Chrome vs Safari Security Showdown: Which One Keeps You Safe in 2024?

Let’s be honest, it doesn’t matter which browser you choose, pretty much all of them collect your data and leave your online security at risk in one way or another. Some are worse than others, though. Safari is known for its data-hungry tactics, which have even led to lawsuits for violating consumer privacy rights. Then again, is Chrome better? Its data collection practices are questionable at best, which could be risky for your online security.

Both browsers have their advantages, including some attractive security features. But you have to wonder whether they’re worth it, given the risks to your security and online data trail. They might claim to put online tracking to rest, but sometimes the browsers are the worst culprits for it. So, just how secure are these two browsers? Is there a clear winner for your online security? Let’s compare the two browser giants to find out.

Chrome vs. Safari: Security Feature Comparison

Before we dig into how the security features for each browser work, let’s quickly compare what’s on offer with Chrome and Safari.

	Chrome	Safari
HTTPS mode	✅ Pre-installed, not enabled by default	✅ Only as an extension from the App store
DNS over HTTPs	✅ Encrypts DNS requests through Google’s public DNS	⛔ Not available as standard
Anti-malware technology	✅ Offers three levels of anti-malware technology, plus sandboxing	✅ Offers protection against fraudulent websites and on-site malware
Third-party tracking blocker	✅ Do Not Track feature limits tracking, plus option to block cookies	✅ Intelligent Tracking Protection blocks trackers and cookies, plus first-party trackers are limited to data storage of 7 days
Social widget blocker	⛔ Not available as standard	✅ Blocks on-site social widget trackers to limit data capture
Digital fingerprint minimizer	⛔ Not available as standard	✅ Uses digital fingerprinting minimization to prevent activity being traced to your device
Private browsing	✅ Incognito Mode available in new windows to help anonymize searches and history	✅ Private Browsing Mode and Smart Search to limit data logging, plus option to set DuckDuckGo as search engine
Password manager	✅ Built-in password manager with option for on-device encryption	✅ Built-in password manager with passwords stored in iCloud and PassKeys for additional security
Password warnings	✅ Warns you of potential password leaks and weak passwords	✅ Warns you of potential password leaks and checks for variations of your passwords against lists of known leaks
Security updates	✅ Security updates every 2–3 weeks as minimum	✅ Yes, but unclear how often
Security extensions	✅ Huge list of available security extensions	✅ Yes, but limited, Apple-approved list of security extensions

Chrome vs. Safari Security

1. HTTPS Mode

HTTPS-only mode forces secure connections on sites by using HTTPS encryption, which masks your data. It’s especially important when you’re accessing sensitive information, such as your online bank accounts. Most websites already use HTTPs, but it’s always worth having extra protection just in case you need it.

Chrome has HTTPS-First Mode, but it’s not pre-set to force websites to use secure connections. You can easily switch it on though. HTTPs-First Mode will also display a warning sign when loading websites that don’t support HTTPs so you can decide whether to proceed.

With Chrome, you also get DNS over HTTPs via Advanced Protection mode, which is pre-enabled. This encrypts your DNS requests when using Google’s public DNS, limiting the amount of information snoopers can see. It also stops cybercriminals from rerouting your DNS requests elsewhere, such as re-directing you to an HTTP or vulnerable site that could install malware on your device.

By comparison, Safari doesn’t have HTTPs-only mode. It can switch sites from HTTP to HTTPs, but you’ll need to install the HTTPS Only for Safari app from the App Store. The extension is easy to set up and provides the level of HTTPs encryption you need, but we’d expect this to be a primary built-in feature.

2. Anti-Malware Technology

Anti-malware technology prevents you from accessing untrustworthy sites that might steal your important information, such as passwords or bank details. Thankfully both Chrome and Safari offer anti-malware technology.

Chrome offers three levels of anti-malware protection: no protection, standard, or enhanced. Standard is enabled by default, protecting you from dangerous websites, downloads, and extensions. It cross-checks URLs with listed unsafe sites to determine if they’re safe. It also alerts you of suspicious activity while you’re on a website through a handy pop-up. Some might say annoying, others would say it’s worth it for your privacy. We agree with the latter. 

You can switch on Enhanced Protection, which lets you help Google with protecting other web users. It sends data about URLs, downloads, and extensions in your browser to help detect new threats. This seems a little contradictory in our eyes. For more protection, you’ll need to share more data with Google (like it needs any more). 

