Swell Browser

Every account, its own space. A minimal, open-source browser on Gecko with an Arc-style sidebar and fully isolated spaces in one window.

Responsibilities: Product, architecture, engineering, brand
Stack: Gecko (Firefox ESR), Rust, JavaScript, SQLite
Year: 2026
Links: Website, GitHub

---

Two accounts, one site

I'm signed in to the same sites twice: a work account and a personal one. Browsers have never handled that well. Firefox containers keep cookies apart but share history, passwords and extensions. Profiles keep everything apart, but each one lives in its own window. Arc came closest, with spaces in a sidebar that could each carry their own profile, and then it stopped being developed.

Swell is the browser I wanted instead: one window, a sidebar, and spaces that share nothing.

Learning from Arc

Before writing any code I studied how Arc is put together. It is a native app that treats Chromium purely as a renderer, behind a small bridge, and its whole sidebar is one flat tree of nodes saved to disk.

That shaped Swell's design. I kept the architecture and the data model, not the code, assets or name: a core that owns all state, a thin engine underneath it, and one tree for everything you pin. Because the models match, Swell can import an existing Arc sidebar straight from its StorableSidebar.json file.

I also left things out. Arc keeps three parallel copies of the tree and pairs of legacy fields. Swell has one tree, one source of truth, and no second bookmarks system.

Isolation is non-negotiable

A space in Swell is a separate identity, not a coloured tab. Each one has its own:

• Web state. Cookies, site storage, cache and network partitioned per space by Gecko.
• History and form data. Kept per space by the core, so the command bar only suggests what you visited there.
• Passwords, addresses and cards. Encrypted with a key per space, stored in the system keychain.
• Extensions. Installing an add-on in a space installs a copy that only sees that space's tabs, cookies and requests.
• Permissions and downloads. Camera, microphone, screen sharing and downloads stay in the space that asked for them.

Deleting a space deletes everything it kept. Isolation across 17 stores is checked by an automated suite, run on every change.

Engineering

The goal was a real browser without maintaining a fork of Firefox.

• Its own Gecko application. Swell lives inside a checkout of the Firefox source, the way Thunderbird does, and ships its own window instead of Firefox's. The tab strip, toolbars and Firefox menus are removed, not hidden.
• A small patch queue. Changes to Mozilla's files are a short list of numbered patches on a pinned Firefox ESR release. A change only goes there if it can't live in Swell's own code.
• A Rust core that owns all state. Spaces, the sidebar tree, history, passwords and extensions live in Rust, persisted in SQLite. The UI sends commands and renders small diffs back. It never holds the whole tree.
• A narrow engine bridge. Only one piece of code may create tabs, and every tab carries its space's identity. The core never touches Gecko types, so the engine stays replaceable.

Private by default

No telemetry, no crash reporter, no accounts. Swell checks GitHub once a day for a newer release, the check can be turned off, and nothing is ever installed without you.

What's next

Swell is in alpha for macOS on Apple silicon and Linux. Next come end-to-end encrypted sync, signed builds and Windows.

Catch the first swell.