cloakbrowser

CloakBrowser

Overview

CloakBrowser is an open-source stealth Chromium binary that passes every major bot detection test — reCAPTCHA v3, Cloudflare Turnstile, FingerprintJS, BrowserScan, you name it. With over 24,000 GitHub stars since its February 2026 launch and nearly 2,000 forks, it’s become the go-to solution for developers who need browser automation that actually works against modern anti-bot systems. The project is maintained by CloakHQ and released under the MIT license.

The key differentiator is architectural. While every other stealth tool — playwright-stealth, undetected-chromedriver, puppeteer-extra — works by injecting JavaScript or tweaking browser flags after the fact, CloakBrowser modifies Chromium at the C++ source level. Fifty-eight patches compiled directly into the binary handle canvas fingerprinting, WebGL rendering, audio context, font enumeration, GPU reporting, WebRTC IP leaks, network timing, and automation signal removal. Detection systems don’t see patched behavior because there’s nothing to detect — the binary is a real browser with slightly different fingerprint values.

The problem it solves is one every web scraping developer knows intimately: you write a Playwright script, it works locally, you deploy it to production, and Cloudflare blocks you within 30 minutes. Or your data pipeline needs to pull pricing information from 500 e-commerce sites, and a quarter of them use FingerprintJS or similar services that flag headless browsers instantly. CloakBrowser fixes this by making your automated browser indistinguishable from a human’s Chrome session, scoring 0.9 on reCAPTCHA v3 (human-level, server-verified) and passing Cloudflare Turnstile without interaction.

Why it matters

The anti-bot detection industry has gotten sophisticated fast. Services like Cloudflare Turnstile, FingerprintJS, Kasada, and Shape Security aren’t just checking navigator.webdriver anymore — they’re analyzing canvas rendering, WebGL output, audio processing, font lists, network timing patterns, and dozens of other signals that JavaScript-level patches can’t reliably spoof. The arms race has escalated to the point where config-level stealth tools break on every Chrome update and require constant maintenance.

CloakBrowser sidesteps this entire arms race by operating at the binary level. When Chromium renders a canvas element, CloakBrowser’s patched code produces output that matches a different GPU profile. When FingerprintJS queries WebGL parameters, it gets real-looking values because they’re generated by modified C++ code, not injected JavaScript. This approach is more robust — it survives Chrome updates because the patches are rebased with each Chromium release (currently on Chromium 146) — and more effective because there’s no detectable patching artifact for anti-bot systems to flag.

For fullstack developers building data pipelines, testing frameworks, or AI agent browser integrations, this is the difference between “works on my machine” and “works in production.” The fact that it’s a drop-in Playwright and Puppeteer replacement means you don’t rewrite your automation code — you swap the import and add a few flags.

Key Features

Source-Level C++ Fingerprint Patches. Fifty-eight patches modify Chromium’s actual rendering and reporting code at the binary level. Canvas, WebGL, audio context, fonts, GPU info, screen properties, WebRTC, network timing, hardware reporting, CDP input behavior — all patched in the compiled binary. This is fundamentally different from JavaScript injection tools that can be detected by checking for patch artifacts. Anti-bot systems see a real browser because the fingerprint generation code itself has been modified.

Humanize Mode. One flag — humanize=True — transforms all mouse, keyboard, and scroll interactions into human-like behavior. Mouse movements follow Bézier curves instead of linear paths. Keyboard input types characters one at a time with realistic timing variance. Scrolling uses natural deceleration patterns. This addresses behavioral detection systems that analyze interaction patterns rather than static fingerprints. The feature scored 24/24 on deviceandbrowserinfo.com’s behavioral bot detection tests.

0.9 reCAPTCHA v3 Score. Server-verified, human-level scoring. Stock Playwright scores 0.1 (definitely a bot). Config-level stealth tools like playwright-stealth typically get 0.3-0.5. CloakBrowser consistently hits 0.9, which is the score a real human Chrome user gets. This matters because reCAPTCHA v3 doesn’t present a challenge — it silently blocks or throttles traffic based on score, so you might not even know you’re being blocked.

Auto-Updating Binary with Zero Config. On first launch, the stealth Chromium binary (~200MB) downloads automatically for your platform and caches locally. Every launch uses the binary with sensible defaults — random fingerprint seed generated at startup, no configuration required. Background update checks ensure you’re always on the latest stealth build. The binary is verified with SHA-256 checksums to prevent tampering.

Native Playwright and Puppeteer API. The Python and JavaScript packages are thin wrappers around the custom Chromium binary. You use the exact same Playwright or Puppeteer API you already know — launch(), new_page(), goto(), click(), all of it works identically. Migrating from stock Playwright is literally a one-line import change. No new API to learn, no configuration files to maintain, no proxy rotation logic built in (bring your own proxies).

GeoIP and WebRTC Leak Prevention. The geoip=True flag auto-detects timezone and locale from your proxy’s exit IP, then sets browser flags to match — no detectable CDP emulation. WebRTC IP spoofing (--fingerprint-webrtc-ip=auto) resolves your proxy’s exit IP and spoofs ICE candidates automatically. Together, these prevent the most common proxy detection vectors where the browser’s timezone doesn’t match its IP geolocation or WebRTC leaks your real IP address.

Browser Profile Manager. A self-hosted alternative to Multilogin, GoLogin, and AdsPower. Spin up the manager with Docker, create browser profiles with unique fingerprints and proxies, and launch them via noVNC in your browser. Free, open source, MIT licensed — no subscriptions or per-profile pricing that commercial antidetect browsers charge.

