Brave Leo encrypted chat is now live in the Brave browser, and it scrambles your prompts on your device before they leave it. Only a verified secure enclave run by NEAR AI can unscramble them, so Brave itself can’t read your conversation. For now it works with one model, GLM 5.3 Flash, and it’s still labeled beta.
Here are the quick facts:
- Announced: October 15, 2026, in a Brave blog post.
- Model: GLM 5.3 Flash, an open-weight model from Z.ai under the MIT license.
- Where: Brave Release, Beta and Nightly channels.
- How to use it: pick GLM 5.3 Flash in Leo’s model settings.
- Catch: other Leo models and features aren’t covered yet.
That list is the short version. The details below explain what the protection really does, and where it stops.
How Brave Leo encrypted chat keeps your prompts private
Normally, when you ask an AI assistant a question, the text travels to a company’s server in a readable form. Policies say what the company will do with it, but the company can technically see it. Brave is trying to remove that “trust us” step.
Your browser encrypts each prompt, plus any page you share with Leo, using a method called Oblivious HTTP. It does this only after checking proof, called attestation, that the receiving server is a genuine trusted execution environment. That’s a locked-down area of the processor that even the machine’s owner can’t peek into.
According to Brave’s announcement, the model runs inside these environments hosted by NEAR AI, on Intel TDX processors and Nvidia confidential-computing GPUs. Brave’s AI Gateway sits in the middle. It passes along the encrypted message and removes your IP address, so NEAR AI doesn’t learn who you are.
Every new message re-encrypts the whole conversation history. The model can also run web searches through Brave Search from inside the enclave, without exposing your chat outside it.
Turning it on and what it covers
You don’t need a special setting. Open Leo, go to the model picker, and choose GLM 5.3 Flash. Brave says the feature is available in the Release, Beta and Nightly versions of the browser.
The announcement doesn’t say whether it’s free or tied to a paid plan, and it doesn’t list platforms. Check Leo’s model menu on your own device to see if the option shows up.
Coverage is narrow right now. Brave says other Leo models and features aren’t yet available in these verifiably private chats. CyberInsider notes this builds on Leo’s confidential computing from November 2025, where prompts still passed through Brave’s servers under policy-based safeguards. The new version removes that readable stop.
Who can see what, and where the limits are
The table below sums up who can read your prompt under this setup, based on Brave’s description.
| Who | Can read your prompt? | Why |
|---|---|---|
| You | Yes | Your browser holds the readable text and your chat history. |
| Brave’s AI Gateway | No | It relays encrypted traffic and strips your IP address, but cannot read the content. |
| NEAR AI (the host) | Only inside the enclave | Decryption happens in attested hardware, not on ordinary servers. |
| The model’s maker | No | Z.ai released the open weights but does not host your chat. |
This setup is a strong privacy upgrade, but it isn’t magic. Brave is open about the gaps, and they matter if you’re deciding how much to trust it.
- The browser currently relies on Brave’s gateway to check the enclave’s key. So you still trust Brave for that step, though Brave plans to move the check into the browser.
- The relay still sees your IP address, even though it can’t read your words.
- Open weights don’t rule out tampering, and the verification chain depends on Intel, Nvidia and other third parties.
In plain terms, you’re trading “trust one company’s policy” for “trust hardware and a verification chain.” That’s a better bet for sensitive prompts, but it isn’t zero trust.
Should you use Brave Leo encrypted chat?
It’s worth trying if you paste anything personal into AI tools, such as medical questions, work drafts or private messages. The encrypted option is built for exactly that kind of prompt.
It also pairs well with other privacy habits. If you use ChatGPT too, our guide to ChatGPT locked chats shows where a PIN lock helps and where it doesn’t. And if you let assistants see your tabs, read what the ChatGPT Chrome extension can read and control first.
Keep your expectations realistic, though. GLM 5.3 Flash is one model, and it may not match the assistant you’re used to for tough tasks. Use it for private questions, and switch back for everything else.
Frequently Asked Questions
Can Brave read my Leo chats with GLM 5.3 Flash?
According to Brave, no. Your browser encrypts the prompt, and only code inside the attested enclave can decrypt it. Brave’s gateway only relays the encrypted data.
Does Brave Leo encrypted chat hide my IP address?
It hides it from NEAR AI, because the gateway strips it before forwarding. Brave’s relay still sees your IP address, which Brave acknowledges.
Is every Leo model encrypted this way?
No. Only GLM 5.3 Flash is covered for now. Brave says other models and features aren’t yet available in verifiably private chats.
Is the feature still in beta?
Brave says GLM 5.3 Flash is in beta. The feature is available in Brave’s Release, Beta and Nightly channels.
My take: this is the most concrete privacy move I’ve seen from a mainstream browser’s AI assistant this year, mainly because you can verify parts of it instead of taking a promise on faith. Use it for anything you’d hesitate to type into a normal chatbot, and keep an eye on Brave’s plan to move the checks into the browser, because that’s the change that would close the biggest gap.
Leave a Reply