Bushido Browser

Browse with Discipline.

Bushido is a solo project. I got tired of browsers that spy on you, bloat themselves with features nobody asked for, & treat your attention like a product. So I built one that doesn't.

Discord • Report Bug • Feature Request

—-

So Why Bushido?

Manifest V3 restricted what ad-blocking extensions can do. Bushido doesn't care —blocking is built into the browser core, not an extension that can be neutered.

• Native Ad & Tracker Blocking —10 filter lists (EasyList, EasyPrivacy, uBlock Filters, and more), matched in under 0.05ms per request. Network blocking at the WebView2 COM level before connections are established. Cosmetic filtering hides ad containers that survive network blocking. Scriptlet injection (173 uBlock Origin resources) defuses anti-adblock scripts. Page JavaScript can't bypass any of it.
• Fingerprint Protection —Canvas, WebGL, audio, navigator, screen, timing —all spoofed with realistic per-session randomized values. Hardened against common detection techniques: Function.prototype.toString inspection, iframe cross-realm access, Web Worker clean scope, Object.getOwnPropertyDescriptor probing, Date.now vs performance.now comparison, error stack trace sanitization, WebGL parameter consistency. Init script runs before any page JS exists —the page never gets a reference to the original functions.
• Cookie Banner Rejection —Automatically clicks "Reject All" on consent popups across 8+ frameworks. You never see them.
• HTTPS-Only Mode —All traffic upgraded to HTTPS. HTTP connections are refused.
• DNS-over-HTTPS —Built-in encrypted DNS resolver. Three levels: Standard (encrypted + tracker blocking), Strict (+ CNAME uncloaking to catch hidden trackers), Maximum (fail-closed, no fallback). Cloudflare primary, Google DNS fallback. 10k entry cache. Your ISP sees nothing.
• Download Manager —Parallel chunked downloads (up to 6 segments), crash recovery via manifest files, cookie-aware authenticated downloads. Pause, resume, retry. Built into the browser, no extension needed.
• Zen-Style Vertical Sidebar —Nav buttons, URL bar, workspaces, tabs —all in one vertical sidebar. Drag, pin, reorder, tree tabs. Session restore built in.
• Command Palette (Ctrl+K) —Fuzzy search tabs, bookmarks, history, and actions from one input.
• Reader Mode (Ctrl+Shift+R) —Strip pages to just text and images. Pick font, theme, line width.
• Picture-in-Picture —Video detection + one-click PiP. Shadow DOM button injection so sites can't block it.
• Split View —Drag a tab from the sidebar into the content area to split. Preview zones show where the tab lands. Up to 4 panes, resizable dividers, recursive horizontal/vertical splits. Layout persists across sessions.
• Web Panels —Pin any site as a persistent sidebar webview. Spotify, Discord, WhatsApp —always one click away, stays open across tab switches. Mobile UA so sites render properly at narrow widths.
• Tab Suspender —Inactive tabs auto-suspend after 5 minutes. Webview destroyed, memory freed, click to restore.
• LAN Sync —Sync bookmarks, history, and settings between devices on your local network. No cloud, no accounts, no data leaving your house. Devices discover each other via mDNS and pair with a 6-digit code using SPAKE2 zero-knowledge authentication. All sync traffic encrypted end-to-end with the Noise Protocol (same primitives as WireGuard and Signal).
• Minimal UI —No bloat, no crypto wallets, no AI assistants, no sponsored tiles.

Tech Stack

| Layer | Tech |

| Binary Size | ~27MB (utilizing system native webview) | | Shell | Tauri v2 (Rust) | | Frontend | React + TypeScript | | Rendering | System WebView (WebView2 / WebKit) | | Ad Blocking | adblock-rust engine + WebView2 COM interception + cosmetic filtering + scriptlet injection | | Fingerprint Resistance | JS-level spoofing at document_start, hardened against cross-realm and introspection attacks | | DNS | Built-in DoH resolver with CNAME uncloaking + tracker blocklist | | Downloads | Rust async + parallel chunked byte-range segments | | LAN Sync | mDNS discovery + SPAKE2 pairing + Noise Protocol (XChaCha20) |

Building from Source

# prerequisites: node.js, rust, tauri cli
npm install
npx tauri dev

For a production build:

npm run tauri build

The installer lands in src-tauri/target/release/bundle/.

Contributing

Bushido is open source under the GPL-3.0 license. Contributions welcome —open an issue or submit a PR.

Ad blocking uses filter lists from EasyList (GPLv3 / CC-BY-SA 3.0).

Roadmap

• Workspaces —shipped in v0.3.0
• History & Bookmarks —shipped in v0.4.0
• Command Palette, Reader Mode, PiP, Tab Suspender —shipped in v0.5.0
• Download Manager with parallel chunks —shipped in v0.5.2
• adblock-rust engine (EasyList + EasyPrivacy) —shipped in v0.6.0
• Split View —shipped in v0.6.1
• Web Panels —shipped in v0.8.0
• Smart Tab Lifecycle —shipped in v0.9.1
• LAN Sync (discovery + encrypted pairing) —shipped in v0.10.0
• LAN Sync (bookmark, history, settings sync via Loro CRDTs) —shipped in v0.10.0
• Permission Prompts (custom glass UI, per-site memory) —shipped in v0.10.3
• Download Enhancements (queue reorder, bandwidth throttle, MIME auto-sort) —shipped in v0.10.3
• Shortcut Runtime Rebinding —shipped in v0.10.4
• Workspace Isolation (per-workspace cookies/storage) —shipped in v0.11.0
• Ad Blocker Tier 2 (cosmetic filtering + scriptlet injection) —shipped in v0.12.0
• Fingerprint Protection v3 (6 bypass categories closed) —shipped in v0.12.0
• Fingerprint Protection v5 (per-site PRNG, cross-realm hardening, timing attacks, worker protection) —shipped in v0.13.0
• Network Inspector (real-time request logging, blocked/allowed, filter by type) —shipped in v0.13.0
• Speculative Preloading (hover-to-preload, same-origin only, 300ms debounce) —shipped in v0.13.0
• DNS-over-HTTPS (encrypted resolver, CNAME uncloaking, 3 privacy levels) —shipped in v0.14.0
• Boosts —per-site CSS/JS injection
• Custom themes
• Cross-platform builds (macOS, Linux)