Don't trust it. Check it.

Check the installer is the one we published

After downloading LeetBrowserSetup.exe, you can check it right here. Choose or drop the file; your browser computes its SHA-256 on your own computer and nothing is uploaded.

Or do it in PowerShell. Open it in the folder and run:

Get-FileHash .\LeetBrowserSetup.exe -Algorithm SHA256

The result must match this value for version 1.261017.2:

533ad110d7b59bd6039b8383d7de0613bbc2892ae33208cf056e5643c1cfe744

The same hash is in the signed file latest.txt in our public releases repository, next to the installer's size (133,909,746 bytes). For newer versions, that file is the source of truth. If the hash differs, don't run the file.

Know how updates are protected

The installer on GitHub is not what protects you after installation. Each update notice (latest.txt) carries an ECDSA P-256 signature over the version, the installer's address, its size and its SHA-256. The matching public key is built into the browser. The browser ignores a notice that is unsigned, edited, older, too large or points to a different host, and deletes any download whose size or hash differs. Redirects are followed by hand and every hop must be on a short list of GitHub hosts. Nothing is installed while you work: it installs when you press "Restart to update" or close the browser.

You can switch the whole thing off in Settings, "Keep Leet up to date". Then Leet checks for nothing.

Watch what the browser connects to (Windows)

Start Leet, leave it idle on the start page for a minute, then in PowerShell run:

Get-Process leet | ForEach-Object {
  Get-NetTCPConnection -OwningProcess $_.Id -ErrorAction SilentlyContinue
} | Where-Object RemoteAddress -notin '127.0.0.1','::1' |
  Select-Object RemoteAddress, RemotePort, State | Sort-Object RemoteAddress -Unique

What you should see: nothing while idle, except possibly the one update check to GitHub (a few seconds after start, then every 6 hours). Once you open a page, you should see addresses of that page's own servers and nothing else. To see a name instead of an address, use Resolve-DnsName <address> or the Resource Monitor's Network tab. Turn off "Keep Leet up to date" and restart: the list should now be empty when idle.

For a harder test, add a Windows Firewall outbound rule for leet.exe that blocks everything, or watch with a packet tool such as Wireshark. The browser needs the network only for pages you open.

See what the browser refuses

Chromium, the engine underneath on Windows, tries on its own to contact some Google services (account and update hosts). Leet routes every secure connection through a local checkpoint that refuses those hosts, so nothing is sent. Our last network audit of an idle, installed build (13 October 2026) found no connection outside the page's own site. That audit was run before the update check was added, so the update notice is now the one known exception, listed on the data table.

Android

The Android app is not released yet. Once it is, it will come through Google Play, which verifies the app's signature. Its privacy policy is here. The same network-watching idea applies: a firewall app or a Private DNS log on the phone shows only the sites you open.