Brave Origin for macOS, free, with the mistakes I made on the way

Brave Origin is the version of Brave with the crypto, the AI chat, the VPN pitch and the news feed removed at compile time. Brave sells it for $59.99 one time on macOS and Windows and gives it away on Linux. Brave’s own announcement says the same set of features can be turned off on a normal install by group policy. So I did that instead. One script, one sudo, and the regular Brave build behaves like Origin on both my Macs. Everything here is macOS only. The script writes a macOS managed preferences file, and Windows and Linux put policies somewhere else.

What the script does

The script writes a managed policy file at /Library/Managed Preferences/com.brave.Browser.plist. Brave reads that file at launch and treats every key in it as mandatory. You can see the result at brave://policy, where each row says Source: Platform, and Status reads OK for all but the three Privacy Sandbox rows, which read Deprecated. The script also makes a small “Brave Origin” launcher app in your Applications folder that starts Brave with two features disabled by flag. I don’t use it. The policy file already turns off Leo and the VPN, which is all the launcher’s flags do, so I open the regular Brave app. You can delete the launcher or skip that part of the script.

The policy file turns off the following. Each one is a documented Brave or Chromium policy key.

Rewards, Wallet, VPN, Talk, News, Playlist, Speedreader and Tor
Leo, the AI chat
P3A, the stats ping and web discovery, which are Brave’s telemetry
Sync, metrics reporting and user feedback
Brave’s password manager and autofill, because 1Password does that job
Search suggestions and the Privacy Sandbox keys

It also turns some things on. DNS over HTTPS goes to AdGuard in secure mode in Ailie’s version, and to Quad9 in mine. HTTPS upgrades are on. Memory saver is on. Component updates stay on, because those carry the ad block lists.

The script is by AilieIsQueen, who publishes it as a gist with a Buy Me a Coffee link. Ailie’s tip link is on the gist. My copy prints mine, because by now the script is a different script: Ko-fi first, which keeps nothing on one-time tips, and Buy Me a Coffee for anyone who already uses it. I changed ten of its policy lines for my own use and deleted five keys Brave ignores on macOS. Two of the ten I had first changed the wrong way in an earlier fork of my own. I caught both while writing this up, before posting, and I say so below. The copy I run is at the end of this post.

What I changed and why

DnsOverHttpsTemplates: Was AdGuard, now Quad9. Ailie points DNS over HTTPS at dns.adguard-dns.com. I prefer Quad9 for the reasons in the next section. My first fork pointed at dns10.quad9.net, which is Quad9’s unsecured address with no malware blocking and no DNSSEC, and I ran that on two Macs because I LARP as a security researcher. The right address is dns.quad9.net, the one Quad9 recommends.
SafeBrowsingProtectionLevel: Was enhanced in Ailie’s script, off in my first fork, now standard. The three settings are 0 for off, 1 for standard, which checks each site against a list of known phishing and malware pages, and 2 for enhanced, which sends live browsing data to the provider. Brave routes the standard check through its own proxy, so Google never sees your address or the full URL, and it catches phishing on clean domains and bad downloads, which DNS filtering can’t. Never use enhanced.
NetworkPredictionOptions: Was always predict, now never. The settings are 0 for predict on any network, 1 for Wi-Fi only, which Chromium has retired, and 2 for never. Predicting means Brave opens connections to sites it guesses you’ll click next. The original script set 0, which is the opposite of what a privacy script wants.
DeveloperToolsAvailability: Was allowed with one exception, now allowed everywhere. The settings are 0 for allowed except inside extensions installed by policy, 1 for allowed everywhere, and 2 for blocked. I have no policy-installed extensions, so 0 and 1 behave the same today. 1 says what I mean.
BraveWaybackMachineEnabled: Was false, now true. When a page 404s, Brave offers the Internet Archive copy. I use the archive daily. The cost is that failed URLs go to archive.org.
TranslateEnabled: Was false, now true. I’m in Spain next month.
SpellcheckEnabled: Was false, now true. The basic checker is an offline dictionary. Only the enhanced Google one sends text, and it stays off.
BookmarkBarEnabled: Was false, now true. I like it.
BrowserGuestModeEnabled: Was false, now true. A guest window lets someone else use the browser without touching my profile. I am the ultimate in couch maxxing and I pass that on to others.
BrowserAddPersonEnabled: Was false, now true. I keep a second profile for work.

