NoScript

own YOUR browser!

Open main menu

Get it!

Latest stable

Direct download for Firefox

You can get the latest stable version for Firefox desktop only also using this direct NoScript 12.6 download link. To install, just drag and drop it onto your address bar.

Special thanks to Adithya Suresh Kumar for extensively reporting about a new browser fingerprinting risk, allowing NoScript 12.6 to deploy a mitigation technique for it.

v 12.6
============================================================
x Make contextual policies override restriction cascading
  (tor-browser#43397)
x [Chromium] Fix 12.5.9xx prompt closure regression
x [Chromium] Full x-load checks Chromium support
x Better offscreen placeholders for x-load
x [l10n] [Chromium] Make x-load capability localization
  Chromium-compatible
x [L10n] Updated de, fr, he, ru, tr zh_CN
x [UX] Honor non-contextual x-load capability granted from
  NoScript Options (thanks barbaz for RFE)
x Prevent data: URIs from messing with srcset parsing
  (thanks fatboy for reporting)
x Regard as "mutually safe" for x-load directories sharing a
  common ancestor
x [UX] Make x-load capability visible for CUSTOM file:
  entries in NoScript Options (thanks barbaz for RFE)
x [UX] Fixed prompt window leaks (tor-browser#43281)
x [UX] Make object unblocking temporary and contextual by
  default, with choices in the prompt
x [nscl] Option to clone Permissions without context
x Always honor the "Collapse blocked objects" option
x Refactor top-level auto-trust and make it contextual
  (issue #417)
x [nscl] Remove noisy debug statement
x [UX] UI support for extra floating capabilities (x-load)
x Integrate event handlers suppression with blocking if
  needed (thanks Adithya Suresh Kumar for reporting)
x [nscl] Refactor xray proxification
x Fix incorrect assumptions about some DOM element
  properties reflecting URLs (thanks Adithya Suresh Kumar
  for reporting)
x [nscl] Fix race condition between multiple extensions
  using MV3/DNR SyncMessage (JShelter#146, thanks polcak for
  reporting)
x Suppress some event handlers (tor-browser#43491, thanks
  Adithya Suresh Kumar for reporting)
x [build] Publish XPIs only after their signed
x [build] Improved version bump commit logic

Development build

NoScript development happens very fast to keep up with emerging web threats. If you're brave enough and you need a specific feature or fix not released yet, or you simply want to provide feedback before official release, you may want to try the latest release candidate.

RC for Firefox

Install NoScript 12.9.909 on Firefox Desktop by simply clicking here.

On Firefox for Android, unfortunately, a pre-release can only be downloaded (same link as above) and temporarily installed on Nightly by using the web-ext tool, which is only suitable for hardcore developers and contributors.

Non-store versions for Chromium

On Chromium based browsers you can download either:

In order to install next MV3 version until it reaches the Chrome Store, or the MV2 version if you're affected by some MV3-caused bug which could not have been fixed yet, you need to unzip the downloaded noscript-$VERSION-chrome.zip file and load its content as an unpacked extension in developer mode.

Please follow these steps:

  1. Open the Extension Management page by navigating to chrome://extensions. Alternatively, open this page by clicking on the Extensions menu button and selecting Manage Extensions at the bottom of the menu. Alternatively, open this page by clicking on the Chrome menu, hovering over More Tools then selecting Extensions
  2. Enable Developer Mode by clicking the toggle switch next to Developer mode.
  3. Unzip the zipped "noscript-12.9.909-chrome.zip" package to a directory of your choice.
  4. Click the [Load unpacked] button and select the extension directory you've unzipped the extension to (the one containing the "manifest.json" file)

You're done. Happy testing!

Recent development history

v 12.9.909
============================================================
x Disable tab-less support on Chromium

v 12.9.908
============================================================
x Fix options page bustage regression from issue #429

v 12.9.907
============================================================
x [UX] Permissions UI support for tab-less (e.g. sidebar)
  content (issue #429)

v 12.9.906
============================================================
x [Chromium] Prerendered frame support in context policies
  enforcing

v 12.9.905
============================================================
x Fixed webRequest header patching regression from
  contextual overrides (addresses issue #436)

v 12.9.904
============================================================
x Fix some automatic top-level TRUST bugs (issue #437)

v 12.9.903
============================================================
x Discard "zombie" prompts from the backlog
x Honor restrictions diablement for x-load checks
x [UX] Improved UX for file:// contextual permissions
  (issue#435)
x [nscl] Harmonize file:// URLs parsing and matching across
  Gecko and Chromium
x [XSS] Prevent false positives from the uptain.de
  e-commerce back-end
x More consistent contextual permission checks

v 12.9.902
============================================================
x Fixed click to play sometimes broken for file:/// URLs

