Epic Browser

Description

The story behind Epic Privacy Browser begins in a place that has nothing to do with privacy. When Alok Bhardwaj launched the first Epic browser on July 15, 2010, it had Indian language support, live cricket commentary, a built-in word processor and a sidebar full of social widgets. It was India’s first home-grown browser and it was developed for Indian internet users at a time when the Indian internet was still in its nascent stages. Privacy was not the point.

Something changed in the next few years. Bhardwaj, who was a Princeton graduate in philosophy and had worked in finance before founding Hidden Reflex in Bangalore around 2008, saw other browsers load up on tracking code, telemetry pipelines, and advertising infrastructure. By 2013, he had rebuilt Epic from the ground up — scrapping the Mozilla Gecko engine, moving to Chromium, and stripping out everything Google put in Chrome that sends data back to Google’s servers. The new Epic shipped on August 29, 2013, with one focus: no tracking, by default, ever.

That philosophy has not changed. Epic operates in permanent private mode. Everything you browse disappears when you close the browser — cookies, history, cache, all of it gone. The browser claims to block an average of 600 tracking attempts per session. It never gathers user data and does not make money off of advertising. Graham Holdings (the Washington Post parent company) gave seed money. Revenue is generated from a search partnership with Yahoo, which is the default search engine, and EpicSearch.in, a subscription private search service.

Hidden Reflex is still a small independent team. Bhardwaj can be contacted directly for support by email. The browser has never taken a big chunk of the market — it’s in the privacy niche somewhere between Brave and Waterfox, with none of the user numbers those browsers have amassed. What it offers is an unusually opinionated approach: instead of offering users settings to configure, Epic just blocks everything from the start.

PRIVACY ARCHITECTURE

Most privacy browsers require users to go into settings and enable protections. Epic begins with everything locked down, and asks users to relax restrictions if something doesn’t work.

Epic blocks third-party cookies by default. No setup preference panel, no opt-in prompt — they’re just off. Epic’s custom uBlock-based ad blocker — with additional filter lists layered on top — blocks tracking scripts across thousands of ad networks, analytics services and social buttons.

Browser fingerprinting receives special attention. A website attempting to fingerprint a user doesn’t even need cookies — it can create a profile based on the installed fonts, screen resolution, time zone, canvas rendering behavior, and audio processing characteristics of the browser. Each of those details, combined, make a signature almost as reliable as an IP address for tracking across sites. Epic blocks access to image canvas data, font canvas data, audio context data, and a host of other fingerprinting vectors that no browser extension can fully address, because extensions operate above the browser layer and cannot block what the browser itself exposes at the API level.

By default, Epic blocks WebRTC IP leaks. WebRTC is a browser technology for video calls and real-time communication, but it has a well-known side-effect: it can disclose a user’s real IP address even if they’re connected via a VPN. Epic disables the particular WebRTC calls that are causing this leak.

All address bar suggestions are from a local database stored on the user’s machine, not from a remote server. Other browsers send partial text to their servers as the user is typing. Epic does all the work for autocomplete on-device, so typing in the address bar doesn’t create network traffic.

Google’s supplementary services built into Chromium — auto-translate, error reporting, installation tracking, alternate error pages, navigation error suggestions, RLZ tracking numbers, and installation timestamps — are all removed at the source code level, not disabled through settings. They’re compiled out, so they don’t exist in Epic’s binary.

Epic also sends a Do Not Track header to all sites visited. This is mostly a gesture and not an enforceable protection, as websites decide whether they will honor it or not, but Epic does it anyway.

AD BLOCKER

Epic’s built-in ad blocker has a custom version of uBlock as its base, and includes filter lists in addition to what the default uBlock configuration includes. It blocks display ads, video ads, pop-ups, tracking pixels, cryptomining scripts, ultrasound signaling (a method of tracking that sends audio signals from websites to be picked up by nearby phones to coordinate cross-device tracking), and malvertising.

The blocker displays a running count of blocked items in the browser toolbar. Users can click on the shield icon to see which domains a given site tried to contact, and they can disable blocking on a per-site basis if something breaks. The ad blocker is applied to all the tabs by default without any setup.

ALWAYS-ON PRIVATE MODE

Epic does not have an incognito window. The whole browser runs in what would be Chrome’s Incognito Mode at all times. Nothing lasts from one session to the next. Bookmarks and saved passwords persist, but browsing history, cookies, cached files, login sessions, form data, and downloaded file records all vanish when the browser is shut down.

Users who wish to remain logged in to sites between sessions cannot do so in Epic — every site will require credentials again on next launch. This is the most obvious trade off the browser makes. Epic’s position is that the alternative — storing session cookies that track activity — is worse than the inconvenience of logging in again.