Deleted, because Brave ignores them on macOS and they only put red rows on brave://policy: the three DefaultSearchProvider keys (Brave won’t set the search engine by policy, and Brave Search is already the default), HomepageLocation and NewTabPageLocation.

IncognitoModeAvailability 0 I left alone. The settings are 0 for private windows enabled, 1 for disabled, and 2 for forced, where every window is private. Chromium’s numbering is backwards from what the name suggests, so read the docs before you “fix” it.

Why Quad9

Ailie’s script points DNS over HTTPS at AdGuard. I moved it to Quad9, and the choice held up after I read who runs it. AdGuard’s resolver blocks ads at the DNS layer, and Brave already blocks ads in the browser with Shields, so that part of AdGuard does nothing here. It is also the wrong layer for me. I sometimes have to see a site with its ads on, to check a layout or an ad slot the way a reader sees it. Shields turns off for one site with one click. A DNS blocklist doesn’t know what a site is, so the only way to see the ads is to change the resolver. What a resolver can add is malware blocking and a privacy policy, and Quad9 is a foundation rather than a company, with blocking that is security only. That is the narrower promise I want from a resolver. Every page load starts with a DNS lookup, so whoever answers those lookups sees every site you visit. By default that is your ISP. Brave’s own resolver option and Cloudflare’s are fine, but Quad9 is the one I’d pick for three reasons, all from Quad9’s own pages.

It is a Swiss foundation, based in Zürich, and it treats your IP address as personal data under the strictest of Swiss, EU and US definitions, whichever protects you most. The privacy policy says so in section 1.0.
It blocks known malware and phishing domains using lists from about twenty threat intelligence partners, commercial and public. It refuses to answer a lookup for a domain on those lists, so the connection never starts. Quad9 says it blocks only for security, never content, ads or trackers, and its partner agreements require that.
It is free, with no account.

If you’d rather hear it than read it, Tom Lawrence of Lawrence Systems interviewed Quad9. The business model and partnership section starts at 6:10, and the part on why a recursive resolver should not do content blocking starts at 14:50.

Tom Lawrence interviews Quad9. Business model at 6:10, why a resolver should not block content at 14:50.

The one thing to get right is the address. Quad9 runs three. dns.quad9.net is the recommended one, with malware blocking and DNSSEC validation. dns11.quad9.net adds ECS, which passes part of your network to the sites you look up for faster routing. dns10.quad9.net, the one I pasted in first, is the unsecured address Quad9 labels “for experts only”, with no blocking and no DNSSEC. Use the first one.

Why Tor stays off

The script sets TorDisabled true and I left it. Brave’s private window with Tor sends your traffic through the Tor network using a Tor binary that ships inside Brave. It is not Tor Browser. The browser around it is still Brave, with Brave’s fingerprint surface, Brave’s extensions and Brave’s update cycle. Tor Browser exists because anonymity needs the whole browser built for it, and a Tor tab inside a normal browser gives people a feeling of cover they don’t have.

The record backs that up. In January 2021 a HackerOne report (hackerone.com/reports/1077022) showed that Brave’s Tor windows sent .onion lookups to the user’s normal DNS resolver, so an ISP or a DNS provider could see which hidden services you asked for. Brave fixed it in the 1.20 release. The issue thread notes the same bug had been known in the older Muon builds and it was unclear whether it had ever been fixed. One leak is enough for me. If I need Tor, I open Tor Browser. Origin removes Tor from the build too, so leaving it off keeps this setup honest to the thing it copies.

What doesn’t work, honestly

If you run Ailie’s original, some rows on brave://policy show errors, and none of them matter. The three DefaultSearchProvider keys show Error, because Brave refuses to set the search engine by policy, and Brave Search is already the default. HomepageLocation and NewTabPageLocation show Ignored on macOS. My copy deletes those five keys, and deletes them again on a rerun over an older file, so the only odd rows left are the three PrivacySandbox keys, which show Deprecated. Privacy Sandbox is Google’s Topics API, and Brave stripped it out of its build years ago. I left those three in because they do no harm on Brave and still matter on other Chromium builds.