v 12.9.901
============================================================
x Fixed automatic temporary permissions require reload
  (thanks scottg for reporting)

v 12.5.906
============================================================
x Make contextual policies override restriction cascading
  (tor-browser#43397)
x [Chromium] Fix 12.5.9xx prompt closure regression
x Full x-load checks Chromium support
x Better offscreen placeholders for x-load
x [l10n] Make x-load capability localization
  Chromium-compatible
x [L10n] Updated tr

v 12.5.905
============================================================
x [UX] Honor non-contextual x-load capability granted from
  NoScript Options (thanks barbaz for RFE)
x Prevent data: URIs from messing with srcset parsing
  (thanks fatboy for reporting)
x Regard as "mutually safe" for x-load directories sharing a
  common ancestor

v 12.5.904
============================================================
x [L10n] Updated de, fr, ru
x Make x-load capability visible for CUSTOM file: entries in
  NoScript Options (thanks barbaz for RFE)
x [UX] Fixed prompt window leaks (tor-browser#43281)
x [UX] Make object unblocking temporary and contextual by
  default, with choices in the prompt
x [nscl] Option to clone Permissions without context

v 12.5.903
============================================================
x Fixed infinite x-load blocking loops (thanks barbaz for
  reporting)
x Always honor the "Collapse blocked objects" option

v 12.5.902
============================================================
x Refactor top-level auto-trust and make it contextual
  (issue #417)
x [L10n] Updated zh_CN

v 12.5.901
============================================================
x Make the x-load capability localizable (tor-browser#43635)
x Earlier x-load interception  (thanks Adithya Suresh Kumar
  for reporting)

v 12.1.1.905
============================================================
x Improved x-load capability support (thanks Adithya Suresh
  Kumar for reporting)
x [nscl] Remove noisy debug statement

v 12.1.1.904
============================================================
x UI support for extra floating capabilities (x-load)
x Integrate event handlers suppression with blocking if
  needed (thanks Adithya Suresh Kumar for reporting)
x [nscl] Refactor xray proxification

v 12.1.1.903
============================================================
x Broader event handlers suppression (thanks Adithya Suresh
  Kumar for reporting)

v 12.1.1.902
============================================================
x Fix incorrect assumptions about some DOM element
  properties reflecting URLs (thanks Adithya Suresh Kumar
  for reporting)

v 12.1.1.901
============================================================
x [nscl] Fix race condition between multiple extensions
  using MV3/DNR SyncMessage (JShelter#146, thanks polcak for
  reporting)
x Suppress some event handlers (tor-browser#43491, thanks
  Adithya Suresh Kumar for reporting)
x [build] Publish XPIs only after their signed
x [nscl] Updated to latest NoScript Commons Library
x [L10n] Updated he
x [build] Improved version bump commit logic

v 12.1.0.901
============================================================
x Fix automatic reloading broken if the background script /
  service worker is not already initialized on UI load
x Re-enable signing logging

v 12.0.904
============================================================
x [nscl] Improved work-around for Youtube placeholder
  displacement (tor-browser#43296)
x [L10n] Updated pl

v 12.0.903
============================================================
x Avoid synchronous policy fetching if document is already
  complete (e.g. on extension updates)
x Remove more MV3-only entries from MV2 manifest
x Remove pre-release version check on signing

v 12.0.902
============================================================
x More informative debug logging
x Fixed misplaced update_url in development builds (thanks
  DJ-Leith for reporting)

v 12.0.901
============================================================
x Switch Firefox development build version format to *.9xx
  (like Chromium)
x Cross-browser and cross-manifest compatibility down to
  Gecko 115
x Improved cross-browser and cross-manifest development and
  build ergonomics
x Fixed RequestGuard on Firefox still using CSP.blocks() as
  an instance method
x Improved cross-browser and cross-manifest support
x Do not reload affected tabs before saving XSS user
  choices, if any

v 11.5.3rc2
============================================================
x [nscl] Several performance and reliability enhancements
  from NSCL
x [nscl] Updated to latest NoScript Commons Library
x Fixed offscreen placeholder container preventing user
  interaction on the left of placeholders
  (tor-browser#43282)
x Fix localization-related console spam when opening options
  panel (tor-browser#43269)

v 12.0.8
============================================================
x Filter out tabs with no accessible url from context
  matching routine
x [nscl] Remove RuleCondition.responseHeaders usage breaking
  Chromium older than 128 (e.g. Kiwi Browser, issue #398)

v 12.0.7
============================================================
x Boostrap from REQUIRED.js (created at build time by
  manifest.js)

v 12.0.6
============================================================
x [nscl] Better SyncMessage recovery from DNR/XHR
  interaction browser bugs
x More reliable implementation of DNR-based unrestricted
  tabs
x Make debugging DNR a bit easier
x Workaround for current tab on current window not always
  available to UI popup on Vivaldi

v 12.0.5
============================================================
x Fixed contextual policies MV3 implementation (issue #394).