DESKTOP PROXY (DISCONTINUED)

Epic’s encrypted proxy was one of its signature features for years. Users could click a button to route all traffic through Hidden Reflex’s own servers in eight countries: US East, US West, Canada, France, the UK, the Netherlands, Germany and Singapore. It concealed the user’s IP address from the sites they visited, encrypted traffic between the browser and the proxy endpoint, and enabled users to get around geographic restrictions.

Hidden Reflex stopped using the proxy in the latest updates, citing the cost and complexity of running the proxy. The proxy icon is still in the browser toolbar, but now it points to a list of third-party VPN extensions users can install instead. Desktop users who used Epic specifically for the built-in proxy will have to add one of the recommended extensions — Proton VPN, among others, works in Epic. The proxy removal is the biggest change Epic has made to its feature set since the Chromium migration in 2013.

IOS VPN

On iOS, Epic still offers a built-in VPN. The iOS app comes with a free, no-logging encrypted VPN that offers servers in seven countries — the US, Canada, the UK, Germany, the Netherlands, Singapore and India — with unlimited data. This is a different implementation than the discontinued desktop proxy and is still active as of mid-2025. The VPN routes traffic at the system level on iOS instead of only through the browser, offering more protection than a browser-only proxy would.

EXTENSIONS

Epic accepts most Chrome Web Store extensions but not all. The browser historically restricted extensions heavily, on the argument that any extension with access to browsing history creates a privacy risk — and that many privacy extensions were themselves collecting and selling user data. Early versions of Epic admitted very few extensions.

The present position is more liberal. Most of the Chrome Web Store’s 150,000+ extensions work in Epic. The extension manager emulates Chrome’s interface and layout. Password managers such as LastPass, productivity tools such as Grammarly and Clockify, and screenshot extensions work without any problems. The underlying Chromium compatibility means that Chrome extensions that don’t specifically depend on Google services will generally run.

Epic does not support multiple user profiles. There is no account sign-in, no sync, and no way to maintain separate browsing environments in one instance.

BUILT-IN TOOLS

Epic has a media downloader that fetches audio and video from YouTube, Vimeo, SoundCloud, Facebook, Dailymotion and hundreds of other sites. The download icon is displayed in the toolbar if the browser detects downloadable media on the current page.

Reader Mode removes ads, sidebars, and navigation from articles and displays the text in a clean, adjustable format. The reader view includes font and size controls, color themes (light, dark, yellow, blue) and text-to-speech playback with speed and language controls. On mobile, an Audio Queue feature allows users to add multiple articles and have them read back-to-back – Epic says this is the first mobile browser to have the feature using iOS native text-to-speech.

The new tab page displays a live tracker counter comparing how many tracking attempts Epic has blocked in the user’s current session compared to what other browsers would have allowed. Users can also configure the counter to display blocking statistics from other browsers that they have installed, allowing them to see what Epic would have blocked in sessions where they used Chrome or Firefox instead.

HTTPS enforcement forces all connections to the secure version of a site wherever the site supports it. Epic attempts to use the HTTPS version of the URL first, and then uses the non-secure version (HTTP) if the site doesn’t have a certificate.

The File Vault on Android encrypts files the user downloads or saves to the device, providing an extra layer of security for saved content.

SEARCH

Yahoo Search is the default on all platforms. This is an explicit revenue arrangement — Hidden Reflex gets paid from the search partnership. Yahoo’s privacy practices apply to searches made through Yahoo’s results pages, and Epic’s FAQ explicitly warns that logging into Gmail or any Google account while using Epic allows Google to correlate search activity with the account.

EpicSearch.in is a paid alternative: a private search engine run by Hidden Reflex that has no ads, no tracking, and no user profiles. Epic Search is a meta-search engine that retrieves results from various sources without transmitting user identity to the sources.

WHAT DOESN’T WORK

Some websites break in Epic. Sites that need third-party cookies for authentication — including some single sign-on systems and some video streaming services — will not work correctly, since Epic blocks those cookies. Sites that use aggressive JavaScript frameworks that rely on data Epic blocks may behave in unexpected ways or fail to load. Users can disable protections site by site from the shield menu in the toolbar.

Google Translate is not available because Epic doesn’t pass data through Google’s servers. The address bar does not provide predictive search suggestions from a remote service. Auto-fill from Google’s password infrastructure doesn’t work. Any Chrome extension that requires a Google account to work will not work.

No multiple profiles implies a single browsing context for each browser instance. Power users who have separate profiles for work and personal use will have to look elsewhere.