Yep, if you don't want to use Sync, user.js is an alternative. It's also helpful for sharing settings across multiple profiles. (For the latter, I do wish there was support for including other files...)
There is a user.js project on github[1] maintained by ghacks.net community members that provides a source of documentation for many settings. It's also useful as a way to monitor new and deprecated settings.
[1]: https://github.com/ghacksuserjs/ghacks-user.js
In Switching from Chrome to Firefoxarkenfox
user.js
JavaScript2018–2026
arkenfox / user.js
user.js
Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
78Distinct people
110Mentions
5Explicit recommenders
13KGitHub stars
What to know before exploring
What it is
Firefox privacy, security and anti-tracking: a comprehensive user.js template for configuration and hardening
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
For extensions, I recommend people follow the recommendations[1] in the arkenfox repo and either harden their firefox or use librewolf. Umatrix is unmaintained since 2019. [1]…
bmikaili used a recommendation phrase. 5 indexed comments match. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- pyllyukko/user.js · linked in 3 of the same discussions
- yokoffing/betterfox · linked in 3 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 8:27:21 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year110 dated mentions
Observed mentions: 2018-09-14 13:37:15 UTC to 2026-03-07 01:03:43 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 13 | 1 | 12 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 8 | 0 | 8 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 11 | 1 | 10 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 25 | 1 | 24 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 20 | 0 | 20 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 10 | 1 | 9 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 20 | 0 | 20 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 2 | 0 | 2 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
This repo and the interactive webpage linked below are the only official sources - do not trust any other sites claiming to be Arkenfox
🟪 user.js
A user.js is a configuration file that can control Firefox settings - for a more technical breakdown and explanation, you can read more in the wiki
🟩 the arkenfox user.js
The arkenfox user.js is a template which aims to provide as much privacy and enhanced security as possible, and to reduce tracking and fingerprinting as much as possible - while minimizing any loss of functionality and breakage (but it will happen).
Firefox's built-in profile feature (enabled since FF150) can copy some preferences across profiles, including data-reporting and Health Reports preferences set by this template. Do not assume these settings are independent per profile; review Permissions and data > Firefox data collection and use in Firefox Settings and verify the shared behavior. The exact shared-preference list is Firefox-version-dependent. See 1933264 and permanentSharedPrefs.
Everyone, experts included, should at least read the wiki, as it contains important information regarding a few user.js settings. There is also an interactive current release, thanks to icpantsparti2.
Note that we do not recommend connecting over Tor on Firefox. Use the Tor Browser if your threat model calls for it, or for accessing hidden services.
Also be aware that the arkenfox user.js is made specifically for desktop Firefox. Using it as-is in other Gecko-based browsers can be counterproductive, especially in the Tor Browser.
🟧 sitemap
releases
changelogs
wiki
stickies
diffs
common questions and answers
🟥 acknowledgments
Literally thousands of sources, references and suggestions. Many thanks, and much appreciated.
Read the full README on GitHubWhat Hacker News says
13 sourcesFor everyone wondering: Firefox extension Chameleon randomly spoofs your user agent. However, I would highly recommend NOT using this extension, or randomizing your user agent whatsoever - it only raises your entropy and makes you easier to track. You should be trying to make your browser look identical to everyone else's, not different.
This can by partially achieved by setting privacy.resistFingerprinting to true in Firefox's about:config. This won't stop Panopticlick from fingerprinting you. If you really want to reduce your fingerprint, try using the ghacks user.js [1]. If you want to make fingerprinting completely impossible, use the TOR browser [2].
Most users don't need to worry about this - uBlock origin blacklists most fingerprinting efforts by default.
Please read: https://www.privacytools.io/browsers/#fingerprint
[1] https://gi
Read the rest
thub.com/ghacksuserjs/ghacks-user.js
[2] https://www.torproject.org/
More Firefox privacy extensions: https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.1-Exte...
I counter with https://github.com/ghacksuserjs/ghacks-user.js
In Firefox Privacy How-To GuideThis is an ok guide for people who don't know what to do, however I'd argue using ghacks userjs, and also disabling the built in content blocking and safebrowsing entirely is in order, along with disabling captive portal detection, and dns over https.
These all call back to google and/or mozilla, cloudflare.
https://github.com/ghacksuserjs/ghacks-user.js
In Firefox Privacy How-To Guide> For about:config, I put all my rules in a user.js file. Make that file in a synced folder (Dropbox, Nextcloud, Syncthing, etc.), go to your FF profile folder, and in there make a symlink to the actual synced user.js.
