Are browser games safe? What to check before you play

Short answer: a browser game from a reputable site, in an up-to-date browser, is one of the safer ways to play a game online. You install nothing, and the browser keeps the game in a box. The risks are real, but most of them are not in the game itself. They are in the pages around it: fake download buttons, pop-ups, copies of games on sites you have never heard of, and payment pages you should not trust.

This page explains what your browser already does for you, where the real risks are, and what to check before you play or pay. We make a browser game, AJ Cities, so we say at the end exactly how it handles each point. The general advice comes from the sources listed at the bottom.

What your browser protects you from

When you open a game in a modern browser, the game's code runs inside a sandbox. In Chrome, for example, the part of the browser that runs web pages works with tight restrictions on what it can touch on your computer: it runs at the lowest trust level the operating system offers, and it has to ask the main browser process for anything outside its box. A web page cannot quietly install a program, read your files or take over your machine just because you opened it.

That is a big change from the old days. Many browser games used to run on Flash, a separate plug-in. Adobe stopped supporting Flash Player on 31 December 2020 and blocked Flash content from 12 January 2021. Today's browser games use the browser's own built-in features instead, such as WebGL for 3D, which are covered by the browser's sandbox and security updates.

Where the real risks are

1. Fake downloads

The most common trap is a page that says you must download something to play: a “launcher”, a “player”, a “codec”. A real browser game needs none of that. The FTC's advice is plain: don't use unfamiliar websites to download free stuff like games. If a browser game asks you to install a program, close the tab.

2. Pop-ups and scare messages

Some game sites carry aggressive ads, and some of those ads pretend your computer is infected and give a number to call. The FTC says never call a phone number that appears in a pop-up window. Close the tab; if it will not close, close the browser.

3. Copies of real games

Popular browser games get copied onto other sites, sometimes with extra ads or worse. Play from the game's own website where you can, and type the address yourself rather than following a link someone posted in a comment section.

4. Extensions

A game in your browser does not need a browser extension. Extensions can ask for wide access to the sites you visit, so be careful with any that promise “free” access to a game or extra powers in it.

5. Payments

Free games make money from purchases, and payment is where your money and your card are at stake. Check that the page belongs to the game, that the price is clear, and that the card form comes from a known payment company. Big processors are held to strict card-security standards: Stripe, for example, says it is certified as a PCI Service Provider Level 1, the most stringent level in the payments industry. A game that asks you to type card details into a plain chat box, or to pay another player directly, is a game to leave.

6. Your data and your account

Many browser games need no account at all. If one does, use a password you do not use anywhere else, never share it with another player, and read what the site says it collects. A good game tells you in plain language and lets you ask for your data to be deleted.

7. Other players

Multiplayer games put you in a world with real people. No real game needs your password, card details or a code from a sign-in email from another player. Anyone asking for those is not doing you a favour.

Keep your browser updated

The sandbox only protects you if it is up to date. CISA, the US cybersecurity agency, puts it simply: the best defence against attackers using known holes is to keep your software up to date, and to turn on automatic updates where you can. That goes for your browser and your operating system.

The six-point check

1. Is this the game's own site? If not, find it.
2. Is it asking me to download something? A browser game should not.
3. Is my browser up to date?
4. What does it sell, and who takes the payment? Look for a known payment company and a clear price.
5. What does it collect? Look for a privacy policy you can read.
6. Is it meant for my age? Some games, ours included, are for adults only.

How AJ Cities handles each of these

We make AJ Cities, a free 3D open-world game set on the edge of Ajegunle, Lagos, so here is how it answers the checklist:

• Nothing to install. It runs in the browser on phones and computers. There is no launcher and no extension, and the game needs neither.
• Payments. The game is free, and tickets in its live multiplayer side are optional. If you buy one, Paystack or Stripe takes the payment and holds your card details; AJ Cities never does. Money paid in the game buys tickets and shop items only and cannot be withdrawn, so nobody can promise you a profit from it. The ticket guide lists every price.
• Accounts. AJ's single-player story needs no account. You sign in only to meet other players, and you must never share your password, a sign-in code or card details with another player.
• Data. Analytics load only if you accept them, and you can change that choice at any time. Crash reports never include your email, name, password or payment details. You can ask for your data to be deleted. The privacy policy explains it in plain language.
• Age. AJ Cities is for people 18 and over. Its fictional story includes crime, guns and drugs. See the terms.

For more on picking games, see our lists of free online multiplayer games with no download and free open-world browser games.

Are browser games safe?

From a reputable site in an up-to-date browser, generally yes: the game runs in the browser’s sandbox and installs nothing. The main risks are fake downloads, pop-ups, copied games and payment pages you cannot trust.

Can a browser game give my computer a virus?

A web page in a modern, updated browser cannot simply install a program. The danger is being tricked into downloading something, so never install a “launcher” or “player” to play a browser game.

Is it safe to pay in a browser game?

Check that the payment goes through a known payment company and that the price is clear. In AJ Cities, Paystack or Stripe takes the payment and holds your card details; AJ Cities never does.

Who is AJ Cities for?

Adults only, 18 and over. Its fictional story includes crime, guns and drugs.