Brave says its latest Leo release uses end-to-end encryption, hardware attestation and Oblivious HTTP to keep users’ prompts hidden from the company and its AI infrastructure partner.
Brave has introduced end-to-end encrypted AI chat in Leo, its browser-based assistant, saying the system is designed so that prompts are encrypted on the user’s device before they are ever sent out. The company says only an attested trusted execution environment can decrypt the messages, while Brave and its AI infrastructure partner, NEAR AI, cannot read the content in transit or at rest.
The launch is pitched as a privacy upgrade for a product that often handles highly sensitive material. Brave argues that browser-side AI can expose far more than a normal search query, because users increasingly ask assistants to interpret medical results, legal notices, workplace documents and other private pages. That concern is not hypothetical: Brave cites survey data showing that large numbers of people already use chatbots for health-related questions and routinely paste personal or payment information into AI tools.
Brave’s broader argument is that privacy claims are not enough unless they can be checked. The company has long framed its browser work around the idea that users should be able to verify what software is doing, not merely trust assurances about it. In a previous step last year, Brave moved Leo towards “verifiable privacy and transparency” by running models inside Nvidia-backed trusted execution environments operated by NEAR AI. The new release extends that approach by adding end-to-end encryption before the prompt leaves the browser.
According to Brave, the process begins with hardware attestation. Before the browser shares a key, a secure enclave must prove that it is genuine hardware, that the approved model and code are running inside it, and that the deployment matches the audited version. Only then does the browser encrypt the prompt using Oblivious HTTP, a standard designed to separate message content from the user’s network identity.
Brave says the relay layer strips the user’s IP address before forwarding the encrypted request, so the AI operator receives the message without seeing where it came from. The company also says Leo retains its existing privacy traits, including no account requirement, no login, and no chat retention on Brave’s side. For paid users, Brave says subscription checks are handled with unlinkable tokens so billing details cannot be tied back to conversations.
The assistant currently runs the open-weight GLM 5.3 Flash model, which Brave says allows independent inspection of the model weights while still letting NEAR AI host the workload inside sealed hardware. Brave presents that combination of open weights, public code and hardware attestation as its answer to a wider problem in AI: a model may be visible on paper, but users still need proof of what actually runs and who can access it. The company also points to earlier work on open models in Leo, including support for other open-weight systems and its own benchmarking of Ask Brave.
Brave says the code for the main components involved in the system is public, including the browser-side client, the gateway and the verifier that checks attestation before a key is issued. The company presents the launch as part of a longer effort to make AI privacy something users can inspect rather than accept on faith, with the new encrypted chat now available in Brave’s Release, Beta and Nightly channels.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