Two gaps are real. There is no policy key for the sponsored images on the new tab page. Disabling Rewards also disables Brave’s browser ads, and in my testing the new tab page came up blank, but I can’t point at a Brave document that promises it. And Brave has never documented policy deployment on macOS. The open request for that is brave-browser issue 17740, still without an answer from staff. The managed preferences path is the standard Chromium one and it works on macOS 27 today. If a future macOS update clears raw plists from that folder, the fix is to wrap the same keys in a configuration profile.

Origin versus this

Origin removes the code. Policy hides the features. The difference shows up in three places. Origin has no Rewards or Wallet binaries to exploit, and the policy version still ships them, switched off. Origin can’t be undone by a user who finds the setting. The policy version can be undone by anyone with sudo, which on my machines is me. And Origin costs $59.99 per machine while the script costs a paste.

For one person on their own Macs, the policy version is the same browser in daily use. If you manage machines for other people, or you want the smaller attack surface, pay for Origin. Brave earns it.

Run it

Install Brave from the cask or from brave.com.
Save the script below as brave-origin-setup.sh.
Run sudo bash brave-origin-setup.sh.
Open Brave and check brave://policy.

To change a key later without rerunning the whole script, use PlistBuddy. For example, to put Translate back:

sudo /usr/libexec/PlistBuddy -c "Set :TranslateEnabled true" "/Library/Managed Preferences/com.brave.Browser.plist" && sudo killall cfprefsd

Then click Reload policies on brave://policy.

Sources

Brave, “Introducing Brave Origin”. Price, platforms, the feature list, and the line that the same set can be disabled by policy on a normal install.
Brave policy definitions in brave-core. Every Brave key in the script comes from here.
Chromium enterprise policy list. The Chromium keys and their numbering.
Lawrence Systems, “How Does Quad9 Combine Privacy, Security, and Free Service?”, YouTube, 2025-01-23.
Quad9, About, Privacy Policy, Threat Blocking, and the service address table. Read 2026-09-26.
Ailie’s original script, “Brave Origin macOS setup and policy script”. Fetched 2026-09-26 and diffed against my copy; the diff is the change list above.
Brave issue 17740. The open request to document macOS policy deployment.
HackerOne report 1077022 and Brave issue 13527. The 2021 report of Tor windows leaking .onion lookups to DNS, fixed in Brave 1.20.
The script, by AilieIsQueen, the gist. My copy with the changes is below.

Prompts for your own agent

Paste one of these into whatever agent you run.

Prompt 1 · Read the plist

Read this policy plist and tell me, key by key, what each one turns off, whether it is a Brave key or a Chromium key, and which values are backwards from what the name suggests. Flag any key that reduces security.

Prompt 2 · Check the macOS path

Check whether macOS (your version) clears raw plists from /Library/Managed Preferences on reboot. Cite Apple’s page or say you can’t find one. If it does, convert this plist into a configuration profile payload for com.brave.Browser.

Prompt 3 · Compare with Origin

Compare the feature list on brave.com/blog/brave-origin with the keys in this script and list what Origin removes that the script does not touch.

The script

Save as brave-origin-setup.sh, then sudo bash brave-origin-setup.sh.

#!/usr/bin/env bash
set -e

###############################################################################
# BRAVE ORIGIN - Complete debloat & speed fix + icon swap
# Platform: macOS
# Usage:   sudo bash brave-origin-setup.sh
# Source:  AilieIsQueen's script (gist.github.com/anxkhn/cb2f1c3e5fa82908a264fd04c220331d),
#          with Ryan Ilano's changes, 2026-09-26. See ilano.fyi for the list and why.
# Verif:   brave://policy
###############################################################################

echo "=========================================="
echo "  Brave Origin - macOS Setup"
echo "  ☕ https://ko-fi.com/ryanilano  (favorite: no fees on tips)"
echo "  ☕ https://buymeacoffee.com/ryanilano  (quick one-time thank-you)"
echo "  🌐 https://ilano.fyi"
echo "=========================================="
echo ""

# --- Detect which channel is installed ---
BRAVE_BUNDLE=""
BROWSER="Brave Browser"
if [ -d "/Applications/Brave Browser.app" ]; then
  BRAVE_BUNDLE="com.brave.Browser"
elif [ -d "/Applications/Brave Browser Beta.app" ]; then
  BRAVE_BUNDLE="com.brave.Browser.beta"
  BROWSER="Brave Browser Beta"
elif [ -d "/Applications/Brave Browser Nightly.app" ]; then
  BRAVE_BUNDLE="com.brave.Browser.nightly"
  BROWSER="Brave Browser Nightly"
else
  echo "[!] Brave Browser not found in /Applications."
  exit 1
fi
echo "[*] Detected: $BROWSER ($BRAVE_BUNDLE)"

