementSetting are Ask-or-Block only, value 1 is not a member at all, and Brave rejects a policy file that names one. Those five rows never show an Allow entry. Checked key by key against Chromium main; the per-key legal enum is recorded in AUDIT.md.

• Web Notifications — Allow / Ask / Block
• Location Access — Allow / Ask / Block; Block removes the prompt outright, so maps and delivery sites need an address typed by hand, and Ask is the middle ground
• Motion Sensors — Allow / Ask / Block; a fingerprinting vector, and blocking rarely breaks anything on desktop
• WebUSB Access — Ask / Block; Block breaks Ledger/Trezor web wallets and in-browser firmware flashers
• Web Serial Access — Ask / Block; Block breaks in-browser microcontroller programming tools
• WebHID Access — Ask / Block; Block may break security keys and gamepad configurators that use WebHID rather than WebAuthn
• Local Font Enumeration — Ask / Block; queryLocalFonts() hands over your installed font list, a strong fingerprint that Shields' font protections don't cover
• Multi-Screen Access — Ask / Block; the window-management permission: your monitor layout, plus placing windows on a chosen screen

Older configs keep working unchanged: a v1.9.5 export or preset naming one of these keys carries the value 2, so it imports as Block, and a key the config doesn't name comes back as Not managed. A value outside a key's legal set is left unmanaged rather than written out, and the import result names the key it skipped.

Lockdowns, and the escape hatches (guest, incognito, extensions) that would otherwise bypass the rest of the policy set — ordinary toggles:

• Force Google SafeSearch
• Filter Adult Content (SafeSites) — this is a remote lookup, not a local filter. Every URL you navigate to, including URLs loaded inside frames, is sent to Google's Safe Search API to be classified, and anything rated adult is blocked. Worth knowing in a tool whose other rows exist to keep Google out of your browsing; enable it only if the parental-control value is worth that trade.
• Disable Guest Mode (guest windows bypass profile restrictions)
• Block All Extensions (blocks new installs and disables existing ones — lockdown/parental setups)
• Block Sideloaded (External) Extensions (the silent registry / drop-in-file install channel bundleware uses; extensions you install yourself keep working)
• Disable / Force Incognito Mode (mutually exclusive; needs a restart)

• Disable Brave Rewards
• Disable Brave Wallet
• Disable Brave VPN (no effect on Linux builds — Brave doesn't compile the VPN there, though brave://policy still reports the key as applied)
• Disable Brave AI Chat
• Disable Local AI (On-Device Models, Brave 1.94+) — stops the on-device model download and the AI index built from your history. Separate from AI Chat: turning Leo off does not cover it. Needs Brave 1.94 or newer (current stable); older versions ignore the key. Needs a restart.
• Disable Brave Shields / Force Shields On for all sites (mutually exclusive)
• Disable Brave News
• Disable Brave Talk
• Disable Brave Playlist
• Disable Web Discovery
• Disable Speedreader
• Disable Tor
• Disable Sync
• Disable Email Aliases

Pin Brave's own protection defaults as managed policy so they can't be weakened per-site or in settings (requires Brave 1.84+; fingerprinting protection also works on 1.83):

• Enforce Ad Blocking
• Enforce Fingerprinting Protection
• Force HTTPS Upgrades (Strict — sites that can't serve HTTPS show an interstitial)
• Cap Referrers (Strict Origin) / Allow Permissive Referrers (mutually exclusive — both unchecked leaves referrer behavior unmanaged)
• Forget First-Party Storage on Close

Note on referrers: with no referrer policy applied, Brave still caps cross-origin referrers by default, but you can loosen it per-site by lowering Shields on that site. "Allow Permissive Referrers" makes the loosening global as managed policy (DefaultBraveReferrersSetting: 1) — sites that request unsafe-url get your full referring URL cross-origin. It exists for compatibility with sites that break under capped referrers; it weakens privacy and is deliberately excluded from every preset.

• Disable Background Mode (Windows/Linux only — the policy doesn't exist on macOS)
• Enable Memory Saver (discard inactive tabs to free RAM)
• Force Hardware Acceleration (keeps rendering and video decode on the GPU; needs a restart)
• Disable Media Router (Cast, including its background LAN device discovery; needs a restart)
• Disable Media Recommendations
• Disable Shopping List
• Always Open PDF Externally
• Disable Translate
• Disable Spellcheck (all of it, offline included — mutually exclusive with Disable Enhanced Spell Check)
• Disable Search Suggestions
• Disable Printing
• Disable Default Browser Prompt
• Disable Developer Tools
• Disable Wayback Machine

• unmanaged by default — no DNS policy is written, so Brave's own DNS settings stay user-controlled
• Four managed modes: automatic, off, secure, custom (off force-disables DoH as policy)
• Custom DoH template URL support (e.g. https://cloudflare-dns.com/dns-query)
• Inline editable template field in the TUI
• secure and custom require a template URL and are refused without one. Chromium would otherwise apply the mode with an empty resolver list and resolve nothing at all — and being machine-managed policy, you couldn't fix it from brave://settings. automatic is exempt: an empty template there is valid, and a template is honoured if you set one.

The Windows PowerShell script is GUI-only: it declares no parameters and ignores anything on its command line, so flags land silently in $args and the window opens anyway. Use its Import and Export buttons instead.

Import/export uses the same JSON format as the Windows PowerShell version. Configs are cross-platform compatible.

SlimBrave Neo writes Chromium managed enterprise policies to platform-specific locations. Brave reads these on startup and enforces the policies. No browser modifications needed.

Additional behavior:

• Auto-detects Brave installations: Arch (brave-bin), deb/rpm, Flatpak, Snap, macOS App (Stable / Beta / Nightly), and PATH fallback
• Reads existing policies on startup and pre-checks matching features; on macOS, the Apply-time channel prompt pre-ticks channels that already have a SlimBrave-managed policy (sticky default)
• Full overwrite on Apply, so unchecked features are cleanly removed
• Import/export compatible with the Windows PowerShell version: all three scripts now export UTF-8 without a BOM, and all three still read the UTF-16 files older PowerShell exports produced

powershell -ExecutionPolicy Bypass -File .\SlimBrave.ps1

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser   # apply
Set-ExecutionPolicy -ExecutionPolicy Undefined   -Scope CurrentUser   # undo

• Add preset configurations (Privacy, Performance, etc.)
• Import/export settings (cross-platform compatible)
• Add Linux support with full interactive TUI
• DNS-over-HTTPS with custom template URLs
• CLI mode for scripting and automation
• macOS support via managed plist policies
• Multi-channel support on macOS (Stable / Beta / Nightly)
• Three-state permission settings (Allow / Ask / Block), not just block-or-nothing
• Collapsible, searchable TUI
• One-click presets in the Windows GUI

• @ltx0101 — SlimBrave, the upstream Windows PowerShell script this project grew out of (GPL-3.0)
• @alsyundawy — macOS version
• @zhaoJianNet — macOS refinements
• @cococool13 — the Permissions & Access category and 14 source-verified policies, shipped in v1.9.0