NordLayer Browser is a lightweight, browser-level secure access client that encrypts web traffic through an organization's Virtual Private Gateway, letting teams reach internal resources and SaaS apps without a desktop VPN app or administrator rights.
NordLayer Browser is the browser-level secure access client in NordLayer's network security platform. Rather than routing a whole machine through a VPN tunnel, NordLayer Browser encrypts traffic inside the browser session and connects it to the Virtual Private Gateways an administrator has enabled for the organization. Users add the extension, sign in with their credentials, and choose a gateway; from then on, intranet portals, internal dashboards, and hosted web apps open over an encrypted TLS connection. Administrators turn the feature on per gateway from the Control Panel, decide which members may use it, and define domain exceptions for split tunneling. Access to company resources therefore stays controlled even on laptops that IT does not manage.
Because the protection runs inside the browser sandbox, NordLayer Browser installs in seconds and needs no administrator rights, which suits contractors, freelancers, and BYOD laptops that cannot run the full desktop app. Different browsers or profiles can point at different gateways, so one machine can keep work sessions in a chosen region while everyday browsing stays local. URL-based split tunneling excludes selected domains from the tunnel, keeping latency-sensitive services such as Slack, email, and video calls on their normal path. IT teams that already audit endpoints with tools like Microsoft Safety Scanner on Windows machines gain a complementary layer: endpoint scanning for stored files, browser-level encryption for the sessions that are live right now.
The biggest benefit is reach without rework. Contractors, freelancers, and remote staff open internal dashboards and SaaS apps from a personal laptop without a managed device image, a heavy agent, or a support ticket. Security teams gain a session layer that covers the gaps left by device-only controls, because traffic is encrypted from the browser even when the endpoint never joins the corporate network. Performance holds up as well: only browser traffic is routed, so other applications keep their usual paths, and split tunneling lets chosen domains bypass the tunnel entirely. Administrators manage everything from one place, enabling gateways, setting domain exceptions, and reviewing which members connect, and rollback is as simple as switching the feature off. NordLayer Browser refreshes itself with the browser, so hybrid teams get consistent encrypted access with almost no maintenance overhead.
Key capabilities and highlights.
NordLayer Browser connects the browser directly to the Virtual Private Gateways your organization has enabled, so intranet sites, internal dashboards, and hosted web apps load inside a single encrypted TLS tunnel without routing the rest of the machine or changing operating system network settings.
Administrators list the domains that should bypass the tunnel, using wildcards so a single entry can cover every subdomain, while the rest of the browser request keeps travelling through the encrypted connection toward the gateway they selected, which keeps bandwidth-heavy destinations fast without weakening protection for everything else.
Because NordLayer Browser runs inside the browser sandbox, users can add it themselves and keep working on contractor laptops, guest machines, or operating systems where the full desktop application cannot be installed, maintained, or supported by IT, including locked-down guest machines.
When an organization runs several Virtual Private Gateways, different browsers or profiles can each connect to a separate destination, so one laptop can hold work sessions in a chosen region while personal browsing stays entirely local, which is useful for teams that test regional availability without moving the whole machine.
Organization admins enable the extension for a specific gateway from the Control Panel, decide which members are allowed to use it, and can further restrict usage or limit allowed countries through Device Posture Security rules, so browser access follows the same policy as the rest of the network.
Only web traffic travels through the encrypted tunnel while the rest of the system keeps its normal route, which is what keeps NordLayer Browser light on bandwidth and avoids slowing down tools such as Slack, email clients, and cloud storage sync apps.
Users add the extension, sign in with their NordLayer credentials, and pick a gateway, and the session is protected from that moment onward without network configuration, device enrollment, or a restart, which means a new contractor can be browsing company resources securely within minutes of being invited.
The extension refreshes itself whenever the browser restarts after a new build is published, so IT teams never have to push manual updates to endpoint devices or chase users who are running an outdated extension, and the browser client stays aligned with the gateway settings configured in the Control Panel.
Browse historical releases and previous builds.
Common questions about NordLayer Browser.
No. NordLayer Browser works without the desktop application and secures browser sessions on its own, which is helpful when the desktop application cannot be installed or is not supported on a given operating system.
Only Virtual Private Gateways are supported. Shared Gateways, Site-to-Site, and Cloud LAN connections still require the NordLayer desktop application instead of the browser client.
The extension is available for Chrome, Firefox, Microsoft Edge, and Brave. It is built for desktop use and does not support mobile browsers on iOS or Android devices.
No. It operates inside the browser sandbox and does not require elevated system permissions, so standard users can add it themselves without involving IT.
The extension uses TLS only. Protocol switching, which the desktop application offers, is not available in the browser-based version.
It sends traffic for chosen domains outside the encrypted tunnel so those sites are reached directly over the internet. Administrators can exclude up to 100 domains and use wildcards for subdomains, while protocol prefixes such as http or https are not accepted.
Yes, but the extension may take priority for browser traffic while the app handles the rest of the system. Only one proxy-controlling extension should be active at a time.
An organization administrator enables it for a specific gateway in the Control Panel. The gateway needs a server attached, and access is then available to members who install the extension and sign in.
NordLayer Browser is a lightweight, browser-level secure access client that encrypts web traffic through an organization's Virtual Private Gateway, letting teams reach internal resources and SaaS apps without a desktop VPN app or administrator rights.
Neat Download Manager is a free Windows and macOS download accelerator that splits files across multiple connections, resumes broken transfers and grabs video or audio links through its browser extension.
Pritunl Client is a VPN client that connects computers to OpenVPN and WireGuard servers, giving administrators and remote workers one interface for importing profiles, switching organizations, and keeping encrypted tunnels reliably connected.
Surfshark is a VPN service that encrypts internet traffic, masks the user’s public IP address, and combines selective routing, tracker blocking, multi-server connections, and automatic protection for everyday privacy.
NordVPN is a privacy and security application that encrypts internet traffic, masks IP addresses, and helps Windows users access online services through protected VPN connections.
Comments