The details

Everything the front page leaves out: how the governor decides, what Raha does and does not send, the security audit, and the keyboard map.

The governor

The heart of Raha is ~150 lines of pure, exhaustively-tested policy (src/shared/policy.js). In precedence order:

Per-tab memory limit — a tab over its own limit goes to sleep, even a pinned one (you asked for that limit). The active tab is never yanked — you get a warning instead.
Idle timer (off by default) — background tabs idle longer than N minutes go to sleep.
Live-tab cap — beyond the cap, the least-recently-used background tab sleeps first. Pinned, audible, and active tabs are protected.
Global memory budget (off by default) — if running tabs together exceed your budget, LRU eviction until they fit.

Sleeping is real: the renderer process is destroyed and the RAM goes back to your OS (why) — not merely throttled or hidden. Navigation history survives; back and forward work after waking.

Organization is spatial

Nested folders, thumbnail grids, drag & drop. A restart brings your whole tree back asleep: instant start, ~0 tab memory, nothing lost.

Private by architecture

Telemetry, phone-home: No telemetry, ever. Raha itself contacts exactly one server: GitHub Releases, for the optional security-update check — on by default, one toggle to silence it. Note the chrome also loads favicons directly from the sites in your tab list, including on a cold start with every tab asleep.
Tracker / ad blocking: EasyList + EasyPrivacy via Ghostery’s open-source engine — lists bundled with the app, never fetched at runtime. Separate ads/trackers toggles, per-site off switch on the address-bar shield.
Global Privacy Control: Sec-GPC: 1 + DNT: 1 on every request made by a page (toggleable).
Permission requests: Camera, microphone, location, notifications, clipboard: asked per site in Raha’s own prompt — allow once / always / never — never granted silently, never a surprise system dialog. Everything else a page asks for is refused, visibly.
Default search: DuckDuckGo (Brave / Startpage / Ecosia / Google / Bing / Kagi selectable; Kagi needs your own Kagi account).
New tab page: Local. Loads nothing.
HTTPS: HTTPS-first for typed addresses; explicit opt-in for plain-HTTP fallback.
Web content isolation: Chromium sandbox on; no preload, no bridge in page processes.
What a page may open: Only http: / https: / raha: / blob: — a site cannot make Raha open file:///… or a fake data: login page in your chrome.
Supply chain: Two direct runtime dependencies — the updater and the filter-list engine, both pinned exact, each with a public decision record. With transitives, 28 npm packages ship inside the app alongside Electron — verify with npm ls --omit=dev --all. Everything else is the project’s own code, and the invariants are enforced by tests.

Raha is Chromium under the hood (Electron, ~100 MB installed). “Light” means runtime discipline, not installer size. Fingerprinting resistance is on the roadmap, not claimed yet.

Raha settings: the governor’s knobs (live-tab cap, memory budget, idle timer) and the privacy toggles — Every knob explained where it lives — the governor and the privacy toggles are the whole settings surface.

Security, with receipts

Pre-release security audit against Electron’s checklist: eight findings, all fixed, report public, with the accepted risks. Every audit check re-runs as a test on every push.

Keyboard

Ctrl/⌘ T new tab · Ctrl/⌘ W close · Ctrl/⌘ ⇧ T reopen closed tab · Ctrl/⌘ F find in page · Ctrl/⌘ L address bar · Ctrl/⌘ ⇧ R hard reload · Ctrl/⌘ E grid/home · Ctrl/⌘ ⇧ B sidebar · ⌘ Y/Ctrl H history · Ctrl Tab cycle running tabs · Ctrl/⌘ 1…9 jump to running tab · Ctrl/⌘ ⇧ S sleep this tab · Ctrl/⌘ ⇧ A sleep everything · Ctrl/⌘ ⇧ K pin · Ctrl/⌘ , settings

The “unidentified developer” warnings

Raha’s installers are not code-signed, so the first open needs one extra step: macOS says “Apple cannot check it for malicious software” — right-click the app → Open → Open, once. Windows SmartScreen says “Windows protected your PC” — More info → Run anyway, once. The build is open source and reproducible from the repository.

Signing needs paid developer programs: Apple’s is US$99 a year, and Windows certificates cost separately. This free project has no budget for them. When a year’s donations reach a developer fee (right now US$99 for Apple), it is spent on that fee and that warning goes away.

Donations so far: US$0 · updated by hand now and then, last on 2026-09-16 · Venmo.

Support

Raha is free, GPL, one person, and a public roadmap. Bugs and ideas: GitHub issues or basareh@duck.com. Want to build? Start at CONTRIBUTING.md.

Security reports: private reporting or email with a [raha security] subject (SECURITY.md).

Raha was written with agentic coding: an AI did much of the typing, a human decided what to build and ran it.

← Back to the front page