Download
Privacy-first browser for Android
RABEX Browser is a free Android public beta with browsing and privacy tools. The official website is rabex.in, also written as Rabex in.
Opens the live web demo below. Simulated data.
From a shortcut to a page, in one tap.
This sample stays on the website. No real page is loaded and no search is sent.
Android-source theme preview · not an app screenshot
Beta features and native behavior may differ.
Features
Browser-request filtering for known ad and tracker hosts, with per-site controls. Not a whole-device VPN. Anti-redirect and hostile-chain upgrades are coming soon.
A VPN built right into the browser. In the works.
No RABEX account and no RABEX cloud sync. Bookmarks, history and notes stay on your phone. Use Incognito for private browsing.
Your favorite sites one tap away, with icons fetched automatically.
40-second tour
A short animated preview of Speed Dial, Tabs, Reader mode, the Video player, the Download Manager and Privacy. It is an animation, not a phone capture.
Privacy
Network-level blocking cuts off known ad and tracker hosts at the source.
Cosmetic filtering hides the empty ad boxes that blockers leave behind.
No RABEX account and no RABEX cloud sync. Bookmarks, history and notes stay on your phone. Use Incognito for private browsing.
Browse privately in Incognito. Private Space is PIN-protected, with fingerprint unlock on supported devices.
A VPN right inside the browser. In the works, not shipped yet.
Part of the Advanced Ad Shield upgrades. In the works, not shipped yet.
Strip a page down to the words for calmer, cleaner reading.
Manage cookies, run Guardian and audit site permissions from Settings.
PIN-protected private notes, kept behind your PIN.
Interactive demos
Live web demos you can tap, type and switch. Data is simulated and this is a website recreation, not the Android app itself.
Total Speed strip, multi-thread progress, Pause and Cancel. Find it in the menu under Downloads.
Tap the menu on any page for Reader mode, Translate, Save offline, Read aloud and more.
Open Downloads, tap the Private tab, press Enter.
Ads and tracker hosts are blocked before they load, and empty ad boxes are hidden. Counts are illustrative.
See every tab at a glance, tap one and it opens full screen.
Tap the search bar, type, and go. No page flicker.
Play, seek, volume, speed, lock, fullscreen and picture-in-picture where your browser supports them. Placeholder clip.
LIVE WEB DEMOS: the interactions are real website code. Files, speeds, counters and results are simulated demo data. The real app runs on Android.
How Ad Shield works
Concept demo
Illustration only. RABEX blocks known ad and tracker hosts.
Results vary by site. Not a live blocking test.
Smart Download Control
Your download. Your network. Your rules.
5G dropped? Your download does not have to switch with it. Set network rules for every download, including Wi-Fi only, mobile data only, charging only and a supported 5G preference.
The Android app does the real work. This is an interactive web demonstration of RABEX's native Download Manager, with simulated data. This conservative web simulation waits on LTE, 5G NSA or unknown radio state. The Android app can accept fresh confirmed NSA evidence; optional phone-state/location access may be needed. Device behavior remains unverified.
Choose Any network, Wi-Fi only, Mobile data only or a 5G-only preference. Add Only while charging or Private, then queue and prioritise. When the network does not match, RABEX pauses the download and waits, then resumes when it does.
Turn on JavaScript to try the interactive demo.
Try it
A small working browser. Type an address, open tabs, toggle Ad Shield and Reader mode. Simulated demo pages.
Speed Dial: your favorite sites, one tap away.
Download
Two separate apps. Pick the one for your device.
For your phone · APK
APK served from rabex.in (stored on GitHub releases). You may need to allow installs from your browser or file manager.
638393a42f5086caa4c3682f8c0fe1fdd4064af070e4730030e61c2eac356791Total APK downloads so far (all versions): loading…
For your PC · 64-bit installer
Windows 0.4.9-beta, unsigned tester. This is a manual installer with no auto-update. It has not been accepted on a real Windows PC; install, upgrade, antivirus, DPI and stability checks remain pending. Windows may show an unknown-publisher warning. Do not bypass Windows or antivirus security warnings.
b2b32f6e1897df97ee9265ca1b48b40dd2d2170a87027309b99234d2f499fadeChangelog
Changes in the current live Android version.