That's exactly what I did, except I just forked the ghacks-user.js user.js file with the changes I needed
I then made a desktop branch, and an android branch.
https://github.com/dngray/ghacks-user.js/tree/fx-desktop
https://github.com/dngray/ghacks-user.js/tree/fx-android
The main reason I'll never use Chrome is because on Android that means no extensions whatsoever, meaning I'd have to give up uBlock and uMatrix. It's also why I wouldn't buy an iPhone (Firefox on iOS isn't allowed to have extensions).
A user.js file can be deployed on Android https://github.com/ghacksuserjs/ghacks-user.js/wiki/1.6-Fire... (I use the non-ro
Read the rest
oted instructions).
On my desktop I have it hooked in with my bootstrap script. I use Yadm https://yadm.io/
#!/usr/bin/env bash
firefox() {
local -n branches=$1
local b p d="$XDG_CONFIG_HOME"/firefox/ghacks-user.js
for p in "${!branches[@]}"
do
b=${branches["$p"]}
printf 'Configuring "%s" on "%s"\n' "$p" "$b"
ln -sf "$XDG_CONFIG_HOME"/firefox/chrome/userChrome.css ~/.mozilla/firefox/"$p"/chrome/userChrome.css
git --git-dir="$d/.git" --work-tree="$d" checkout "$b" &&
cp "$d/user.js" ~/.mozilla/firefox/"$p"/user.js
done
}
The function takes in an array:
firefox_data_path="mozilla/firefox.json"
declare -A fx_profiles
while read -r profile; read -r branch; do
fx_profiles[$profile]=$branch
done < <(jq -r '.[] | .profile, .branch' "$template_data_path/$firefox_data_path")
firefox fx_profiles
Which simply reads in a bunch of profiles and what branch they are supposed to be from a json file:
[
{
"profile": "user.default",
"branch": "fx-desktop"
}
]
https://github.com/ghacksuserjs/ghacks-user.js
Plus remove all the http(s) references to mozilla and google servers in about:config in your user-overrides.js file...and then tweak everything to taste.
In How to stop Firefox from making automatic connectionsAlternatives that allow you to still get your security and stability updates from Mozilla include two Gnu soft-forks. There's IceCat, which is the best-supported version and runs off of ESR. [1] There's also "abrowser" (that's literally what it's called) that is part of the Gnu Trisquel distribution, which is based on the most recent release. Both patch the browser to be more security and privacy friendly. [2] There are also several projects that provide patches for Firefox or user.js files [3] to minimize the privacy impact of recent Mozilla decisions. (I publish patches that remove Pocket and disable various forms of tracking in Firefox.) The problem with the patch-based approach is that you have to build Firefox yourself, which most people are unable or unwilling to do.
[1] https://www.gnu.org/software/gnuzilla/
[2] https://trisquel.in
Read the rest
If you use uMatrix, you can easily block the localhost and local network "sniffing" with the following rule[0]:
* 127 * block ### block access to IPv4 localhost 127.x.x.x
* localhost * block
* [::1] * block ### block access to IPv6 localhost
* 192.168 * block ### block access to LAN 192.168.x.x
In principle, you can use this without any other blocking, i.e. with the rule:
* * * allow
and hence without disabling javascript on any sites.
[0] https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.2.3-uM...
Edit: as pointed out by DarkWiiPlayer below, if you want to be able to access the localhost websites from the same browser, you need:
localhost localhost * allow
and similarly for the LAN. In full:
127 127 * allow
localhost localhost * allow
[::1] [::1] * allow
192.168 192.16
Read the rest
8 * allow
> How could Mozilla respect the needs of users who opt-out of Mozilla knowing they, and their needs, exist at all?
How about surveys or well, common sense?
I'm a tech oriented person who cares about privacy. I want software that is lightweight, configurable, with sensible defaults. For any features besides the basic functionality (in this case: browsing the web), I don't want to opt-out, I want to opt-in.
Privacy oriented means for me that the software I use doesn't send one bit of data that isn't necessary for its basic functionality. I use a "dumb phone" because of this. I never understood how anybody can think telemetry and privacy can co-exist.
I want a Firefox without Pocket, Send, Screenshot Tools, Sync, Clickz, any cloud based service. I only want a fast, lightweight browser that doesn't send any unnecessary data anywhere without m
Read the rest
e explicitly configuring it. That's a sensible default for me, really. Software used to be like that.
I'd also like to configure when my software looks for updates. My Linux distro let's me do that.
