I adapted a user.js template [1] that hardens Firefox by disabling a lot of features, including disabling Mozilla products like Pocket.
By default it is very strict though, so you will probably want to go through the config setting by setting and relax it a bit. Like enabling Webassembly and the search engine integration of the URL bar.
Most settings have inline comments explaining what they do and why they are chosen.
[1] https://github.com/pyllyukko/user.js
In Tor Browser 10pyllyukko
user.js
JavaScript2015–2025
pyllyukko / user.js
user.js
user.js -- Firefox configuration hardening
32Distinct people
39Mentions
1Explicit recommenders
2.9KGitHub stars
What to know before exploring
What it is
user.js -- Firefox configuration hardening
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
Mozilla is going on the completely opposite direction of what their supporters (and previous contributors) want them to go. Yes, they provide mobile browsers, plus a browser…
sdlkfgj used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- arkenfox/user.js · linked in 3 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 10:02:05 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year39 dated mentions
Observed mentions: 2015-01-27 15:44:18 UTC to 2025-09-02 18:35:17 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 14 | 2 | 12 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 5 | 0 | 5 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 1 | 0 | 1 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
user.js
Firefox configuration hardening
A user.js configuration file for Mozilla Firefox designed to harden browser settings and make it more secure.
This is a default template with every possible hardening measure enforced. See the relaxed branch for a variant providing more usability
Main goals
Limit the possibilities to track the user through web analytics.
Harden the browser against known data disclosure or code execution vulnerabilities.
Limit the browser from storing anything even remotely sensitive persistently.
Make sure the browser doesn't reveal too much information to shoulder surfers.
Harden the browser's encryption (cipher suites, protocols).
Limit possibilities to uniquely identify the browser/device using browser fingerprinting.
Hopefully limit the attack surface by disabling various features.
Still be usable in daily use.
How to achieve this?
There are several parts to all this and they are:
Downloading and installing the user.js file.
Reading about and applying further hardening techniques.
Optional: Modifying user.js to adapt it to your web browser usage.
Download
Installation
What does it do?
Further hardening
Known problems and limitations
FAQ
Contributing
Online tests
References
Maintenance
Download
Different download methods are available:
Clone using git: git clone https://github.com/pyllyukko/user.js
Download and extract the ZIP file containing the latest version.
Download the latest user.js directly
Installation
Backups
Do note that these settings alter your browser behaviour quite a bit, so it is recommended to either create a completely new profile for Firefox or backup your existing profile directory before putting the user.js file in place.
To enable the Profile Manager, run Firefox with command-line arguments: firefox --no-remote -P
Single profile installation
Copy user.js in your current user profile directory, or (recommended) to a fresh, newly created Firefox profile directory.
The file should be located at:
OS
Path
Windows 7
%APPDATA%\Mozilla\Firefox\Profiles\XXXXXXXX.your_profile_name\user.js
Linux
~/.mozilla/firefox/XXXXXXXX.your_profile_name/user.js
OS X
~/Library/Application Support/Firefox/Profiles/XXXXXXXX.your_profile_name
Android
/data/data/org.mozilla.firefox/files/mozilla/XXXXXXXX.your_profile_name and see issue #14
Sailfish OS + Alien Dalvik
/opt/alien/data/data/org.mozilla.firefox/files/mozilla/XXXXXXXX.your_profile_name
Windows (portable)
[firefox directory]\Data\profile\
With this installation method, if you change any of user.js settings through about:config or Firefox preferences dialogs, they will be reset to the user.js defined values after you restart Firefox. This makes sure they're always back to secure defaults when starting the browser. However this prevents persistently changing settings you don't consider appropriate. Either edit user.js directly, or use the system-wide installation method described below.
System-wide installation (all platforms)
Generate a file suitable for system-wide installation, by running make with one of the following targets:
systemwide_user.js: (the value will be used as default value for all Firefox Profiles where it is not explicitly set, it can be changed in about:config and is kept across browser sessions)
locked_user.js: (the value will be used as default value on Firefox profile creation, will be locked and can't be changed) in user.js or in Firefox's about:config or settings.
debian_locked.js: Debian specific. Users are not able to override preferences. See #415.
Copy the produced file to the Firefox installation directory. The file should be located at:
OS
Path
Windows
C:\Program Files (x86)\Mozilla Firefox\mozilla.cfg
Linux
/etc/firefox/syspref.js, for older versions: /etc/firefox/firefox.js
Linux (Debian)
/etc/firefox-esr/firefox-esr.js
Linux (Gentoo, Archlinux)
/usr/lib/firefox/mozilla.cfg, might also be /usr/lib32/ or /usr/lib64/
OS X
/Applications/Firefox.app/Contents/Resources/mozilla.cfg
Additional installation steps for Windows / OS X / Gentoo / Archlinux
Create local-settings.js in Firefox installation directory, with the following contents:
pref("general.config.obscure_value", 0);
pref("general.config.filename", "mozilla.cfg");
This file should be located at:
OS
Path
Windows
C:\Program Files (x86)\Mozilla Firefox\defaults\pref\
OS X
/Applications/Firefox.app/Contents/Resources/defaults/pref
Linux (Gentoo, Archlinux)
/usr/lib/firefox/defaults/pref/, might also be /usr/lib32/ or /usr/lib64/
If mozilla.cfg still fails to load, you must add a blank comment to the top of mozilla.cfg like so:
//
Additional settings (policies)
Not all Firefox settings can be changed through user.js - some must be set in a separate policies.json file [1]. These policies apply system-wide.