Public build of 1.0.361-beta (package com.aman.ucturbo, versionCode 900361).
Builder reports four reported corrections sharing one source across owner and public flavors: Files grid batch selection, equalizer row selection, a fresh popup WebView, and the media-notification path now starting the existing media service from active foreground playback, retaining the same engine and session through Home and reclaim.
Builder reports: normal app screens are now capturable for screenshots, while explicit private and sensitive surfaces keep their secure flags; private playback does not create a session or notification target.
Distributed under GNU GPL v3 or later (FFmpeg 6.1.2 under LGPL2.1-or-later); the corresponding source is published next to the APK download.
Known limitations: Builder reports: checks for this candidate are host-side only; there is no Android device end-to-end acquisition, crash runtime, OEM notification delivery, hardware screenshot behavior, or download/save/Open verification, and host checks are not a runtime success claim.
Known limitations: Not a full normal-feature parity closeout: owner-only backup/import/export, devices, sync and plugins remain pending scope review.
Known limitations: The observed video is consistent with the prewarmed popup history invariant; the exact original Java exception was not recovered.
Known limitations: Limitations listed for earlier builds may still apply; they have not been re-verified for this build.
Known limitations: Install from this site is manual for this build.
We use aggregate APK request counts to help plan RABEX's roadmap. The public "downloads" total starts from zero when this counter is activated on October 10, 2026; earlier site history is not included because provider history was sampled. It counts successfully recorded APK download requests (GET responses with status 200 or 206) for versions 1.0.204 through 1.0.207 from October 10, 2026, and for each later Android APK version from the time counting was added for it on October 11, 2026. Downloads of versions 1.0.224, 1.0.225, 1.0.227 and 1.0.228 made before that time were not counted. It is not a count of unique people, completed downloads or installed apps. Retries, partial requests, bots and verification downloads can add extra counts. Counter failures and browser caching can leave some requests uncounted.
The counter stores only daily version/response-category integer totals and one lifetime integer. It does not store visitor identifiers, individual event records, IP addresses, user agents, referrers, Ray IDs or cookies. Daily totals are kept for 90 UTC calendar days; recovery copies can last up to 7 more days. The lifetime total is retained. Cloudflare processes network information to host and protect the website. This counter does not measure Android app use.
Last updated October 12, 2026. Android coverage: signed PUBLIC RABEX 1.0.237-beta, versionCode 238, package com.aman.ucturbo; OWNER=false, BETA=true, DEVELOPER=false. Version 225 retains the reviewed 224 data/network behavior and adds only the startup current-tab bounds guard. Version 227 retains the reviewed 225 data/network behavior and the same 20 Android permissions, and adds only a settings search popup: it stores recent settings searches on this device (fixed topic names, up to 12, normal tabs only, never read or written in private tabs), and its voice search asks for confirmation before using the Android speech service. Version 228 retains the reviewed 227 data/network behavior and the same 20 Android permissions, and adds only: the settings search popup blocks screenshots and screen recording while private or incognito tabs are in use, and the update checker can defer its notice - public release details and their fetch time can be kept in app settings on this device and shown later, within the 12-hour window described below. Version 237 retains the reviewed 228 data/network behavior and the same 20 Android permissions, and adds a media library and player updates: the library reads media on this device through Android's MediaStore using the existing media permissions; continue-watching entries (up to 100) and playlists are stored, unencrypted, in the app's private settings on this device; folder categories and favorites are saved only in normal mode; the play queue is kept in memory only. Playing from a private tab writes no history, resume, playlist or favorite entries and turns off background playback and picture-in-picture; some player settings can still be saved from private playback. Clearing history or deleting playlists removes the stored entries; it is not a secure erase. The 1.0.227-beta review (2026-10-11, signed