3Eyes / Blog
2026-08-30 · Dan Clark

Which Browsers Bypass Parental Controls (And How to Block Them)

Short answer: four kinds of browser defeat most parental controls. Browsers with a built-in VPN or proxy (Opera, Opera GX, Brave's Tor windows). Tor Browser itself. Portable builds run from a USB stick or the Downloads folder without installing. And any browser a child can install into their own user folder without an administrator password.

If you have blocked sites in Chrome and your child is still getting through, this is almost always why. Not a clever hack — a second browser.

The rest of this guide covers exactly how each one gets past a filter, which defences actually hold, and the situations where nothing on this page will help. That last part matters, so it is not buried at the bottom.

Why blocking at the browser level fails structurally

A parental control that works inside a browser is playing a game it cannot win. Chrome extensions, Edge's Family Safety filtering, Safari's Screen Time restrictions — each of these hooks into one specific browser, and each is defeated by the same move: install a different one.

This is not a bug in those products. It is what "browser-level" means. Microsoft Family Safety's web filtering only enforces in Edge, so Microsoft's answer is to block every other browser from launching. That is a reasonable patch, and it is also an admission: the filter itself has no idea what Chrome is doing, so the only option is to stop Chrome existing.

The consequence for you as a parent is a rule of thumb worth memorising. If a control can be described as "it blocks sites in [browser name]", assume a determined child will beat it in under ten minutes. The fix is not a better browser extension. It is moving the control to a layer the browser cannot opt out of — the network, DNS, or the operating system's ability to run new programs at all. We cover the wider pattern in how parental controls get bypassed.

Brave: Tor windows built into the browser

Brave is a well-built, privacy-focused Chromium browser, and for most purposes it behaves like Chrome. The feature that matters here is "New private window with Tor", available from Brave's main menu on desktop with two clicks and no setup.

A Tor window routes the page request through the Tor network before it reaches the site. From your filter's point of view, your child is connecting to an anonymous relay, not to the site they are actually visiting. Domain blocklists, router URL filters and DNS filters all see a destination they have no reason to block. The site loads.

Two things temper this. Tor windows in Brave are noticeably slow, and many large sites — including a lot of video — either break or throw a CAPTCHA wall, so it is a poor route to YouTube and a good route to a text-heavy site somebody told them about. And Brave's Tor mode is a browser feature, so removing Brave removes it.

What stops it: preventing Brave from being installed in the first place (a standard, non-admin account does this on Windows), or filtering at a layer that fails closed on unknown destinations rather than checking a blocklist.

Opera and Opera GX: a free VPN in the settings menu

Opera and its gaming-branded sibling Opera GX ship with a free built-in VPN — technically a proxy for browser traffic rather than a full system VPN, but the practical effect is identical for a parent. It is enabled with a toggle in Settings, requires no account, no payment and no separate install, and it is heavily advertised inside the browser itself.

Opera GX is the one to watch. It is marketed directly at teenage gamers, with Discord and Twitch integrations and a following on gaming YouTube, so plenty of children install it for reasons that have nothing to do with getting around you and then discover the VPN toggle afterwards.

Once it is on, every request from that browser leaves your network encrypted and addressed to Opera's proxy. A router block, a hosts file entry and a DNS filter all become irrelevant for anything opened in that window. Other applications on the machine are unaffected, which is why a parent watching the router logs sees normal traffic from the PC and concludes the block is working.

What stops it: the same two things — no unapproved installs, and network filtering that blocks the proxy endpoints themselves. Our guide on whether a VPN can bypass parental controls goes into the detection side in more depth.

Tor Browser: the one that beats domain blocking outright

Tor Browser is the full version of what Brave offers as a side feature. It is free, it is a single download from torproject.org, and on Windows it can be extracted and run from a folder in the user's own profile — no administrator password, no entry in Add/Remove Programs, no Start menu shortcut unless one is created.

Against a domain or DNS blocklist, Tor Browser is close to a total bypass. Your filter never learns which site was requested, because the request is encrypted and relayed. Against category-based filters it is the same story.

