iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes—Brave says Leo’s new private mode encrypts prompts on your device before they leave it, then decrypts them only inside an attested Trusted Execution Environment (TEE) running the model. The relay that handles your connection can see your IP address but not the prompt. This is stronger than ordinary transport encryption, but it still requires trust in Brave’s verifier, the attestation evidence, the enclave hardware, and the exact model build covered by that attestation.
What Brave announced on October 15, 2026
Brave’s end-to-end encrypted chat is available in Brave Release, Beta, and Nightly. At launch, the protected mode is tied to GLM 5.3 Flash, an open-weight model released by Z.ai under an MIT license and hosted by NEAR AI in attested hardware.
Brave describes the design this way: “Your Brave browser encrypts each prompt on your device, before leaving your device, such that only an attested Trusted Execution Environment (TEE) can decrypt your prompts and run confidential LLM inference on it.”
Free tools Windows power users keep installed
One-click scans. No signup required.
The feature is not a claim that no system ever handles readable text. The model must receive plaintext to answer, so decryption occurs inside the attested enclave. The privacy claim is that the relay and infrastructure operators outside that enclave cannot read the conversation.
#1 Best Overall
How an encrypted Leo request works
1. Brave verifies the enclave before releasing a key
Before encryption keys are made available, Brave’s open-source verifier checks the TEE’s attestation, the approved software builds, and a key signed from inside the TEE. If those checks fail, Brave says, “Brave won’t hand out the key or relay your message.”
This verification step defines the trust boundary: the key is intended for the approved code running in the measured enclave, rather than for an arbitrary server process.
2. Your device encrypts each turn
The browser encrypts your prompt and any page content you share with Leo before sending it over the network. A fresh one-time key is generated for each turn, and the full conversation is re-encrypted as the chat continues.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
That means a relay receiving network traffic gets ciphertext rather than a readable transcript. It also limits the reuse of any single per-turn key if traffic is captured.
3. An OHTTP relay separates your IP from the prompt
Brave’s AI Gateway acts as an Oblivious HTTP (OHTTP) relay. It can see the connecting user’s IP address, but it cannot read the encrypted request. Brave forwards the request to the NEAR AI gateway under Brave’s account, so the NEAR AI gateway does not learn the user’s IP address.
4. The model runs inside confidential hardware
The NEAR AI gateway and the inference service run inside sealed, Nvidia-backed hardware enclaves. The enclave decrypts the request, runs GLM 5.3 Flash, and encrypts the response before it leaves the protected environment. Brave says the enclave is designed to protect prompts and responses from infrastructure operators, including Brave and NEAR AI.
Which part of the system can see what?
| Component | Can see your IP address? | Can see the plaintext prompt? |
|---|---|---|
| Brave AI Gateway relay | Yes | No |
| NEAR AI gateway TEE | No | Yes, inside the TEE only |
| NEAR AI inference TEE | No | Yes, inside the TEE only |
The table explains why Brave calls the mode end-to-end encrypted while still using a hosted model: readable text exists at the inference endpoint, but only within the attested execution environment.
Is Brave Leo really end-to-end encrypted?
Under Brave’s stated architecture, the answer is yes for the path between your browser and the attested inference environment. The relay cannot inspect the ciphertext, and the hosting operators are not supposed to obtain readable prompts outside the enclave.
This differs from ordinary HTTPS or other transport encryption. Transport encryption protects traffic while it travels between two network endpoints; the endpoint service can normally decrypt it on its own servers. Leo’s design adds device-side encryption, an OHTTP relay, and attestation so the intermediary handling the connection is not also the party reading the prompt.
What the claim depends on
- The verifier must correctly validate the TEE attestation and approved build.
- The enclave hardware and its attestation mechanism must enforce the stated isolation.
- The signed key must genuinely originate from the verified TEE.
- The model and pipeline running in the enclave must match what the attestation covers.
Brave’s engineering authors summarize the intended result as: “Brave and NEAR AI never hold a readable copy of your chats, so there’s nothing readable to train on, hand over, or leak.” That is a statement about the system design and its verified execution path, not an independent measurement of every possible implementation or operational failure.
Can Brave read your Leo chats, and what metadata remains?
Brave says its AI Gateway can route the request without reading the prompt, while the NEAR AI side can decrypt it only inside the TEE and does not receive your IP address. The relay nevertheless sees the IP address needed to accept your connection. The announcement does not promise that every network-level metadata field—such as timing or traffic size—is invisible.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsBrave also says no account or login is required for Leo’s private chat. If you use a Premium subscription, Brave validates it with unlinkable tokens rather than attaching the subscription check to a readable chat identity.
Best Value
Where are Leo conversations stored?
Chat history on your device
Leo’s help center says local chat history is kept in local storage on your device. That makes the browser profile holding the local data the place to consider when you clear site data, reset a profile, or move to another device.
Data on Brave’s servers
Brave’s model help page says conversation data is discarded from Brave’s servers immediately after a chat session ends. That statement concerns server-side conversation data; it does not erase the local history retained by your browser.
Which model supports encrypted Leo?
The October 15 launch connects encrypted mode to GLM 5.3 Flash. Brave says the model is open-weight, released by Z.ai under the MIT license, and hosted by NEAR AI in attested hardware.
The model is not permanently fixed by the concept of encrypted Leo. Brave’s earlier November 20, 2025 announcement began the verifiable-TEE rollout with DeepSeek V3.1 in Nightly. That history shows that the supported model and release channel can change as Brave expands the system. Brave says more Leo features and open-weight models are planned for verifiably private chats.
What you need to use the private mode
- Use a current Brave Release, Beta, or Nightly build that exposes the encrypted Leo capability.
- Choose the supported encrypted model, GLM 5.3 Flash at the October 15 launch.
- Send prompts normally; the browser performs the attestation check and encrypts the prompt before transmission.
- Share page content only when you want that content included, because shared page text is part of the encrypted request and will be processed by the model inside the TEE.
- Manage or clear local chat history in the browser profile if you do not want conversations retained on the device.
No account or Brave Premium subscription is required for the basic private-chat path, according to Brave. Premium validation uses unlinkable tokens when applicable.
Important limits to understand
- Not every Leo model or feature is necessarily covered. The launch specifically names GLM 5.3 Flash; support for additional models is a future expansion.
- Attestation is central. If verification fails, the documented behavior is to withhold the key and not relay the message.
- The model still sees plaintext inside the enclave. End-to-end here means the intermediary relay and outside infrastructure cannot read the request, not that inference occurs on your device.
- Local history is separate from server deletion. Ending a session removes server-side conversation data according to Brave’s help documentation, while local storage can remain on your device.
- No performance or security-rate guarantee is stated. The launch provides an architecture and verification process, not an independently reported latency, accuracy, usage, or breach-rate statistic.
Bottom line
Brave Leo’s encrypted mode is designed so your browser encrypts each turn, Brave’s relay sees your IP but not your prompt, and only a verified TEE can decrypt the request for GLM 5.3 Flash. It is a meaningful privacy upgrade over a conventional hosted chatbot, provided you accept the remaining trust in attestation, enclave hardware, approved code, and the local browser storage that keeps your history.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