build SHA-256 b96be4d71c9f658c8cd07989b083af8483a5c0f0147ad9b473f025878d9bfae9) found the same 20 Android permissions as 1.0.225-beta, no new network endpoint strings in the reviewed code and artifact, and unchanged private-mode data handling; this is a static source and artifact review, not a network traffic capture. The 1.0.228-beta review (2026-10-11, signed build SHA-256 ba77233b29c107cda079437cc3e34ab348961049ccd91e65c1ce1f2aea865b15) found the same 20 Android permissions as 1.0.225-beta, no new network endpoint strings in the reviewed code and artifact, and unchanged private-mode data handling; this is a static source and artifact review, not a network traffic capture. The 1.0.237-beta review (2026-10-12, signed build SHA-256 a7d1b83c4d384532d01206de11e8c4bc875aee79f1e39754aa1d0ad3097ebe56) found the same 20 Android permissions as 1.0.225-beta, no new network endpoint strings in the reviewed code and artifact, and the private-mode media handling described above; its code is identical to the reviewed 1.0.236 release-candidate build except the version number; 1.0.229 was preparation-only with no APK proven, 1.0.230 through 1.0.235 were signed internal test builds, and no public publication is proven for any of them. This is a static source and artifact review, not a network traffic capture. The private owner224 flavor is distinguished below. This policy also retains the existing rabex.in website disclosures. Windows is not covered. Source/byte checks are not a network packet trace, complete security audit or native-device acceptance. Install/upgrade, native UI, playback, permissions and WebView isolation still need device checks. Historical changelog entries describe their own versions and remain unchanged.
History, bookmarks, tabs, settings, reading lists, notes, download records and playlists can be stored in unencrypted app storage. Android's app sandbox and device security still apply, but RABEX does not separately encrypt all of these records. No RABEX account/cloud-sync backend or analytics SDK such as Firebase, Crashlytics or Sentry was found in the reviewed source.
Local technical crash records are stored in app-private preferences. A record can include crash kind and minute-rounded time, device model, Android/API/app/WebView versions, a bounded thread label, up to four exception class names and up to twelve selected class.method:line frames. Exception messages, full stack dumps, URLs, page content, entered text and file paths are not recorded by this CrashFacts path. Renderer-exit records can include did-crash and priority; on supported Android versions the most recent process-exit reason/importance can be recorded. This narrow Java/WebView/process-exit path is not a native crash dump or complete diagnostic trace.
CrashFacts retention accepts at most five records, each at most 4 KiB UTF-8, with a total JSON-array cap of 16 KiB UTF-8. Records at least 30 days old, future-dated, malformed or oversized are discarded, not truncated into valid records. Pruning runs at app startup before exit-record capture and whenever a CrashFacts record is written. It does not run while the app is closed. It uses the phone's wall clock, so clock changes affect retention. A failed storage commit can leave earlier values on disk. These bounds are not a secure-erasure or instantaneous filesystem-cleanup guarantee. Related crash-loop/start/exit bookkeeping is pruned or overwritten during those lifecycle steps and is not an additional five-record native log.
No HTTP/socket/upload call is implemented in CrashFacts, CrashRecordPolicy, Crash or SafeReport. There is no automatic crash upload in this reviewed path. A separate next-launch dialog can offer an Android Share report chooser; in BETA it shares a fixed generic app-stopped code rather than the CrashFacts JSON. Sharing is an explicit user action, and the chosen receiving app/service can retain its copy. Public 224 has OWNER=false and DEVELOPER=false: owner full-preference backup/import and developer diagnostic-center/self-check tools are guarded off, but local crash capture and the generic crash chooser are not claimed disabled.
Shake-to-report is disabled in the reviewed beta flavor. Where report sharing is enabled, screenshots are stored temporarily in private app cache and shared through a read-only provider with access granted to the receiving app, not saved to public MediaStore. A screenshot can contain what is visible on screen. Up to 16 temporary files are retained; files older than 24 hours are cleaned up at the next launch or report save. Receiving apps can keep their own copies, and canceling a report does not remove copies they already received.