What it is bad at: speed, video, and anything requiring a login. Tor exit nodes get CAPTCHA-walled constantly. So Tor Browser is rarely the tool for a child who wants to watch YouTube all evening, and much more often the tool for reaching one specific blocked site.

What stops it: blocking the executable from running at all (application allowlisting, or a control that only permits approved programs), or blocking access to known Tor entry points at the network layer. Deleting the folder is a temporary fix; it takes two minutes to download again.

Vivaldi, Yandex, and the long tail of "just another browser"

Vivaldi does not have a built-in VPN or Tor mode. It is on this list for a duller reason: it is a browser your parental control has probably never heard of.

Many consumer controls work from a list of known browsers. They know Chrome, Edge, Firefox and Safari. They may know Brave and Opera. They usually do not know Vivaldi, Yandex Browser, Waterfox, LibreWolf, Pale Moon, Falkon, Min, or whatever appeared last year. If a filter enforces by hooking known browsers, an unknown browser is simply unfiltered — no VPN required.

There is no realistic way to keep up with this by name. New Chromium and Firefox forks appear constantly, and any of them can be installed by a child who searched "browser that isn't blocked". This is the single strongest argument for an allowlist approach to applications: instead of maintaining a list of browsers to block, permit the ones you have approved and let everything else fail.

What stops it: allowlisting applications rather than blocklisting them, plus network-level filtering that applies to all traffic regardless of which program produced it.

Portable browsers from a USB stick or the Downloads folder

This is the case that catches the most parents out, because there is no installation to notice.

PortableApps and similar projects publish self-contained builds of Chrome, Firefox, Opera and Tor Browser that run straight from a folder. Nothing is written to Program Files, no installer runs, nothing appears in the Windows uninstall list, and — critically — no administrator password is required, because everything happens inside the user's own profile or on a removable drive.

The variants to know about:

  • On a USB stick. Brought in from a friend, plugged in, run, unplugged. Leaves almost nothing behind.
  • Downloaded and run without installing. The child downloads a portable .exe or a .zip, extracts it to Downloads or Desktop, and double-clicks. Total time: about ninety seconds.
  • Renamed. A portable browser called homework.exe sitting in a school folder is not going to catch your eye during a spot check.

Because a portable browser is a fresh, unconfigured copy, any settings you applied to the installed browser — SafeSearch locks, extensions, managed policies — are not present. Checking that SafeSearch is locked in Chrome tells you nothing about a portable Firefox on a USB stick.

What stops it: network and DNS filtering, which does not care which executable made the request; and controls that prevent unapproved executables from running at all. Deleting browsers and checking the Programs list do not stop it, because it was never in the Programs list.

Which defence actually works, and which just feels like it works

Defence Stops built-in VPN browsers Stops Tor Stops portable browsers Effort Honest verdict
Blocking sites in Chrome/Edge settings No No No Low Only works if the child never installs a second browser
Browser extension filter No No No Low Uninstalled or bypassed in one click
Uninstalling other browsers No — reinstalled No No Low Buys you an afternoon
Hosts file entries No No Yes, for listed domains Low Beaten by any VPN or proxy
Router / DNS filtering Partly — if you block proxy endpoints No Yes Medium Good baseline, defeated by encrypted tunnels
Standard (non-admin) Windows account Mostly Partly No — portable needs no admin Low The highest-value single change you can make
Application allowlist (approved programs only) Yes Yes Yes Medium The only thing that covers portable builds
DNS-over-HTTPS blocked at the network Helps No n/a Medium Stops the browser hiding lookups from your filter

The pattern is worth stating plainly: every defence that lives in a browser loses, and every defence that lives below the browser has a chance. Rank your effort accordingly.

The three changes that actually hold

1. Filter at the network or DNS layer, not the browser layer. A filter that sees all traffic leaving the machine does not care whether the request came from Chrome, Vivaldi, or a portable Firefox on a memory stick. This alone handles the entire "just install another browser" category.

2. Remove the ability to install or run new programs. On Windows, make your child's account a Standard User rather than an Administrator (Settings > Accounts > Other users > select the account > Change account type). This stops normal installers cold. It does not stop portable executables, which is why the second half matters: use a control that only permits approved applications to run, so an unrecognised .exe in the Downloads folder does nothing when double-clicked.

