Freedom v0.0.3

A secure-by-default web browser in pure C. Zero telemetry. Zero backdoors. Zero implicit trust.

Getting Started

Click the URL bar (or press Ctrl+L), type, and press Enter or click Go.

• Type an address — example.com opens https://example.com (the scheme is added; http:// is upgraded to https).
• Type anything else — best linux distro runs a DuckDuckGo HTML search (the no-JS version). A dangerous scheme like javascript: is searched, never executed.
• Local file — /path/file.html or a relative path opens it from disk.

Keyboard Shortcuts

Scrolling (Vim-style, when the URL bar is not focused)

Privacy & Anti-Fingerprinting

• Blend-in identity: Freedom sends a normalized, shared User-Agent and Accept-Language (a common Firefox-on-Linux identity) so every user looks the same. It never advertises "Freedom" on the wire. Override the User-Agent per session in the menu (top-right).
• Off by default: images (remote and local) and author styles (CSS) are disabled; the menu toggles them (or Ctrl+I for images). Supported formats are PNG and JPEG, decoded inside the sandboxed worker (never in the UI process); anything else shows a placeholder. A page that uses images shows a tracking warning and a placeholder per image. Press Ctrl+I to see the logo above. Local pages get a file:// origin, so relative images load from disk — confined to the document's own directory (no ../ escape, no phone-home).
• JavaScript off by default (per-domain): page JS is hostile content, so it is disabled unless you opt a host in. A global mode (off / allowlist / on, set in the menu, --js, or FREEDOM_JS) plus a per-host js.conf allowlist. When enabled, inline scripts run in the per-tab sandbox against a memory-safe writable DOM (document.title, textContent, createElement/appendChild, innerHTML, onload). Click events are wired end-to-end: addEventListener('click', fn) and element.onclick = fn fire when you click the element, the worker mutates the live DOM, and the GUI repaints the result (links still navigate after the handler runs). Storage is in-memory and ephemeral, cookies are empty — JS runs without leaking your identity. Scripts read a real read-only location, and a JS-requested navigation (location.href = …) is re-checked against the full network policy by the trusted parent before it loads — a hostile or compromised script can never drive the browser off-policy. External (src) scripts run only for a host you trusted twice (in allow.conf and js.conf): the sandboxed worker never touches a socket — script bytes come from the trusted parent over the same gated channel as XMLHttpRequest/fetch, with the full network policy re-applied per script (host filter, realm routing, TLS-PQ) and a JavaScript Content-Type required (a 404 HTML page is never evaluated). Errors report their url:line:col in Freebug. For every other host, external scripts still never run. Real querySelector and a modern DOM surface: document.querySelector/querySelectorAll and element.matches/closest run through the same author-CSS selector engine as the stylesheets (identical matching from JS and CSS); elements expose parentNode/children/classList/style and DocumentFragment, with node identity cached so === works. The globals a modern site touches at startup are present but inert and identity-safe: matchMedia never matches, the observers never fire, getComputedStyle returns "", performance.timing is a fixed epoch, and the viewport reads a fixed 1920 width — while window.open/postMessage stay undefined (no popups, no cross-frame messaging). Real homepages like google.com render; web-component apps (YouTube's Polymer shell) do not yet, since custom-element upgrade is unimplemented. Google may still show its server-side "unusual traffic" wall (an IP/cookie decision on their end; Freedom never persists cookies) — the address bar searches via the no-JS DuckDuckGo HTML, which renders cleanly. With JS off, <noscript> fallback content is shown.
• Normalized JS surface: clocks, screen size, and canvas/audio readback are coarsened or poisoned so the JS engine cannot fingerprint the device. The readback noise is keyed per site (eTLD+1), so two different sites get different poisoning and cannot be linked by their canvas/audio fingerprint. No WebRTC, no WebGL, no third-party requests.
• Tor / I2P: optional socket-level routing via local proxies (toggles in the menu). .onion uses Tor only; .i2p uses I2P only — fail-closed, never leaked over clearnet.

