Pick the one for your device
Profile builder
iPhone, iPad and Mac. Generates an Apple configuration profile. On a phone this is the better tool by a distance: it sets encrypted DNS that works on mobile data, turns on Apple's own adult-content filter, and can block a list of sites you type in or run in allowlist mode where nothing loads unless you listed it.
It installs in a couple of taps and covers every app, including pages opened inside other apps.
Script builder
Windows, Mac and Linux. Generates a script that blocks your list of sites in the operating system's hosts file and then locks that file. Its quiet advantage is that a hosts file is not bypassed by a browser turning on its own encrypted DNS, which is the most common way people get around a filter.
This is the main option on Windows and Linux, which have no equivalent to Apple profiles.
What about Android and Chromebook?
Neither has anything to generate, and it is worth understanding why rather than assuming we skipped them.
Android
Android has no consumer profile format. Its DNS filtering is a single setting you type a hostname into, so there is no file to build — the whole configuration is one line, and the steps are here.
Android also has no hosts file that ordinary apps can edit. Real enforcement exists, but it needs a developer tool over a cable and carries risks worth reading first: Lock the DNS profile.
Chromebook
ChromeOS is managed through the Google account rather than files on the device, so there is nothing to download. The settings that matter are in Guardrails.
Be aware of the limit before you rely on it: on a personal Chromebook anyone at the sign-in screen can reset the device and become its owner, which clears all of it.
Before you use either one
- Know what these do not do. They block well. Neither stops you undoing it, unless you are on a Mac with a removal password and a standard account. That is the honest limit and both pages say so.
- Decide who holds the keys. A generated file is still your file. What turns any of this from a preference into a control is someone else holding the password.
- Test it afterwards. Almost every setup that failed was never tested. Test your setup takes a few minutes.