And it would be awesome if all other functionality (like Send/Sync/Pocket, etc.) is available via optional plugins, or in another "full-featured" version of Firefox. The deluxe edition or whatever.
I believe I'm not alone with these ideas about software. In discussions about Firefox these things always come up. There are github projects [1,2] with 1600 and 1200 stars about hardening Firefox. People care about privacy. It's not hard to find this part of the userbase.
The idea that you can't create software for your users without telemetry, is what leads Mozilla to disregard their privacy oriented users in the first place. It's depressing.
And even if I allowed telemetry on my system Mozilla wouldn't learn anything about what I wrote here. It's useless.
1: https://github.com/pyllyukko/user.js/
2: https://github.com/ghacksuserjs/ghacks-user.js
With some effort, yes: https://github.com/ghacksuserjs/ghacks-user.js/wiki/1.6-Fire...
It doesn't work on iOS because Firefox on iOS isn't really Firefox but just a Safari webview with a bunch of extra features and a different logo.
In Configuring and hardening Firefox privacy, security and anti-fingerprintingConfiguring and hardening Firefox privacy, security and anti-fingerprinting
110 points · Open discussionI use a very similar list of addons. In addition I recommend:
> * CanvasBlocker https://addons.mozilla.org/en-US/firefox/addon/canvasblocker....
A lot of people recommend that, but you don't need it if you're using ghacks-user.js. The reason is because of privacy.resistFingerprinting.
> * Cookie AutoDelete https://addons.mozilla.org/en-US/firefox/addon/cookie-autode....
> and I block cookies by default using uMatrix.
I use CookieAutodelete on my mobile because unfortunately the container API isn't available on the Android version of Firefox.
The reason I don't use it on my desktop is because there are certain types of things that cannot be cleared.
> APIs do not exist to allow clearing IndexedDB, Service Workers cache, appCache, or cache by host. Clearing cookies & localStorage on their own, and leaving orphaned persistent data is a false
Read the rest
sense of privacy.
* https://github.com/Cookie-AutoDelete/Cookie-AutoDelete/wiki/...
* https://github.com/ghacksuserjs/ghacks-user.js/wiki/4.1-Exte...
> Edit: I also recently switched to NoHTTP instead of HTTPS-Everywhere. This way I have to explicitly allow any non-HTTPS connections.
I might have to check that out.
> Im actually glad that the author pointed out that once you log in somewhere that will track you, that connection is associated with you.
Exactly, and it's usually a cookie or some sort of persistent storage. I use a VPN, but I use it at the router level. https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a...
I know my ISP logs my metadata (by law), whereas I trust that my VPN provider does not.
Essentially VLAN2 all traffic is routed direct to my ISP, and VLAN3 all traffic is routed to VPN. My machine normally sits in VLAN3. I make sure not to log into anything social media related or tied to my real identity.
If I need to do banking, Facebook or something like that I'll use a device in VLAN2 (a separate computer).
All phones and devices like that are broadcasting information anyway so those are in VLAN2 as well, unless they ar
Read the rest
e devices with LineageOS and no Google Apps.
> A vpn is not a cure-all. It is only as private as you're willing to make it. If you want to pirate movies and chat on facebook at the same time, you're probably gonna have a bad time. What you do is absolutely a part of your advertising/tracking profile.
See in this scenario I would have a system in VLAN3 that I use for my downloading, and another computer in VLAN2 that is used for the facebooking. I use a hardened browser with https://github.com/ghacksuserjs/ghacks-user.js that hardens the browser and helps against fingerprinting.
I also use a number of addons, for various purposes
That requires hardening. Currently I use
* CleanURLs https://addons.mozilla.org/addon/clearurls/ (remove UTM and parameter tracking)
* CSS Exfil Protection https://addons.mozilla.org/addon/css-exfil-protection/
* Decentraleyes https://addons.mozilla.org/addon/decentraleyes/ (prevent tracking via CDN)
* Firefox Multi-Account Containers https://addons.mozilla.org/addon/multi-account-containers/ (used for sites to keep me logged in)
* HTTPS Everywhere https://addons.mozilla.org/addon/https-everywhere/
* Redirect AMP to HTML https://addons.mozilla.org/addon/amp2html/ (no to AMP)
* Temporary Containers https://addons.mozilla.org/addon/temporary-containers/ (Prevents tracking via ETags and other things like IndexDB)
* uBlock Origin https://addons.mozilla.org/addon/ublock-origin/ (block adverts)
* uMatrix https://addons.mozilla.org/firefox/addon/umatrix/ (block 1st party JavaScript)