Bulwark — Privacy Posture & Tracker Shield

Audits your browser's privacy settings, blocks trackers, and flags risky extensions. Everything runs on your machine.

Most privacy extensions tell you how to be safer. Bulwark reads your browser and tells you what is actually true right now — then fixes it, blocks what settings cannot, and never sends a single byte anywhere. Everything runs on your machine. No account, no server, no analytics, no install identifier. There is nothing to opt out of. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ WHAT IT CHECKS 19 real Chrome privacy settings, read back from the browser and scored out of 100, grouped by what each one actually leaks: - Third-party cookies, referrer headers, link-auditing pings and WebRTC address leaks — the four levers that let one company follow you between unrelated sites. - Chrome's own ad-targeting APIs — the Topics API, site-suggested ads and ad measurement. These are tracking performed by the browser itself, and most privacy tools predate them. - What Chrome sends out on its own: address-bar keystrokes to your search engine, form text to the cloud spellchecker, failed addresses to Google, speculative preloading. - Data kept locally — address and card autofill, the protected-content identifier that survives clearing cookies. Each row shows the live value, the recommended value, why it matters in plain language, and what you give up by changing it. Settings that another extension has taken control of, or that your workplace has locked, say so rather than silently failing. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ WHAT IT BLOCKS 182 tracking hosts in four groups you can switch independently: - Analytics and audience measurement - Ad tech and retargeting - Session recorders and heatmap tools that replay your mouse and keystrokes - Commercial device-fingerprinting services Optionally, Bulwark strips 98 tracking parameters — utm_source, fbclid, gclid, msclkid, ttclid and the rest — out of addresses as they load, so a link cannot be attributed back to you and cannot be pasted into a message with your ID still attached. If a site breaks, exempt it in one click and carry on. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ THE SAFE BROWSING WATCH Malicious software switches Chrome's Safe Browsing off quietly, then walks you onto a phishing page. Bulwark watches that setting and turns its icon red the moment it changes. One click puts it back. This runs on a Chrome event, not a background timer, so nothing polls and nothing drains your battery. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ YOUR FINGERPRINT, COMPUTED LOCALLY Press "Scan this page" and Bulwark reads the tab once and shows you what a tracking script would learn: your canvas and audio hashes, your GPU string, how many fonts you have installed, screen geometry, CPU cores, memory, time zone. These survive clearing cookies and switching to a fresh profile, which is why fingerprinting works. You also get every third-party host the page contacted, which tracking SDKs are live in it, and what it stored in your browser. No results page opens. Nothing is uploaded. Close the popup and the report is gone. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ THE EXTENSIONS YOU NEVER INSTALLED Extensions that arrive bundled with desktop software never went through review. Bulwark lists every extension installed outside the Web Store, every one that takes updates from an outside server, and scores each by what its permissions would let it collect — reading your cookies, your history, every request your browser makes. Disable or remove any of them without leaving the popup. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ONE HONEST LIMIT No extension can make you unidentifiable. Blocking known trackers and hardening Chrome removes the great majority of commercial tracking, but a site that fingerprints you in its own first-party code is beyond the reach of any blocklist. Bulwark shows you that surface on the "This page" tab instead of pretending it closed it.