What Xiao changes

This page is generated from the same settings files the browser uses, so it can't drift from what Xiao actually does.

Settings

Telemetry, studies and remote experiments (18)

Nothing about how you use the browser is sent anywhere, and no one can switch on experiments remotely.

`datareporting.policy.dataSubmissionEnabled`	`false`
`datareporting.healthreport.uploadEnabled`	`false`
`toolkit.telemetry.enabled`	`false`
`toolkit.telemetry.unified`	`false`
`toolkit.telemetry.server`	`data:,`
`toolkit.telemetry.archive.enabled`	`false`
`toolkit.telemetry.newProfilePing.enabled`	`false`
`toolkit.telemetry.shutdownPingSender.enabled`	`false`
`toolkit.telemetry.updatePing.enabled`	`false`
`toolkit.telemetry.bhrPing.enabled`	`false`
`toolkit.telemetry.firstShutdownPing.enabled`	`false`
`app.shield.optoutstudies.enabled`	`false`
`app.normandy.enabled`	`false`
`app.normandy.api_url`	`""`
`messaging-system.rsexperimentloader.enabled`	`false`
`browser.discovery.enabled`	`false`
`breakpad.reportURL`	`""`
`browser.tabs.crashReporting.sendReport`	`false`

Sponsored content and recommendations (8)

No sponsored shortcuts, suggestions or add-on recommendations.

`browser.newtabpage.activity-stream.showSponsored`	`false`
`browser.newtabpage.activity-stream.showSponsoredTopSites`	`false`
`browser.newtabpage.activity-stream.feeds.telemetry`	`false`
`browser.newtabpage.activity-stream.telemetry`	`false`
`browser.urlbar.suggest.quicksuggest.sponsored`	`false`
`browser.urlbar.suggest.quicksuggest.nonsponsored`	`false`
`extensions.getAddons.showPane`	`false`
`extensions.htmlaboutaddons.recommendations.enabled`	`false`

Tracking protection (14)

Strict tracking protection, cookies kept per site, tracking parameters removed from links, and a Global Privacy Control signal.

`browser.contentblocking.category`	`strict`
`privacy.trackingprotection.enabled`	`true`
`privacy.trackingprotection.socialtracking.enabled`	`true`
`network.cookie.cookieBehavior`	`5`
`privacy.query_stripping.enabled`	`true`
`privacy.query_stripping.enabled.pbmode`	`true`
`privacy.globalprivacycontrol.enabled`	`true`
`privacy.fingerprintingProtection`	`true`
`privacy.fingerprintingProtection.pbmode`	`true`
`privacy.fingerprintingProtection.overrides`	`+WebGLRenderInfo,+WebGLVendorRandomize,+ScreenRect,+ScreenAvailRect,+WindowOuterSize,+NavigatorHWConcurrencyTiered,+FontVisibilityBaseSystem,+FontVisibilityLangPack,+AudioSampleRate`
`privacy.partition.network_state.ocsp_cache`	`true`
`network.http.referer.XOriginTrimmingPolicy`	`2`
`browser.send_pings`	`false`
`dom.battery.enabled`	`false`

Connections (14)

Pages load over HTTPS only, certificate checks are strict, and DNS lookups are encrypted (Quad9).

`dom.security.https_only_mode`	`true`
`dom.security.https_only_mode_send_http_background_request`	`false`
`security.tls.enable_0rtt_data`	`false`
`security.ssl.require_safe_negotiation`	`true`
`security.ssl.treat_unsafe_negotiation_as_broken`	`true`
`security.cert_pinning.enforcement_level`	`2`
`security.remote_settings.crlite_filters.enabled`	`true`
`security.pki.crlite_mode`	`2`
`browser.xul.error_pages.expert_bad_cert`	`true`
`network.IDN_show_punycode`	`true`
`network.trr.mode`	`2`
`network.trr.uri`	`https://dns.quad9.net/dns-query`
`network.trr.custom_uri`	`https://dns.quad9.net/dns-query`
`doh-rollout.disable-heuristics`	`true`

Requests made before you ask (also keeps the Tor container clean) (13)

The browser doesn't connect to sites you haven't opened: no prefetching, no early connections, no search suggestions while you type.

`network.prefetch-next`	`false`
`network.dns.disablePrefetch`	`true`
`network.dns.disablePrefetchFromHTTPS`	`true`
`network.predictor.enabled`	`false`
`network.predictor.enable-prefetch`	`false`
`network.http.speculative-parallel-limit`	`0`
`browser.places.speculativeConnect.enabled`	`false`
`browser.urlbar.speculativeConnect.enabled`	`false`
`browser.search.suggest.enabled`	`false`
`browser.urlbar.suggest.searches`	`false`
`network.proxy.socks_remote_dns`	`true`
`network.file.disable_unc_paths`	`true`
`network.gio.supported-protocols`	`""`

WebRTC: never reveal local addresses (3)

Video calls still work, but sites can't read your local network addresses.

