NovaBlock vs Ghostery: we ran both, and split the results

Ghostery is one of the best privacy tools available, and it has been for fifteen years. We benchmarked NovaBlock against it on the same machine, same browser, same pages, on the same day — both products installed fresh and taken through their own setup.

The result was a genuine split, and the two products turn out to have quite different philosophies.

The most interesting number in that table is the one most benchmarks never report: how many third-party companies actually got to see you.

Across five sites, a bare browser contacts 79 third-party servers. NovaBlock cuts that to 28. Ghostery cuts it to 36.

Yet Ghostery blocked 311 requests to our 108. Those two facts look contradictory until you understand what each product is doing.

NovaBlock cuts connections at the company level. When we block a tracking network, its script never loads — so the twenty requests that script would have fired never happen at all. They don't get counted as blocked, because they never existed. Ghostery more often lets the script load and then blocks each beacon it tries to send. Twenty counted blocks, where we score one.

On Marca the contrast is stark: Ghostery blocked 68 requests to our 9, and still ended up contacting more third-party servers than we did — sixteen against our thirteen.

Neither approach is wrong. Ours means fewer companies ever learn you exist. Theirs means the companies that do connect send less. And on bandwidth, theirs is clearly the more effective strategy: 18.2 MB against our 26.3, a 43% saving where we manage 18%. If you're on a metered connection or a slow line, that's Ghostery's argument and it's a strong one.

On Tom's Hardware — twenty-eight third-party servers before any blocking — we load in 1021 ms to Ghostery's 1100. On GitHub, 563 ms to 625. These are pages where a blocker earns its keep.

On lighter pages Ghostery edges ahead: Wikipedia by 8 ms, the Guardian by 33 ms. Across all page loads pooled together, Ghostery's median is 434 ms to our 465. We're showing both framings because picking whichever flattered us is exactly what makes benchmarks worthless.

NovaBlock used 11.98 MB of page memory against Ghostery's 14.76 — and a browser with no extension at all uses 10.26, so our overhead is under 2 MB.

On permissions, we ask for seven: activeTab, alarms, contextMenus, declarativeNetRequest, offscreen, storage, tabs. Ghostery asks for thirteen, including permission to run its own code inside every page you visit.

We're not suggesting Ghostery misuses that. It's an open-source project with a long and good reputation. But an extension that cannot inject code into your pages cannot be made to — not by a future update, not by a change of ownership, not by a compromised build. That's a structural guarantee rather than a promise, and it's why we build the way we do.

We pulled both products' compiled filter rules apart, and the result surprised us.

We ship 139,471 rules. Ghostery ships 90,328. We block a third as much.

Volume was never the difference. Ghostery uses four of the browser's five filtering actions; we currently use one. Most importantly it ships 5,743 redirect rules and 46 small stand-in files: rather than blocking a tracking script outright, it swaps in a local file that offers the same functions and does nothing. The tracker collects nothing, but the page's own code doesn't break when it calls into it.

That one technique is how Ghostery blocks more and breaks less — two things that normally trade against each other — and it explains most of its bandwidth lead. It needs none of the extra permissions. It's a technique gap on our side, not an access gap, and it's the top item on our roadmap.

* Why “requests blocked” can be misleading. This number measures blocking style as much as effectiveness. NovaBlock blocks tracking companies at the domain level — the script never loads, so the twenty requests it would have made never happen, and are never counted as blocked. Blockers that let the script run and then kill each beacon it fires score twenty for the same outcome. On Marca, Ghostery blocked 68 requests to NovaBlock's 9 while still contacting more third-party servers (16 against 13). That's why we also report third-party servers reached, which this effect doesn't distort. The gap isn't purely cosmetic — Ghostery genuinely transfers less data overall — but the raw count overstates it substantially.

† Why our tracker score may flatter us. We check whether the JavaScript object each tracker installs is present on the page after loading. Some blockers replace a tracker with a harmless local stand-in rather than blocking it outright; the stand-in defines the same object, so our test records it as “ran” even though no data left the browser. On this measure, their better technique scores worse. We report the figure because we measured it, and the caveat because it's true.