# --- Setup managed preferences ---
MANAGED_PREFS_DIR="/Library/Managed Preferences"
if [ ! -d "$MANAGED_PREFS_DIR" ]; then
  sudo mkdir -p "$MANAGED_PREFS_DIR"
  sudo chown root:wheel "$MANAGED_PREFS_DIR"
  sudo chmod 755 "$MANAGED_PREFS_DIR"
fi

# --- Apply policies ---
echo "[1] Deploying system policies..."

write_policy() {
  local key="$1"
  local type="$2"
  local val="$3"
  sudo /usr/libexec/PlistBuddy -c "Add :$key $type $val" /Library/Managed\ Preferences/$BRAVE_BUNDLE.plist 2>/dev/null || \
  sudo /usr/libexec/PlistBuddy -c "Set :$key $val" /Library/Managed\ Preferences/$BRAVE_BUNDLE.plist
}

POLICY_FILE="/Library/Managed Preferences/$BRAVE_BUNDLE.plist"
if ! sudo plutil -lint "$POLICY_FILE" >/dev/null 2>&1; then
  sudo rm -f "$POLICY_FILE"
  sudo /usr/libexec/PlistBuddy -c "Clear dict" "$POLICY_FILE" >/dev/null
fi

# Keys Brave ignores on macOS. Remove them so a rerun over an older copy leaves no red rows.
for k in DefaultSearchProviderEnabled DefaultSearchProviderName DefaultSearchProviderSearchURL HomepageLocation NewTabPageLocation; do
  sudo /usr/libexec/PlistBuddy -c "Delete :$k" "$POLICY_FILE" 2>/dev/null || true
done

write_policy "BraveRewardsDisabled"       bool  true
write_policy "BraveWalletDisabled"        bool  true
write_policy "BraveVPNDisabled"           bool  true
write_policy "BraveAIChatEnabled"         bool  false
write_policy "BraveNewsDisabled"          bool  true
write_policy "BraveTalkDisabled"          bool  true
write_policy "TorDisabled"                bool  true
write_policy "BraveSpeedreaderEnabled"    bool  false
write_policy "BraveWaybackMachineEnabled" bool  true   # Ryan 2026-09-25: research tool, keep the offer
write_policy "BravePlaylistEnabled"       bool  false
write_policy "BraveP3AEnabled"            bool  false
write_policy "BraveStatsPingEnabled"      bool  false
write_policy "BraveWebDiscoveryEnabled"   bool  false
write_policy "SyncDisabled"               bool  true
write_policy "BackgroundModeEnabled"      bool  false
write_policy "MetricsReportingEnabled"    bool  false
write_policy "ComponentUpdatesEnabled"    bool  true
write_policy "HighEfficiencyModeEnabled"  bool  true
write_policy "DnsOverHttpsMode"             string  "secure"
write_policy "DnsOverHttpsTemplates"        string  "https://dns.quad9.net/dns-query"
write_policy "SafeBrowsingProtectionLevel"  integer 1   # Ryan 2026-09-26: standard, proxied by Brave
write_policy "AlternateErrorPagesEnabled"   bool    false
write_policy "NetworkPredictionOptions"     integer 2   # Ryan 2026-09-26: 2 = never predict; 0 was "always"
write_policy "PrivacySandboxAdTopicsEnabled"       bool  false
write_policy "PrivacySandboxPromptEnabled"         bool  false
write_policy "PrivacySandboxSiteEnabledAdsEnabled" bool  false
write_policy "PaymentMethodQueryEnabled"           bool  false
write_policy "UserFeedbackAllowed"                 bool  false
write_policy "SearchSuggestEnabled"                bool  false
write_policy "SpellcheckEnabled"                   bool  true    # Ryan 2026-09-26: local dictionary only
write_policy "HttpsUpgradesEnabled"                bool  true
write_policy "PasswordManagerEnabled"     bool  false
write_policy "AutofillAddressEnabled"     bool  false
write_policy "AutofillCreditCardEnabled"  bool  false
write_policy "TranslateEnabled"           bool  true   # Ryan 2026-09-25: Spain trip, keep translate
write_policy "DeveloperToolsAvailability" integer 1   # Ryan 2026-09-26: 1 = allowed everywhere
write_policy "IncognitoModeAvailability"    integer 0
write_policy "BrowserAddPersonEnabled"      bool    true   # Ryan 2026-09-26: allow extra profiles
write_policy "BrowserGuestModeEnabled"      bool    true   # Ryan 2026-09-26: guest window for other people
write_policy "DefaultBrowserSettingEnabled" bool    false
write_policy "BookmarkBarEnabled"  bool    true   # Ryan 2026-09-25: keep the bar
write_policy "ShowHomeButton"      bool    false
write_policy "DownloadRestrictions"      integer 0
write_policy "PromptForDownloadLocation" bool    true
write_policy "PrintingEnabled" bool true