Chrome also uses a feature called sandboxing, which isolates websites if it detects suspicious activity. This stops downloads or harmful links from further damaging your device. Effectively, it locks the threat in a box so it can’t go anywhere else. You can then close the browser to remove the threat and reopen a new window to continue as before. This is enabled by default.

By comparison, Safari’s Fraudulent Website Warning alerts you if you attempt to visit a suspicious website. It can detect phishing and scam attempts before you open a webpage to shield you from vulnerabilities before they happen. It’s already built-in to the browser but it’s not switched on by default, which is a little disappointing.

3. Security Updates

According to The Hacker News, Chrome reported 8 zero-day exploits in 2023, which is worrying, to say the least. The last of these zero-day vulnerabilities enabled cybercriminals to run code outside of Chrome’s sandbox feature, leaving users at risk of malware and unauthorized device access. Chrome releases new updates with security and bug fixes every 2-3 weeks, though perhaps that’s not often enough, especially given the data. 

Apple doesn’t disclose how often it runs security updates for Safari, which raises some questions about transparency and what’s happening behind the scenes. It does mention a Rapid Security Response to patch major security vulnerabilities as soon as possible. Looking back at 2023 data, Apple released over 100 security patches across multiple devices, though it’s not clear which of these were specifically related to Safari. Nor do we know how many of these were zero-day exploits. We have questions unanswered here.

4. Tracking Protection

Tracking protection is something both browsers do well at. Well, Chrome is getting there. It offers a Do Not Track feature that lets you send a request to sites not to track you or collect your browsing data. This helps reduce the amount of data websites can gather about you, but pay attention to the word ‘request.’ Websites receive a request from you to not log or track your data, but how they respond to that request is up to them. It doesn’t force them to stop tracking you, so they can still serve you relevant ads and monitor your activity. 

On the plus side, you can choose to block third-party cookies entirely, only block them in Incognito mode, or allow them. The default setting is to block cookies in Incognito mode, so you’ll need to change your settings if you want these turned off completely. This will restrict how websites track you, stopping them from following you around the web where they can serve you ads on other sites. 

In early 2024, Chrome announced it’s rolling out a new Tracking Protection feature to phase out third-party cookies. This means third-party cookies will be restricted by default, rather than you having to select this feature yourself. We’re yet to hear the results of their first rollout, so we’ll have to wait and see. 

Now what about Safari? Safari’s Intelligent Tracking Prevention (ITP) feature works to block third-party and cross-site tracking by default, hiding your IP address from trackers. It also restricts the storage of first-party cookies from JavaScript to 7 days, significantly limiting how much information is stored about you online. You can access your Privacy Report via Safari to see which trackers the ITP has blocked, which is a huge positive for transparency.

Safari also takes things one step further with social widget tracking prevention. This feature prevents social widget-like share buttons and comment fields from logging your data without your permission. Then there’s the Fingerprinting Defense functionality, which shows websites a simplified version of device characteristics to make it hard to distinguish when it’s you or someone else. This makes it tough to digitally profile you or link activity back to you.

5. Password Management

Let’s start with Safari. The WebKit-based browser uses PassKeys, which are designed to replace passwords and provide you with a safer sign-in method. Unlike passwords, PassKeys aren’t stored on web browsers, so there’s much less risk of someone getting access to your credentials. You get a new PassKey for each website, so even if someone could see your login information, they couldn’t break through any other accounts. 

For any regular logins, Safari lets you save these to the iCloud Keychain, which is protected by encryption and your device passcode. It also suggests strong passwords when setting up new logins, helping to protect you from cybercriminals who could easily guess them. It then runs regular checks to see if any of these passwords have been leaked, checking variations of your logins against lists of breached passwords. It will notify you if it detects any leaked passwords.

Like Safari, Chrome lets you save passwords to your account. Your list of saved passwords is locked by your Google login information. Safety Check runs in the background to check passwords and will alert you if they’ve been compromised. It also highlights weak passwords and encourages you to change them. 

You can set up on-device encryption with Chrome for extra security. This encrypts passwords before they’re saved to your Google account. To access these logins, you’ll need two-factor authentication. Annoyingly, this feature is somewhat hidden within your Chrome security settings, so it’s not the easiest thing to find. 

6. Private Browsing

Both Safari and Chrome offer private browsing. Safari’s Private Search option stops the browser from logging your search history, queries, or information from forms you fill in.. It also stops trackers, both on pages and in URLs. Any private browser window you use is locked so that others near you can’t snoop on your search if you’ve left your device unattended. You’ll need your device passcode to reopen the window.

