Security

Page engine and updates

Windows: DodoBrowser uses the shared Edge engine on your system and doesn't carry a separate copy of it. Microsoft updates the engine automatically, on the same security schedule as Edge. You don't need to wait for a new DodoBrowser version.

If an engine update needs a restart, DodoBrowser lets you know. You decide when to restart.

Android: The phone's Chromium-based page engine is used; DodoBrowser doesn't carry a separate copy. The engine is updated by Google Play through the phone's system. These updates, too, are independent of the DodoBrowser version.

Security protections

• Malicious sites and files: Microsoft Defender SmartScreen is used on Windows, and Google Safe Browsing protection on Android. These protections aren't turned off. On Windows, a file that was stopped because it is dangerous isn't downloaded again.
• Site isolation (Windows): Sites are kept separate from each other and from your computer in the engine's own compartments, which run with restricted privileges.
• Certificate checks: Pages with an invalid certificate are stopped with a warning. If you choose to continue, your permission applies only to that site, certificate and error; for a different certificate or error, you're asked again. The permission applies in all open tabs, isn't saved to disk, and is deleted when DodoBrowser closes.
• Encrypted connections: An address you type is tried over HTTPS first. If you type a password on an unencrypted page, the lock in the address bar turns red to warn you.
• Site permissions: Camera, microphone and location access need your approval. Background tabs can't ask for permissions; notifications are off by default.
• Misleading site names: Addresses built from look-alike characters are shown in their encoded form.
• The browser's own pages: Sites can't send commands to DodoBrowser's settings or its own pages.

Passwords and account details

On Windows, your passwords and Google sign-in token are stored with encryption tied to your Windows account. Another Windows user can't read them. Your saved passwords aren't synced and aren't sent to us.

An exported password file isn't encrypted. DodoBrowser warns you before the export and asks you to confirm with your Windows account every time. You should delete the file when you're done.

On Android, your phone's password manager handles your passwords; DodoBrowser doesn't store them. The Google sign-in token isn't kept on the phone permanently.

Details of how data is handled are in the Privacy policy.

Official distribution and updates

Windows: The official distribution channel is Microsoft Store. Microsoft reviews published versions, scans them for malware and signs them. If you would rather not open the Store app, the Microsoft installer or the command winget install 9P17GF8DSSL1 -s msstore installs the same package, signed by Microsoft. App updates arrive automatically from the Store.

Android: The official APK file is offered on the Android page; it isn't on Google Play. The file is signed with our own key and doesn't go through a store review. You can compare the file you downloaded with the SHA-256 value on that page. When you update from inside the app, Dodo downloads the file from a fixed GitHub address and, before installing, checks that its signature matches the installed Dodo's; if it doesn't, Dodo doesn't install it. Android also won't install a file with a different signature over Dodo. The SHA-256 check only catches a damaged or partly downloaded file; the signature is the real safeguard. You approve the install in Android's window.

Download links offered on other sites aren't our official distribution. Security fixes take priority and are released without delay as soon as they're ready. Updates don't delete your data or settings.

Contacting us about security

You can reach info@dodobrowser.com by writing “Security” in the subject line. It's enough to describe what you ran into, along with the version number from Settings → About.

Every report is answered within 7 days at the latest.

DodoBrowser's own code

Opening pages, network connections and the engine's security protections are provided by Edge on Windows and the phone's page engine on Android. DodoBrowser's own code manages the window, tabs, address bar, Shield, Start page and settings; it is kept small and simple.