Author CSS & Distraction-Free Reading

• Author styles (the web as the webmaster intended): when you enable Author styles (CSS) in the menu, Freedom renders the page's own CSS — both <style> blocks and inline style= — using a deliberately simpler subset: color, background, text-align, font-size, line-height, font-weight, font-style, text-decoration (underline/line-through/overline/none), display (incl. display:none), with type/class/id/group selectors plus the descendant (div p) and child (nav > a) combinators, attribute selectors ([type=text], [href^="https"], ~=/|=/$=/*= with the i case flag), !important, the sibling combinators (h2 + p, h2 ~ p) and a pseudo-class subset — :link (Zero Knowledge: no history, every link is unvisited), :root, :first-child/:last-child/:only-child/:nth-child(An+B)/:nth-last-child(), :checked/:disabled/:enabled; :visited and :hover/:focus/:active parse but never match (no CSS history sniffing, no interactive state), and unknown pseudos / all pseudo-elements fail closed. It never phones home: any value with url( and the network/font @-rules (@import/@font-face) are dropped, so author CSS can never trigger a fetch or a tracking beacon. CSS is hostile content: the parser is bounded (anti-DoS), fails closed, executes nothing, and is fuzzed.
• Flex & grid from the author's stylesheet: a display:flex / display:grid container now takes its layout params (gap, justify-content, grid-template-columns) from the same cascade, so a <style> rule lays out columns — not just an inline style=. Because layout is structure, not styling, the columns render even with author colors off (geometry opens no socket and leaks nothing — only author colors stay gated by the toggle). See examples/css-sheet-layout.html.
• Floats & the two-column web (float:left / float:right + clear): the classic two-column era layout — a floated sidebar, a floated main column, a clear:both footer beneath — now lays out side by side instead of stacking. The float band nests inside the open box stack, so a wrapping position:relative background panel stays in-flow and paints its background behind the columns (no more grey stripes showing through). Like flex/grid, layout is structure: the columns appear even with author colors off. v1: no text wrap around a lone float (the band is a self-contained row; the next non-floated block clears below it). See examples/float.html.
• External stylesheets (<link rel=stylesheet>): with Author styles on, Freedom fetches the page's external sheets the same Zero-Trust way it fetches trusted scripts: the sandboxed worker never touches a socket — each sheet is requested through the trusted parent, which re-applies the full network policy (tracker blocklist, realm routing, TLS-PQ) before any byte moves, serves style-only loads as GET exclusively, and never parses a wrong Content-Type as CSS. With the toggle off, nothing is fetched at all (Privacy by Default). This is what makes real sites (Hacker News' news.css class colors, for example) render as the webmaster styled them.
• Box model (margin / padding / width / max-width): resolved through the same cascade (lengths in px, a bare 0, or em/rem; %/viewport units fail closed). The headline is the modern centered reading column — max-width + margin: 0 auto + horizontal padding — and an author margin-top/margin-bottom overrides the default block spacing. An author box can shrink content to unreadability, so the box model is gated behind the Author-styles toggle like the colors (Secure by Default). The CSS parser now also resolves the values of position, border/border-radius, box-sizing, box-shadow, outline and per-item flexbox/grid (so a page using them no longer confuses the cascade) — but these are not painted yet: honouring them needs the per-block box engine and is the next milestone. See examples/box-model.html.
• Text presentation: the author subset also covers font-family (mapped to a generic family — serif / sans-serif / monospace / cursive / fantasy; exact font files are never matched and @font-face/url() are dropped, so it never fetches), text-transform (uppercase/lowercase/capitalize), letter-spacing, word-spacing, text-shadow (single layer), opacity, vertical-align (sub/super), text-indent, white-space (nowrap/pre suppress wrapping) and list-style-type (decimal/lower-alpha/upper-roman/disc/circle/square… changes the <li> marker). All but list-style are gated behind the Author-styles toggle. See examples/text-presentation.html and the full supported-vs-missing inventory in spec/css.md.
• Automatic dark mode: @media is supported as a safe subset — with the dark theme on (and Author styles enabled), a page's @media (prefers-color-scheme: dark) rules apply automatically. screen/print and min/max-width queries evaluate against a fixed, normalized desktop width (no real viewport size leaks — anti-fingerprinting); not and unknown features fail closed. @media only chooses which local rules apply — it still never fetches.
• Distraction-free mode (Ctrl+D): a clean reading view — nav/header/footer/aside boilerplate is dropped, author styling and images are turned off, and the text is centered in a comfortable reading column. Toggle again to restore. Your persistent image/CSS toggles are untouched.
• Real text shaping (HarfBuzz): page text is laid out with HarfBuzz shaping instead of one-glyph-per-byte, so you get proper ligatures (fi / ffi / fl), GPOS kerning (AV / To / Wa), contextual forms and correct in-word direction for complex scripts. It runs on the trusted side only: it shapes the (sanitised, fuzzed) page text with local system fonts — it never enters the sandboxed worker, never fetches a web font (@font-face/url() are dropped), and never persists. If no font resolves it falls back cleanly to the previous renderer.