The password generator and strength/reuse checks run on the phone only and do not contact any server; they do not detect leaked passwords.
The reviewed password vault uses AES-256-GCM with an Android Keystore-wrapped key. The separate vault file/key are excluded from the full-preferences backup, and no server-sync code was found. A user-directed CSV export is plaintext and goes to the Android document provider you choose, which may be cloud-backed. Anyone who can read the exported CSV can read its contents; protect or delete it when no longer needed.
Full-preference backup/export/import is available only on the OWNER=true path. Signed PUBLIC 224 has OWNER=false, including its BETA flavor, and rejects those owner-only operations. Where available, Export backup creates plaintext JSON: anyone who can read it can read its contents. Encrypted backup uses UCB1, AES-256-GCM and PBKDF2 (60,000 iterations) with a password of at least six characters; use a strong long password.
In 224 both plaintext and encrypted full-preference backups exclude crashFacts, crashlog, evlog, autolog, crashExitMinute, crashAt, crashCount, crashLoop, startAt and loopSafe. The same exclusion set is honored on restore, so an older backup does not reintroduce these entries through this restore path. The encrypted serializer also excludes broken_* recovery entries; do not claim that additional exclusion for every plaintext preference. Previously exported files remain unchanged and are not revoked or erased.
Where owner exports are enabled, other exported preferences can include bookmarks, ordinary history, notes, reading/download lists, playlists, private-bookmark URLs, Speed Dial, workspaces, research, watched pages, scripts, clipboard-history choices and settings. This is not an exhaustive field list. PIN verifiers are excluded and importing does not replace the existing PIN. Vault file/key/notes, Private Space file bytes and open-tab/recovery state are excluded from full-preference export. A selected Android document provider may store a user-directed export in the cloud. Android allowBackup=false does not prevent such user-directed copies. No automatic RABEX cloud-sync backend is implemented.
The PIN verifier uses PBKDF2 (100,000 iterations). A low-entropy PIN, such as a four-digit PIN, can be guessed by brute force if its verifier is exposed. Encrypted backup does not justify saying that private bookmarks can never leave the phone.
Private Space copies files into private app storage; originals remain in their previous location, including the gallery where applicable. The file bytes are not separately encrypted by RABEX. Protection depends on the PIN, Android sandbox and device encryption. No automatic upload was found.
Incognito guards normal history/tab persistence and disables Google suggestions in that mode, but it is not anonymous or trace-free. In 224, Incognito tabs use a separate app-created WebView profile, so their cookies and site storage are kept apart from normal tabs when the installed Android System WebView supports separate profiles. If it does not, or the profile cannot start, Incognito pages are blocked from loading (network, JavaScript and site storage are turned off) instead of using normal cookies. Closing all Incognito tabs requests cleanup of that profile's cookies, site storage and location permissions and then deletes the profile, but cleanup can finish later or wait until the next time Incognito starts. Cache and service-worker data are removed only when the profile is deleted. RABEX does not promise an immediate or secure disk wipe. Separate-profile isolation was checked in source only and has not been tested on a device. Download entries can persist URL, referrer, page URL and filename in unencrypted app storage (dl_queue.json). If you choose Private Space Save Current Page, even an Incognito URL can be saved in preferences. Google Safe Browsing lookups also apply to Incognito tabs.
Browsing/searches contact the websites and selected search engine. Websites can use cookies, storage and tracking. In normal tabs Google suggestions are requested while typing, with a 160 ms debounce. Online search suggestions are ON by default and can be switched off. Off stops new requests and drops suggestion callbacks, but one in-flight or racing stale query may still reach Google. Incognito guards those suggestions.
Each page load can make a main-frame HEAD probe. Normal probes can use site cookies; Incognito probes omit cookies. Displayed bookmark/Speed Dial icons and homepage items can be fetched automatically without cookies, with a one-hour throttle. Google Safe Browsing URL-hash lookups run for all tabs, including Incognito. Download requests can include site cookies and referrer information.
