Jan is worth considering for desktop drafting and a local writing API, provided you are willing to manage models and connections. Existing users should check the v0.8.8 security update before reconnecting a browser frontend. A working terminal request does not establish that a browser has permission to connect.
This October 29, 2026 revision combines a public-entry check with current official documentation. We did not install Jan, run a model or reproduce the reported fixes.
The official Browser link did not give us a chat workspace
We followed Browser in Jan’s “What is Jan?” handbook. It opened chat.jan.ai, then redirected to the Jan homepage in our desktop browser. We saw download links and a v0.8.8 announcement, with no chat composer.
That is a dated access observation, not proof that browser access is permanently unavailable or identical for everyone. Do not plan a browser-only writing session around that link without checking it first. The desktop client and its local API are a separate setup decision.
Starting the API still requires a loadable local model
Jan’s Local API Server guide says a configured remote provider does not remove the local-model startup requirement. Select a loadable local model in Settings → Local API Server, start the server and confirm its running status.
The documented default base URL is http://127.0.0.1:1337/v1. Keep its /v1 prefix in a compatible client.
There is a hardware catch: the guide currently excludes Intel Macs from local-model operation. On macOS, its documented local paths require Apple Silicon. Check that prerequisite before spending time on frontend configuration.
Diagnose the connection layer before changing models
The v0.8.8 release notes describe browser-origin checks and an effective CORS switch that starts enabled after updating. They distinguish browser requests from requests without a browser Origin, such as ordinary SDK or terminal calls.
The following is a documentation-based diagnosis map, not a set of errors we reproduced:
- Terminal works; browser fails
- Inspect the browser’s origin and Jan’s Trusted Hosts list, then CORS. A successful script does not clear a browser-origin check. Do not replace the model as the first response.
- Neither client connects
- Confirm server status, address, port and API prefix. The API guide distinguishes connection refusal from a missing or incorrect API key; inspect the actual error before editing settings.
- Chat works; MCP tools do not run
- Check who is meant to execute tools. Jan’s server-side execution is a separate opt-in; leave it off when the client handles tool execution.
For a browser frontend you deliberately trust, the release notes document Settings → Local API Server → Trusted Hosts. Allow that specific client rather than loosening access for unrelated sites. We did not edit or verify these controls inside an installed app.
Also distinguish where the browser page is hosted from where the frontend’s server makes API requests. That architecture determines which connection to investigate. The API guide’s loopback default is limited to the same computer; a different device cannot reach that computer through its own 127.0.0.1.
“Local model” does not settle web-search privacy
The Web Search guide documents search enabled by default, a free keyless Exa endpoint and a globe control in the chat toolbar. It also says this built-in search does not require an MCP server.
Keyless search is still an online service. For manuscript work that must stay offline, selecting a local model is only part of the decision. Check search and other connected tools separately. We have not inspected their network traffic or retention behavior.
Jan’s privacy overview describes optional analytics preferences at first launch. That policy statement does not establish the data handling of a separately configured cloud provider or search service.
Two reported update effects matter during troubleshooting
The official 0.8.8 GitHub release reports a fix for model loading under Windows usernames containing non-English characters. It also says old prompt caches are discarded once after the engine update.
If one of those conditions matches an existing problem, record the installed version before renaming accounts, moving files or judging a first post-update request. These are vendor-reported changes, not fixes or performance results we validated.
Next: verify the exact client you intend to use
Start with one harmless fictional paragraph in Jan’s desktop chat. If your real workflow needs a browser frontend, verify that connection separately with the same model and record the result, error and version.
Keep API authentication, browser access and tool execution as separate decisions. A successful reply proves only that tested path works. For other local setups, compare the existing Ollama and LM Studio reviews; neither comparison substitutes for testing your intended client.