Is Rambox secure or safe to use?
How Rambox 3 protects your apps and account, what is outside its control, and the simple habits that keep you safe.
Yes. Rambox is built on the same browser technology as Google Chrome and follows the same approach to security. This article explains what Rambox does to keep you safe, what depends on you or on the apps you add, and a few settings that add an extra layer of protection.
Built on Chromium, kept up to date
Rambox runs on Chromium, the engine behind Chrome, Edge and Brave. Each app you add works like a website in a browser, with Chromium's own security protections. See How does Rambox work? for the details.
Most security issues that affect Rambox are, in fact, issues in Chromium itself, and they affect every Chromium-based browser in the same way. Rambox ships new versions that include Chromium's fixes, which is why keeping Rambox updated matters. See How to check for updates.
TIP
If you see a banner saying your version will no longer be supported, update as soon as you can. Older versions stop receiving security fixes.
Your app passwords stay on your computer
When you sign in to an app inside Rambox (Gmail, Slack, WhatsApp…), that sign-in is saved only on your computer, the same way Chrome saves it. Rambox doesn't store your app passwords on its servers. What Rambox syncs to your account is your setup: workspaces, apps and their settings.
Signing in to Rambox happens in your browser
Rambox 3 doesn't ask for your Rambox password inside the app. When you sign in, your default browser opens the official Rambox sign-in page, and the browser then hands you back to the app. This way you can see the address of the page you're typing your password into, and you can use your browser's password manager or a Google, Microsoft or Facebook account. See Signing in to Rambox.
Extra protection you can turn on
- Lock Rambox with a Master Password or a YubiKey. Rambox then asks for it every time it starts, when you lock it with a shortcut, and after a period of inactivity if you choose. See How to set and remove your Master Password.
- Hide notification content. In an app's or workspace's settings, tick Hide notification content so pop-up notifications show "You have a new notification" instead of the message text. Useful if people can see your screen.
- Keep an eye on your devices. In the web console's Machines page you can see every computer signed in to your account, remove one, or Sign out of all devices. See Active sessions: how does it work?.
Features that are off unless you turn them on
- Remote Control (MCP) in Settings → Advanced lets an assistant program on your own computer control Rambox. It is off by default. When you turn it on, it only accepts connections from your own computer and requires a secret token, which you can regenerate at any time.
- Advanced app options (inject JavaScript or CSS, change the user agent, and similar) come with a warning in the app because code you paste there runs inside that app. Only use code you trust. See How to inject JavaScript and CSS code.
What is outside Rambox's control
- The apps you add are third-party services. Rambox shows them to you, but their security and privacy are governed by each service's own policies. Review them for the services you use.
- Malware on your computer. Software that reads browser cookies and saved sessions can affect Rambox just like it affects any browser. Keep your operating system and antivirus up to date, and be careful with what you install.
Always download Rambox from official sources
Download Rambox only from rambox.app or the official releases page on GitHub (github.com/ramboxapp/download). The Windows and macOS versions are signed by Rambox LLC, so your operating system can confirm they come from us.
Questions?
If you have a security question or want to report a vulnerability, write to support@rambox.app or open a support request.