osfv/BraveDebloater

Safety-first Windows PowerShell debloater for Brave Browser using enterprise policies, dry-run mode, backups, and restore

Summary

BraveDebloater is a PowerShell tool that disables Brave Browser extras using official Brave and Chromium enterprise policies rather than in-app toggles, with Windows registry writes, macOS defaults/plist payloads, and Linux JSON policy files all supported. It runs in dry-run mode by default, writes a JSON backup before any apply run, and explicitly refuses to weaken Shields, disable updates, edit the hosts file, or patch binaries. Engineers can use it to put Brave under managed policy control on workstations where brave://settings toggles get re-promoted after browser updates.

What it is useful for

• Locking down privacy-sensitive browsers so changes survive Brave updates and remain visible in brave://policy
• Disabling Brave-specific surfaces such as Rewards, Wallet, VPN, Leo AI Chat, News, Talk, Playlist, Email Aliases, Speedreader, and Wayback prompts
• Turning off telemetry paths including Brave P3A, stats ping, Web Discovery, Chromium metrics, URL-keyed data collection, remote search suggestions, and remote spellcheck
• Enforcing a stricter Shields baseline with the optional -LockShields add-on
• Forcing DNS-over-HTTPS through a resolver of your choice, for example .\Invoke-BraveDebloater.ps1 -DnsOverHttps Secure -DnsOverHttpsTemplates https://dns.quad9.net/dns-query
• Auditing an existing Brave install without changing anything via -Doctor
• Producing MDM payloads for iOS or Android via -ExportPolicyPath

The tool is policy-only: it does not edit Preferences unless you pass -IncludeProfilePreferences, does not manage extensions, and does not disable Brave updates.

How engineers can use it

The documented installer pulls the latest release zip, verifies it against SHA256SUMS.txt, and prints the preview command:

irm https://raw.githubusercontent.com/osfv/BraveDebloater/main/install.ps1 | iex

Always preview first. The default preset is Extreme, which includes Standard and High:

.\Invoke-BraveDebloater.ps1 -Preset Extreme
.\Invoke-BraveDebloater.ps1 -Preset Extreme -Apply

To target a single feature or a short list, use -OnlyFeature, for example .\Invoke-BraveDebloater.ps1 -OnlyFeature Rewards,Wallet,VPN,LeoAI -Apply. The full set of feature names is printed by -ListFeatures, and -Customize walks through each one interactively. After applying, restart Brave and confirm the policies loaded in brave://policy.

Every apply run prints the exact -UndoFromBackup command for that backup. To restore the newest backup automatically:

.\Invoke-BraveDebloater.ps1 -UndoFromBackup Latest -Apply

Documented limitations worth knowing: profile preference cleanup requires Brave to be closed; PowerShell 7.0 to 7.4 cannot keep date strings as text in JSON or plist files, so the script skips those targets (use PowerShell 7.5+ or Windows PowerShell 5.1); Android and iOS/iPadOS only support -ExportPolicyPath; and DNS-over-HTTPS control is not available for iOS/iPadOS exports. If Windows blocks the script under a Restricted execution policy, the README documents Set-ExecutionPolicy -Scope CurrentUser RemoteSigned as the user-scope workaround.