Features can contact Translate, Google Lens, speech/text-to-speech providers and Cloudflare speed tests when invoked. Connectivity checks contact a generate_204 endpoint; filter refreshes contact pgl.yoyo.org. Watched public URLs can be fetched while the app is open. These are source-review findings, not an exhaustive list of every possible connection.
Both signed 224 flavors use the BETA updater and embed empty feedback/social/update constants, not a personal Drive update channel. Auto-check is optional and defaults on. It checks release metadata from https://rabex.in/release.json when the app is foreground, focused, unlocked, in a normal tab and not covered by another page/splash. Eligible checks are normally at most once per 12 hours from the last attempt; a backward clock change can make another check due. The app evaluates eligibility shortly after resume and periodically while open. It is not a background scheduler or exact twelve-hour alarm. Leaving the app or entering a private or locked screen stops scheduled checks, requests cancellation of an in-progress check and closes any visible update notice. Public release details and their fetch time may be kept in app settings on this device so an update notice can be shown later. Cached details are used only while no more than 12 hours old; expiry and clock changes are checked when the update checker runs. Choosing Later or dismissing the notice requests removal of the cache, and turning off update checks clears it when the checker next runs. An installed version is not offered again.
A newer-release notice offers Update or Later. Update opens the manual update workflow. It never starts an automatic APK download or silent installation. You can also choose Check for beta updates manually and switch automatic checks off. Choosing Download saves the APK privately; pause/interruption keeps bytes for supported resume. Before Android's installer is opened, the app verifies actual file size, SHA-256, package/version and existing signing-certificate compatibility. An incompatible key is rejected, not solved by uninstalling your app. Android still requires installation consent and may require a source-install permission round trip. These paths are source-tested, not proven on every phone. Requests to rabex.in expose ordinary IP/HTTP information to its hosting provider; the metadata checker does not attach browsing cookies, a persistent device ID or local crash records.
Optional speed test: tap GO to start three HTTPS response probes, then repeated test-data downloads from speed.cloudflare.com during a sample targeting about nine seconds. Each download request asks for 25,000,000 bytes, but TOTAL DATA IS NOT CAPPED. Fast connections can consume hundreds of megabytes; mobile data charges may apply. Connection/header/read delays mean this is not an exact 9-second wall-clock cutoff. Closing the test or leaving the app requests cancellation; it is not a guarantee that network traffic stops at that instant.
Cloudflare receives the connecting IP address and the test requests, including byte-count parameters and fresh random request nonces, and processes them under its privacy policy. SpeedProbe does not send browsing history, page text, saved passwords or private files, and does not upload its calculated results. The result is calculated locally from received bytes and elapsed time. Displayed received bytes exclude some network overhead and are not carrier billing. This is a single-stream download estimate and best-of-three HTTPS response timing, not an ICMP ping, upload test, packet-loss test or guaranteed maximum line speed. No zero-IP, anonymity or no-server-logging claim is made. Cloudflare's own test-page data limits are not a cap implemented by RABEX. See https://speed.cloudflare.com/ and https://www.cloudflare.com/privacypolicy/ .
The reviewed manifest declares 20 permissions, with no SMS, contacts or call-log permission, and Android backup is disabled (allowBackup=false). This does not prevent user-directed exports, report screenshots or backups from creating copies elsewhere. Manifest permissions do not prove every permission is used in every session.
This website has no RABEX accounts, behavioral analytics SDK, advertising pixels or third-party embeds. Its code does not set cookies or use localStorage or sessionStorage. Its images, video, fonts and scripts are served from this site. The browser demos run locally in memory; typing in a demo does not send a real search or upload your notes.
Cloudflare hosts and protects the site and feedback service. When you visit or download, Cloudflare processes your IP address, requested URL, request time and browser/HTTP headers. Hosting services may keep operational and security data. This is separate from behavioral analytics: Cloudflare Pages Web Analytics is currently disabled.