v 12.0.4
============================================================
x [nscl] MV3 work-around for Permissions-Policy breaking
  SyncMessage

v 12.0.3
============================================================
x Improved startup behavior
x Do not retry failed synchronous policy retrievals if
  document is not loading
x Coalesce activity reports by origin
x More robust initialization sequence
x Fix DNRPolicy matching for entries including explicit
  protocol

v 12.0.2
============================================================
x Make "Temporarily set top-level sites to TRUSTED" work on
  Manifest V3 (issue #388)
x Fix UI reporting noise from requests of uninteresting
  types (e.g. images)
x Fixes naked domains with no HTTPS lock and explicit port
  numbers not correctly matched in mapped MV3 DNR rules
  (issue #387)

v 12.0.1
============================================================
x Restructure inclusion of file/ftp protocol-specific
  content scripts
x Fixed TabTies session (de)serialization bugs
x [nscl] Fixed media blocking regresssion affecting Youtube
  (issue #386)

v 12.0.0
============================================================
x [nscl] Switch all the Chromium usages of patchWindow() to
  the new Worlds API
x [nscl] Switch patchWorkers.js implementation from
  patchWindow.js to Worlds.js
x [nscl] Switch WebGLHook implementation from patchWindow.js
  to Worlds.js
x Optimized fall-back reporting for non-HTTP documents and
  included script type
x Remove uuid from DNR reporting CSP to prevent it from
  being abused for tracking
x Import versioning module just once
x Infrastructure to replace patchWindow.js with MAIN world
  content scripts
x MV3 compatibility
x DeclarativeNetRequest-backed policy enforcement
x Fixed theming race condition and other bugs
x Require explicit call to run tests
x fixup! Gecko strict compatibility versionining to prevent
  Chromium-only NoScript 12.x from being accidentally
  installed on Firefox
x Simplified Wakening
x Gecko strict compatibility versionining to prevent
  Chromium-only NoScript 12.x from being accidentally
  installed on Firefox

v 11.5.3rc1
============================================================
x Fixed offscreen placeholder container preventing user
  interaction on the left of placeholders
  (tor-browser#43282)
x Fix localization-related console spam when opening options
  panel (tor-browser#43269)

v 11.5.2rc1
============================================================
x [tor-browser#43257] More efficient, flexible and
  race-resistant placeholder styling

v 11.5.1rc4
============================================================
x [tor-browser#43258] Fixed LifeCycle error on update

v 11.5.1rc3
============================================================
x [nscl] Panic abort on buggy pages (like
  https://github.com/) going in infinite loops when webgl is
  disabled
x Refactoring to use DocRewriter

v 11.5.1rc2
============================================================
x [tor-browser#43258] Remove content script crypto.subtle
  dependency
x Synchronize Sites.onionSecure on any settings update

v 11.5.1rc1
============================================================
x [tor-browser#32668] More reliable Security Level Reset on
  Tor / Mullvad Browser

v 11.5.0rc1
============================================================
x [tor-browser#32668] Use the Security Level as the default
  policy for Options Reset on Tor Browser
x [tor] Stateless-compatible Tor Browser integration
x [L10n] Updated pt_BR
x Stateless-compatible temporary permissions
x Switch from deferWebTraffic to Wakening
x Stateless-compatibile TabGuard
x Switch to non-persistent background page
x [xss] Refactor for non-persistence
x Removed Fennec-specific code
x Bump min Gecko compatibility to 115.0 (stateless
  background script support)

Browser compatibility and obsolete versions

NoScript 12.6 is compatible with browsers based on Gecko versions 115 and above (e.g. Firefox and Tor Browser, on desktop and Android) and on Chromium versions 128 and above (Chrome, Edge, Vivaldi, Brave...)

NoScript 11.4.44rc2 is compatible with Gecko versions 59-114.

NoScript Classic Logo

You can still download NoScript "Classic" (5.1.9) (SHA256) for Seamonkey, Palemoon, Waterfox Classic and possibly other "vintage" (pre-Gecko 57) Firefox forks here.

Notice: you may need to open about:config and set your xpinstall.signatures.required preference to false in order to install NoScript 5.x, since Mozilla doesn't support signatures for legacy add-ons anymore. If you're using a non ESR Firefox, you may also need this hack.

Users of Firefox 58 and below are urged to upgrade their very unsafe browser. For those few who can't,

Disclaimer

We cannot update nor support NoScript 5.x and below anymore, because it was based on a completely different and now obsolete technology. However you can still find usage information and a FAQ section for those ancient versions in the NoScript Classic archived website.