CloakBrowser: Open-Source Stealth Browser for Web Automation

What Is CloakBrowser?

CloakBrowser is an open-source Anti-Detect Browser from SalhaNabil that ships a modified Chromium binary for developers who need Playwright or Puppeteer sessions to survive bot checks. It is one of the best Anti-Detect Browsers tools for developers and indie hackers automating Cloudflare Turnstile, FingerprintJS, BrowserScan, and reCAPTCHA-gated flows, and the repo advertises 49 source-level C++ patches plus a 0.9 reCAPTCHA v3 score.

The important detail is that CloakBrowser does not try to hide automation with a thin wrapper or a JS-only patch layer. It changes the browser fingerprint at the source level, which is exactly what anti-bot systems inspect when they compare canvas, WebGL, audio, fonts, GPU, WebRTC, and timing signals.

Quick Overview

Who Should Use CloakBrowser?

• Automation engineers building login, checkout, or QA flows that break on standard Chromium fingerprints.
• Indie hackers scraping or testing sites behind Cloudflare Turnstile, FingerprintJS, or BrowserScan without rewriting their browser code.
• Security and growth teams validating anti-bot defenses from the attacker side so they can measure what actually gets detected.
• Python and JavaScript teams that already know Playwright or Puppeteer and want a drop-in browser swap instead of a full rewrite.

Not ideal for:

• Teams that only need ordinary browser automation and do not face bot detection.
• Users who want a managed SaaS proxy stack with support SLAs and policy controls.
• Projects that cannot tolerate the maintenance cost of tracking Chromium changes and stealth regressions.

Key Features of CloakBrowser

• Source-level fingerprint patches — CloakBrowser changes Chromium internals instead of relying on runtime monkey-patching. The repo lists canvas, WebGL, audio, fonts, GPU, screen, WebRTC, network timing, automation signals, and CDP input behavior among the modified surfaces.
• Drop-in Playwright/Puppeteer replacement — The API is designed to stay close to the standard automation mental model, so teams can swap imports instead of rewriting the entire test or scraping stack. That matters when your existing scripts already handle selectors, navigation, and assertions.
• Humanized input mode — humanize=True adds mouse curves, keyboard timing, and scroll patterns that look like a person instead of a tight event loop. That helps on sites that score interaction quality, not just browser fingerprints.
• Detector coverage beyond one vendor — The project claims successful tests against Cloudflare Turnstile, FingerprintJS, BrowserScan, and 30+ detection sites as of Feb 2026. That breadth matters because a browser that only beats one vendor usually fails the next one.
• Auto-updating binary — CloakBrowser checks for updates in the background and keeps the stealth build current. This reduces the risk of shipping an old Chromium fingerprint that anti-bot vendors already cataloged.
• Python and JavaScript installation paths — The project supports pip install cloakbrowser and npm install cloakbrowser, which keeps it usable from both backend automation scripts and Node-based browser runners. That is useful if one team writes test harnesses in Python while another uses JavaScript.
• Headed and headed-test friendly — The project shows headed-mode passing tests, which is important because some detection stacks score headless sessions differently. If a target is sensitive to window behavior, CloakBrowser gives you a browser that can present a normal UI profile.

CloakBrowser vs Alternatives

Pick CloakBrowser when the browser itself is the thing getting flagged and you need fewer code changes. If your target site is normal and you just need reliable automation, OpenTrace is useful for debugging the surrounding request and browser behavior, while Playwright or Puppeteer are still the cleaner default.

Pick Playwright when you want the broadest standard automation API, browser coverage, and test ergonomics without stealth constraints. Pick Puppeteer when your stack is already Chrome-only and you want a smaller surface area.

Pick undetected-chromedriver when your system is built around Selenium and you only need to harden ChromeDriver sessions. If you are orchestrating many browser tasks, OpenSwarm pairs better with a larger automation workflow, while CloakBrowser handles the session that needs stealth.

How CloakBrowser Works

CloakBrowser works by moving stealth from the JavaScript layer down into the browser build itself. Instead of faking fingerprints after the page loads, it compiles a patched Chromium where detection-relevant surfaces already look normal before any page script runs.

That design matters because modern bot defenses inspect more than navigator.webdriver. They correlate canvas output, WebGL vendor strings, audio fingerprints, font enumeration, screen metrics, GPU behavior, WebRTC hints, network timing, and CDP-driven input patterns against known automation signatures. CloakBrowser's 49 patches attack those surfaces directly, which is why the project can claim higher pass rates than a patched config or a JS injection layer.

The browser is meant to stay compatible with the Playwright/Puppeteer workflow that developers already know. You still launch a browser, open a page, and drive it with the same mental model; the difference is that CloakBrowser adds behavioral smoothing and a less suspicious fingerprint at the browser boundary.

from cloakbrowser import launch

browser = launch(headed=True, humanize=True)
page = browser.new_page()
page.goto('https://bot.sannysoft.com')
print(page.title())

That snippet launches the stealth browser, enables human-like behavior, and opens a public fingerprint test page. Expect the first run to take longer because the binary is downloaded automatically, then cached locally for later runs.

Pros and Cons of CloakBrowser

Pros:

• Source-level stealth reduces reliance on brittle JS patches and post-load hacks.
• Drop-in workflow keeps existing Playwright or Puppeteer code largely intact.
• Behavioral humanization helps when the target scores interaction timing, not just browser headers.
• Broad detector coverage is reported against Turnstile, FingerprintJS, BrowserScan, and other test sites.
• Auto-updating binary lowers the chance of running a stale Chromium build with a known fingerprint.
• Open-source access removes subscription cost and lets teams inspect the implementation.

Cons:

• Chromium maintenance overhead is real because every upstream browser update can shift internals.
• Not every anti-bot stack is equal; a site can still flag proxies, account history, or IP reputation even if the browser fingerprint passes.
• Limited ecosystem compared with Playwright because the niche is stealth-first, not general-purpose automation.
• More operational risk than vanilla browser automation because stealth tools can break unexpectedly after upstream security changes.
• Potential compliance concerns exist if you use CloakBrowser against sites that forbid automated access.

Getting Started with CloakBrowser

The fastest path is to install the package, let it pull the browser binary, and run a fingerprint test before wiring it into production code. CloakBrowser supports both Python and JavaScript entry points, so choose the runtime that matches your existing automation stack.

pip install cloakbrowser
python - <<'PY'
from cloakbrowser import launch

browser = launch(humanize=True)
page = browser.new_page()
page.goto('https://bot.sannysoft.com')
print(page.title())
PY

After the first run, CloakBrowser should have a cached binary and a local profile path ready for reuse. If your target is sensitive, start with a public detection page first, then move to your real site only after you confirm that browser fingerprinting and input behavior look stable.

Verdict

CloakBrowser is the strongest option for browser automation against fingerprint checks when you need a drop-in Playwright or Puppeteer workflow instead of rewriting scripts. Its biggest strength is source-level Chromium stealth; the main caveat is ongoing browser maintenance and the fact that IP reputation can still sink a session. Use it when fingerprint evasion matters more than broad browser generality.