Cloudflare also enables network-error diagnostics. Supported browsers may send connection-failure reports to Cloudflare, including the requested URL, referrer, request method, protocol, status, failure type and timing. Cloudflare says it uses the client IP to derive network and approximate-location information, then drops that IP from its network-error reporting pipeline after processing. We do not claim that visiting the site sends no data to servers.
On a visit, the page requests public feedback from our Cloudflare feedback service, along with release information and feedback templates from this site. These requests expose normal request information to the host even if you do not submit feedback.
Text feedback sends your chosen display name, message, rating, permission to publish and whether you used suggested wording. We store those fields with a submission ID, received time and moderation status in Cloudflare storage. Authorized moderators and account administrators can access them. After review and your permission, your name, quote and rating can appear publicly on this page.
A star-only rating contributes to an aggregate rating count and total. We do not retain your name or text for a star-only rating. The browser may still send a name you typed, but the service does not save it for that rating.
To limit spam and duplicate ratings, the service processes your IP address and keeps short-lived IP-derived rate-limit identifiers. At present these identifiers can last up to 25 hours. They are pseudonymous, not guaranteed anonymous, and are not included in public feedback.
At present, text-feedback records have no automatic expiry. Rejecting a submission or removing its public quote does not by itself delete the private record. To request removal, email us and identify the submission. We may need enough information to verify which feedback is yours before removing it. We are preparing a bounded retention and full-deletion workflow; this policy does not claim that it is already active.
RABEX Browser is developed by Aman. Instagram: @its_aman7017.
The feedback, support and security email links open your mail app. They do not send an email automatically. If you send a message to Aman9917in@gmail.com, your email address, name, message, any attachments and email metadata pass through your email provider and Google/Gmail and can be read by the mailbox owner and authorized mailbox access. Send only what is needed. Do not send passwords, private signing keys or recovery codes.
Roadmap
Beta feedback
Only real feedback from people who tried the beta and agreed to share it.
The beta just opened. Tried it? Tell us what worked and what did not. With your OK, your words show up here.
Prefer email? Send it by email.
FAQ
RABEX Browser is the Android web browser on rabex.in, also written as Rabex in. If you meant this browser when typing rabix, rabax, ravex, rebex, ravix or revex, use rabex.in to find the official beta download. These are spelling examples, not separate RABEX products.
RABEX Browser is an Android web browser with built-in privacy tools. It is in public beta. It includes Ad Shield, Speed Dial, bookmarks, a built-in download manager, Incognito, Private Space and Rabex Vault.
Yes. The Android beta is free to download from this page.
Android 7.0 or newer. The Android beta is live now. Windows 0.4.9-beta is available as an unsigned tester installer from the Download section. It has no auto-update and has not been accepted on a real Windows PC.
Download the APK from the Download section and open it. Android may ask you to allow installs from your browser. Get it from rabex.in only, and compare the SHA-256 shown next to the download.
Ordinary browsing/searches and user-invoked tools contact their service providers. Optional update checks contact rabex.in; speed tests contact Cloudflare. Servers see connecting IP information. Normal tabs can store local history; separate-profile Incognito is not anonymous or a secure disk wipe. See the privacy policy below for local crash records, retention, exports and service requests.
It filters known ad and tracker hosts and hides empty ad boxes, with per-site controls. It does not block everything.
Available: Ad Shield, Speed Dial, bookmarks, a download manager with pause and cancel, Incognito, Private Space, Rabex Vault, Reader mode and page options. Coming soon: built-in VPN and anti-redirect protection. The beta is still being tested on real devices, so expect rough edges, and feedback inside the app is not available yet.
Both are page options in the menu. Desktop site asks websites for a 980 px wide layout and sends supported desktop browser hints; turning it off restores the mobile layout. Results vary by site and Android WebView version, and some sites ignore the request. Reader mode strips a page down to its main text so long articles are easier to read, where RABEX can find an article on the page.
Use the form in the Beta feedback section above, or email Aman9917in@gmail.com with your phone model, Android version and RABEX version. Tick the box (or say so in the email) if we may show your words on this page. We only show real feedback that the sender agreed to share.