Use Cases

• Web scraping at scale — Pull data from sites protected by Cloudflare, FingerprintJS, or similar services without getting blocked. The C++ patches handle fingerprint consistency across thousands of pages, and humanize mode prevents behavioral detection during long scraping sessions.

• E2E testing against anti-bot protected sites — Test your application’s flows that pass through Cloudflare Turnstile or reCAPTCHA gates. Stock Playwright fails these tests; CloakBrowser passes them, giving you accurate test coverage for real-world user journeys.

• AI agent browser automation — Integrate with browser-use, Crawl4AI, Scrapling, Stagehand, or LangChain agent frameworks. AI agents that browse the web need stealth to access protected content, and CloakBrowser provides it without changing the agent’s browser interaction code.

• Competitive intelligence and price monitoring — Monitor competitor pricing, product listings, or content changes on sites that actively block scrapers. The persistent profile feature keeps cookies and localStorage across sessions, so login state survives between monitoring runs.

• Multi-account management — Run multiple browser profiles with unique fingerprints simultaneously. Each profile has its own persistent storage, proxy, and fingerprint identity. Useful for managing multiple accounts on platforms that detect shared browser fingerprints.

Pros and Cons

Pros:

• Actually works against modern anti-bot systems. The test results speak for themselves: 0.9 reCAPTCHA v3 score, Cloudflare Turnstile passing, FingerprintJS passing, 30+ detection sites verified. No other open-source tool comes close to these numbers.
• Zero code changes for existing Playwright/Puppeteer projects. Swap the import, optionally add flags, done. This is a massive adoption advantage — you don’t rewrite your automation layer.
• Active maintenance with Chromium version tracking. The project tracks Chromium releases (currently 146) and rebases patches with each update. Unlike stale alternatives like playwright-stealth (last updated months ago), CloakBrowser is actively maintained.
• MIT licensed with no usage limits. No subscriptions, no per-seat pricing, no “community vs enterprise” tiers. The binary auto-downloads on first use and works indefinitely.

Cons:

• ~200MB binary download on first use. The custom Chromium binary is large. In CI/CD pipelines or serverless environments, this adds cold-start time and storage overhead. You can pre-cache it in Docker images, but it’s still a significant dependency.
• Doesn’t solve CAPTCHAs — prevents them. If a site still presents a CAPTCHA despite stealth (rare, but possible with aggressive configurations), CloakBrowser won’t solve it. You’d need a separate CAPTCHA-solving service. The philosophy is prevention over solving, which works 95% of the time but not always.
• Python and JavaScript only. The official packages support Python (pip) and JavaScript/Node.js (npm). Go, Rust, and Java developers would need to manage the Chromium binary and connect via CDP manually, which is doable but not officially supported.

Getting Started

Install CloakBrowser with a single command:

# Python
pip install cloakbrowser

# JavaScript (with Playwright)
npm install cloakbrowser playwright-core

# JavaScript (with Puppeteer)
npm install cloakbrowser puppeteer-core

Replace your existing Playwright import:

# Before
from playwright.sync_api import sync_playwright
pw = sync_playwright().start()
browser = pw.chromium.launch()

# After
from cloakbrowser import launch
browser = launch()

page = browser.new_page()
page.goto("https://example.com")
browser.close()

For sites with anti-bot protection, add proxy and humanize flags:

browser = launch(
    proxy="http://user:***@residential-proxy:port",
    geoip=True,
    headless=False,
    humanize=True,
)

Quick test without installing anything:

docker run --rm cloakhq/cloakbrowser cloaktest

Alternatives

Camoufox — A C++-level stealth browser built on Firefox instead of Chromium. It achieves similar reCAPTCHA scores (0.7-0.9) and has a solid approach to fingerprint randomization. Choose Camoufox if you specifically need a Firefox-based browser or want to avoid Chromium’s market share for fingerprint diversity. However, it’s less actively maintained and has a smaller ecosystem of integrations.

undetected-chromedriver — The original Python stealth Chrome driver that popularized the concept of patching ChromeDriver to avoid detection. It works at the config/flag level rather than source level, which means it breaks frequently when Chrome updates. Still usable for basic anti-detection needs, but it scores 0.3-0.7 on reCAPTCHA v3 and fails Cloudflare Turnstile more often than not. Choose it only if you need a quick, lightweight solution and don’t face aggressive anti-bot systems.

Playwright Stealth (puppeteer-extra-plugin-stealth) — JavaScript injection-based stealth for Playwright and Puppeteer. It patches navigator.webdriver, spoofs plugins, and modifies various browser APIs after launch. The approach is fragile — anti-bot systems specifically check for these injection patterns — and the project has gone stale with infrequent updates. Not recommended for production use against modern detection systems.

Verdict

CloakBrowser is the most effective open-source stealth browser I’ve seen, and the 24,000+ star count in under four months reflects genuine developer demand. The C++ source-level approach is architecturally superior to every JavaScript injection or config-patching alternative, and the test results against 30+ detection services aren’t marketing claims — they’re reproducible. If your fullstack application needs to automate browser interactions against anti-bot protected sites — whether for scraping, testing, or AI agent integration — this is the tool to reach for. The one-line migration from Playwright makes adoption trivial, and the MIT license means no vendor lock-in. The only real tradeoff is the 200MB binary dependency, which is a reasonable price for actually working in production.