3. Allowlist browsers instead of blocklisting them. Decide which browser your family uses, approve it, and let every other browser — including ones that do not exist yet — fail by default. Blocklisting is an endless subscription to other people's release schedules. See parental controls kids can't bypass for how the allowlist model applies more broadly.

This is the model 3Eyes is built on: approved applications and approved sites, with everything else showing an "Ask Parent" page rather than loading. It runs on Windows and Mac as a managed service that resists being closed or uninstalled from a standard account, and requests come to your phone for approval. It is paid software with a 14-day trial. If a non-admin account and router filtering are holding fine in your house, you do not need it.

When this doesn't work

Three situations where none of the above is the answer. Each has a different next step.

Your child has administrator rights. Then they can uninstall your filter, change the DNS server, disable the service, or create a new account. Nothing you configure survives. Next step: change the account type first, before installing anything. On Windows: Settings > Accounts > Other users > Change account type > Standard User. On a Mac: System Settings > Users & Groups, and make sure their account is a Standard account. Do this even if you buy nothing else — it is free and it is the largest single improvement available. If this is happening after a filter is already in place, our guide on what to do when your kid bypasses parental controls covers the conversation as well as the settings.

It's a school-managed laptop or Chromebook. School devices are enrolled in the school's management system, which usually outranks anything a parent installs — and on a managed Chromebook you frequently cannot install third-party software at all. Next step: ask the school's IT administrator what filtering is applied at home versus on site, whether a personal profile can be added, and whether the device is filtered by the school's system when off the school network. Then apply your own controls at the router, which covers the device regardless of who manages it. Our Chromebook parental controls guide covers what remains available to parents.

They're using a phone hotspot. A phone providing a Wi-Fi hotspot to the laptop bypasses every network control in your house instantly, because your network is no longer involved. Next step: this cannot be fixed at the router. It needs a control that runs on the computer itself, plus mobile-side limits on the phone providing the connection. Check the phone's own settings for a hotspot restriction under its parental controls or screen-time options.

The honest limitation

A teenager with physical access to a computer, administrator rights and enough motivation defeats every consumer parental control on the market. That includes ours.

They can boot from a USB stick into a different operating system entirely, and your Windows filter is not running. They can use a different computer at a friend's house. They can factory reset. They can, at the low-tech end, simply do the thing at school. Software cannot solve a problem where the user has full control of the hardware — that is not a marketing weakness in a particular product, it is the shape of the problem.

What good software does is make bypassing deliberate and effortful rather than accidental and casual. There is a real difference between a nine-year-old who clicks a link in a Discord message and lands somewhere upsetting, and a fifteen-year-old who spends an evening researching how to get around you. Filtering solves the first case almost completely. It does not solve the second, and any product that claims otherwise is selling you something.

For the second case, the useful tools are visibility, a stated rule your child could explain back to you, and a conversation about why. Products help. They do not substitute.

Frequently asked questions

Does Brave bypass parental controls? Brave itself is filtered like any other Chromium browser by a network-level filter. Its Tor windows do bypass domain and DNS blocklists, because the destination is hidden from your filter. Blocking Brave's installation is the practical answer.

Is Opera GX safe for kids? It is a normal browser with gaming features, but it includes a free built-in VPN that switches on with one toggle and no account. If you are filtering at the router or DNS level, that toggle makes the filtering ineffective for anything opened in Opera GX.

How do I tell which browsers are installed on my child's PC? Check Settings > Apps > Installed apps, then look in C:\Users\[name]\AppData\Local and the Downloads and Desktop folders for browser folders or loose .exe files. Portable browsers never appear in the installed apps list, so the folder check is the one that matters.

Can parental controls block Tor Browser? Network-level filters cannot see what Tor is fetching, so the block has to happen earlier: prevent the executable from running, or block known Tor entry relays at the network. Removing the folder alone is not a fix, since it re-downloads in minutes.

Should I block all browsers except one? Yes, if you can. Allowlisting one approved browser is far more durable than blocking a list of bad ones, because new browsers appear constantly and portable builds need no installation. Pair it with network-level filtering so an unexpected browser is still filtered.