`media.peerconnection.ice.default_address_only`	`true`
`media.peerconnection.ice.no_host`	`true`
`media.peerconnection.ice.proxy_only_if_behind_proxy`	`true`

Safe Browsing stays on; downloads are not sent to Google (3)

Known phishing and malware sites are still blocked, using lists checked on your computer. Files you download are not sent off for checking.

`browser.safebrowsing.malware.enabled`	`true`
`browser.safebrowsing.phishing.enabled`	`true`
`browser.safebrowsing.downloads.remote.enabled`	`false`

Smaller things (7)

PDFs can't run scripts, saved passwords aren't filled in automatically, and containers are turned on.

`pdfjs.enableScripting`	`false`
`network.auth.subresource-http-auth-allow`	`1`
`browser.download.always_ask_before_handling_new_types`	`true`
`signon.formlessCapture.enabled`	`false`
`signon.autofillForms`	`false`
`privacy.userContext.enabled`	`true`
`privacy.userContext.ui.enabled`	`true`

Local-only data (1)

Your browsing data stays on this computer: no Firefox Account and no Firefox Sync.

identity.fxaccounts.enabled false

Translation on this computer (1)

Firefox's own translation runs on your computer. Its language files come from Mozilla the first time you use a language.

browser.translations.enable true

Speed and memory (6)

Pages appear a little sooner, and fewer idle processes and tabs stay in memory. Tabs that were unloaded reload when you open them.

`content.notify.interval`	`100000`
`network.http.max-persistent-connections-per-server`	`10`
`dom.ipc.processPrelaunch.fission.number`	`1`
`browser.sessionstore.interval`	`60000`
`browser.tabs.min_inactive_duration_before_unload`	`300000`
`zen.tab-unloader.timeout-minutes`	`15`

Strict mode adds

Fingerprinting resistance and more (10)

Installed with --strict. Some sites look or behave differently.

`privacy.resistFingerprinting`	`true`
`privacy.resistFingerprinting.letterboxing`	`true`
`privacy.spoof_english`	`2`
`webgl.disabled`	`true`
`geo.enabled`	`false`
`network.trr.mode`	`3`
`media.peerconnection.ice.relay_only`	`true`
`privacy.sanitize.sanitizeOnShutdown`	`true`
`privacy.clearOnShutdown_v2.cookiesAndStorage`	`true`
`signon.rememberSignons`	`false`

Connections Xiao itself makes

Once a day, a newer blocking engine (made from EasyList, EasyPrivacy and uBlock Origin's lists) from Xiao's engine release on github.com, checked against its SHA-256. If there isn't one, Xiao keeps the engine it was installed with.
When the start page or toolbar shows Tor status: check.torproject.org, always through Tor.
With Xiao Search, your searches go from your own computer to the search engines SearXNG asks (by default Google, DuckDuckGo, Brave, Wikipedia and a few more), without cookies or an account.
Nothing else. There is no Xiao server, account or telemetry.

Zen and Firefox make their own connections (Safe Browsing lists, certificate revocation lists). The settings above switch off the ones that aren't needed for security. Read the files.

How memory was measured

test/e2e/memory.mjs on 2026-10-20: Zen 1.23.3b on an Apple silicon Mac, a fresh profile each time, the start page plus six pages (Wikipedia, The Guardian, BBC News, CNN, Reddit and an ad test page), measured 60 s after opening them with Firefox's own per-process figures, then again after Firefox's "minimise memory". Three runs of each version, alternating; the figures are medians.

	Xiao 0.1	Xiao 0.2
Add-on process, after a minute	1,135 MB (Xiao's blocker and Zen's add-ons)	40 MB (Zen's own add-ons)
Add-on process, after freeing memory	290 MB	39 MB
Whole browser, after a minute	3,193 MB	2,179 MB
Whole browser, after freeing memory	2,026 MB	1,821 MB
Each run, whole browser after a minute	2,692, 3,273, 3,193 MB	2,179, 2,119, 2,272 MB

0.1's extension built its blocking engine from the raw lists and kept it in a process of its own; 0.2 loads a prebuilt engine into the browser itself. 0.2 also keeps one spare web process instead of three. Busy sites move the whole-browser numbers a lot from run to run, so read them as a direction, not a promise. Run node test/e2e/memory.mjs to measure on your own machine.