Safari also has Smart Search which lets you type website names, web addresses, and search queries within the same search bar. This limits the amount of data third-party search engines can collect about you, including cookies, precise location, and browsing history. 

For even more security, you can opt to set DuckDuckGo as your default search engine to browse with increased encryption and stop more trackers, including those in emails. Chrome also offers this functionality, but you’ll need to install the DuckDuckGo extension rather than Safari’s one-click method. 

As part of an iCloud+ subscription, you can upgrade your private browsing to include Apple’s Private Relay. This sends your DNS requests through different relays, masking your IP address and internet traffic. Only your network provider can see your IP address at the first relay, but they can’t see your DNS requests, so they have no idea what site you’re looking at. The second relay gives you a temporary IP address to disguise your real location from trackers and third parties. 

It works similarly to a VPN, but it only encrypts your in-browser traffic, not all device activity. It’s also worth mentioning that the second relay is monitored by a third-party content provider, so there’s always the risk your traffic could be tampered with or intercepted if a cybercriminal exploits a vulnerability at this relay. 

Chrome’s Incognito Mode offers private browsing by blocking search query logs, cookies, and other site-tracking information. To use it, you simply click on New Incognito Window from your Chrome settings. Anything you do in this window stays private and isn’t linked to your Chrome browsing history. As soon as you close the window, Google wipes all session data, including cookies. 

Google’s Incognito Mode hasn’t always lived up to expectations though. Towards the end of 2023, Google faced a lawsuit for tracking users’ activity even while they were in Incognito Mode. It then changed wording about its private browsing feature to explain that sites can still track you in Incognito Mode, they just can’t link activity back to your other Chrome history. The private browser also doesn’t stop ISPs, your employer, or school network operators from seeing your activity. For that, you’d need a VPN.

A VPN wraps your traffic in encrypted code and sends all of your traffic through a VPN tunnel to hide your activities. This means anyone watching can’t see what you’re doing, whether that’s your employer or a cybercriminal, even if they’re on the same network.  It also switches your IP address with another, preventing trackers from tracing activity back to your device. You can try PIA VPN to mask your browser habits and IP address, keeping your online activity away from watchful eyes.

7. Security Extensions

Chrome offers an almost infinite number of extensions to boost your browser security. Some of the most popular extensions include AdBlock Plus, HTTPS Everywhere, LastPass, PrivacyBadger, and Click&Clean. 

Most of Chrome’s security extensions are based on blocking ads, banners, pop-ups, cookies, and trackers to limit the amount of data third parties can gather about you. The Click&Clean extension also lets you wipe browsing history, saved passwords, and cache, to limit your online data sharing and prevent data leaks or breaches.

Safari isn’t so lenient with extensions. Apple is incredibly strict about which extensions you can use, so you can only select from a carefully curated collection of security extensions through the App Store. Some of the permitted extensions include AdGuard, Lulu, and StopTheMadness. Like Chrome, these extensions help you block ads and also protect you from spyware. 

Which Is More Secure, Chrome or Safari?

Both browsers have their strengths and weaknesses. And both of them shine through over the other for certain aspects. When it comes down to your security, Safari is probably your best bet. 

Chrome offers greater functionality for security extensions, it employs HTTPs-First Mode, and it scans for potentially fraudulent websites to stop you from getting caught by cybercriminals. But Safari’s security measures are superior. Apple takes the precautions you need to keep your passwords and logins secure, protect you from risky ads and trackers, and even lets you use DuckDuckGo as your search engine for an extra layer of security. 

The Final Verdict: Chrome vs. Safari

Safari might trump Chrome for security, but neither browser is 100% secure. Nothing online ever is. Even with Safari’s security features, third parties can still see your IP address, snoop on your browsing history, and potentially steal your data. To take your security to the next level, you need a VPN.

A VPN encrypts your traffic and switches your IP address, concealing your location and online activity from anyone watching. ISPs, government officials, data-hungry websites, and cybercriminals can’t look at what you’re doing online. It won’t make you 100% anonymous (that’s impossible!), but it will shield your online history and keep your browser activities more private. 

You can download Private Internet Access to encrypt your activity and keep yourself safe while browsing. Whether it’s a private email, your online banking, or just a day’s worth of online shopping history, PIA keeps your data safely locked away from snoopers.

Get PIA VPN

FAQ