sudo /usr/libexec/PlistBuddy -c "Save" "/Library/Managed Preferences/$BRAVE_BUNDLE.plist" 2>/dev/null
sudo chown root:wheel "/Library/Managed Preferences/$BRAVE_BUNDLE.plist" 2>/dev/null
sudo chmod 644 "/Library/Managed Preferences/$BRAVE_BUNDLE.plist" 2>/dev/null
sudo killall cfprefsd 2>/dev/null || true
echo "    -> Policies applied to $BRAVE_BUNDLE"

# --- 2. Create Brave Origin launcher app ---
echo "[2] Creating Brave Origin launcher app..."

# The launcher belongs to the person who ran sudo, not root.
REAL_USER="${SUDO_USER:-$USER}"
REAL_HOME=$(dscl . -read "/Users/$REAL_USER" NFSHomeDirectory 2>/dev/null | awk '{print $2}')
REAL_HOME="${REAL_HOME:-$HOME}"
LAUNCHER_APP="$REAL_HOME/Applications/Brave Origin.app"
mkdir -p "$LAUNCHER_APP/Contents/MacOS"
mkdir -p "$LAUNCHER_APP/Contents/Resources"

cat > "$LAUNCHER_APP/Contents/MacOS/Brave Origin" << 'LAUNCHER_EOF'
#!/bin/bash
BROWSER_APP=""

for app in "/Applications/Brave Browser.app" "/Applications/Brave Browser Beta.app" "/Applications/Brave Browser Nightly.app"; do
  if [ -d "$app" ]; then
    BROWSER_APP="$app"
    break
  fi
done

exec "$BROWSER_APP/Contents/MacOS/$(basename "$BROWSER_APP" .app)" \
  --disable-features=AIChat,BraveVPN \
  --enable-features=HighEfficiencyMode \
  "$@"
LAUNCHER_EOF

chmod +x "$LAUNCHER_APP/Contents/MacOS/Brave Origin"

cat > "$LAUNCHER_APP/Contents/Info.plist" << PLIST_EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>CFBundleExecutable</key>
  <string>Brave Origin</string>
  <key>CFBundleIdentifier</key>
  <string>com.brave.origin</string>
  <key>CFBundleName</key>
  <string>Brave Origin</string>
  <key>CFBundlePackageType</key>
  <string>APPL</string>
</dict>
</plist>
PLIST_EOF
chown -R "$REAL_USER" "$REAL_HOME/Applications" 2>/dev/null || chown -R "$REAL_USER" "$LAUNCHER_APP"

echo ""
echo "=========================================="
echo "  DONE"
echo "  ☕ https://ko-fi.com/ryanilano  (favorite: no fees on tips)"
echo "  ☕ https://buymeacoffee.com/ryanilano  (quick one-time thank-you)"
echo "  🌐 https://ilano.fyi"
echo "=========================================="
echo ""
echo "Open 'Brave Origin' from $REAL_HOME/Applications"
echo "(instead of normal Brave) for the flags to take effect."
echo ""
echo "Manual steps (do once in Brave):"
echo ""
echo "  brave://flags/#brave-sidebar        -> Disabled"
echo "  brave://flags/#enable-zero-copy      -> Enabled"
echo "  brave://flags/#enable-parallel-downloading -> Enabled"
echo "  brave://settings/appearance          -> Use system title bar and borders ON"
echo "  brave://settings/system              -> Memory Saver ON"
echo ""
echo "Verify: brave://policy"
echo ""