To install policies.json from this repository, simply copy it to the appropriate directory (create it if it does not exist):
OS
Path
Windows
C:\Program Files (x86)\Mozilla Firefox\distribution\
OS X
/Applications/Firefox.app/distribution\
Linux (Debian)
/etc/firefox-esr/policies/
Note that JSON does not support comments, hence settings are documented in custom *_comment keys. Mozilla maintains a list of available policies: [1] [2](https://github.com/mozilla/policy-templates). The Enterprise Policy Generator add-on can be used to generate policies.json files from a graphical interface.
Updating using git
For any of the above methods, you can keep your browser's user.js with the latest version available here: Clone the repository, and create a symbolic link from the appropriate location to the user.js file in the repository. Just run git pull in the repository when you want to update, then restart Firefox:
cd ~/.mozilla/firefox
git clone 'https://github.com/pyllyukko/user.js.git'
cd XXXXXXXX.your_profile_name
ln -s ${HOME}/.mozilla/firefox/user.js/user.js user.js
Verifying
Verify that the settings are effective from about:support (check the "Import
Read the full README on GitHubWhat Hacker News says
5 sourcesI use next script. It creates temporarily dir for firefox, uses it as a profile dir and remove after firefox closed.
#!/bin/sh -e
DIR="${XDG_CACHE_HOME:-$HOME/.cache}"
mkdir -p -- "$DIR"
TEMP="$(mktemp -d -- "$DIR/firefox-XXXXXX")"
trap "rm -rf -- '$TEMP'" INT TERM EXIT
wget 'https://raw.githubusercontent.com/pyllyukko/user.js/master/user.js' -O "$TEMP/user.js"
firefox -profile "$TEMP" -no-remote "$@"
It also uses very hardened options from https://github.com/pyllyukko/user.js
It is not my invention, but I lost a link to blog post
In Ask HN: How do you set up a virtual browserThis is definitely something that should be fixed by the vendor, but as a (Firefox) user if you want a quick fix you can use https://github.com/pyllyukko/user.js
In Web browsers need to stop. Enough is enoughMozilla is going on the completely opposite direction of what their supporters (and previous contributors) want them to go.
Yes, they provide mobile browsers, plus a browser with "private mode" (focus) and now this. But on every single one of them, you have the same philosophy of Google Chrome (tm) adopted, of treating the user as a dumb gullible person that should not have access to important settings.
Why would they waste so much effort, and clone all the things people should avoid from Google Chrome?!
For example, any new tech introduced that can be used for browser fingerprinting and user tracking (e.g. canvas, webgl, webrtc, etc) is enabled to every single site by default, just like chrome.
Some you can install extensions (you can't on this and on mozilla focus), some you can fiddle with user-UNfriendly settings in about:config (desk
Read the rest
top and full featured android, not focus or this) where you have to guess setting names and cryptic values (what does 2 means in a setting named somethingEnabled?!)
Only on mozilla desktop you can standardize sane settings by importing a user.js file from the dozen of crowdsourced efforts (i recommend the most complete one from https://github.com/pyllyukko/user.js/ ). think about this, there's more then a dozen community led effort to provide sane defaults, not hardcore user optimized settings, sane defaults, for a project that should be open source and the users could have been able to send in patches to have sane defaults in the first place! now, why would those sane defaults everyone want would be denied in the main branch? because mozilla do not represent the users for a long time!
Mozilla is now a corporation that looks for Advertisement companies grants.
A quick reminder how to maintain your privacy while using Firefox (Windows pathnames):
1. Install Firefox with Internet disconnected. Do not install the Maintenance Service. Run once and then close it completely (Ctrl-Shift-Esc to check no processes are running).
2. Create and edit the file:
"%APPDATA%\Roaming\Mozilla\Firefox\Profiles\*.default\user.js"
Use the following as a template:
https://github.com/pyllyukko/user.js/blob/master/user.js
Best to read through the whole contents and edit it by hand as some of the settings might be too restrictive (there's a "relaxed" version too in another repository by the same author).
3. Create and edit the file:
"%ProgramFiles%\Mozilla Firefox\distribution\policies.json"
With the following contents:
{
"policies": {
"DisableAppUpdate": true
}
}
Note: This file and directory a
Read the rest
re being deleted every time you update Firefox, so be prepared to re-create them afterwards. Alternatively, it might also work to revoke the write permission to that directory but this could break the whole update process (I have yet to test it).
4. Update Firefox manually whenever a new version is released but wait for a while first, so that all the new anti-features such as this one come to light.