Run web automation that bypasses security barriers by mimicking human behavior
If you have struggled to collect data because of security barriers like Cloudflare Turnstile or reCAPTCHA, this tool allows you to pass them naturally. It is a specialized browser created by modifying the Chromium source code itself to avoid being recognized as a bot. You can run a browser that behaves as if a person is moving the mouse and typing, while keeping your existing automation code almost unchanged.
Changing fingerprints at the source code level
Existing stealth tools try to bypass bot detection by injecting JavaScript or adjusting configuration values, but modern security systems easily detect these superficial modifications. This repository takes a different approach. It directly patches 87 points in Chromium's C++ source code to make canvas, WebGL, audio, fonts, GPU, screen resolution, WebRTC, network timing, automation signals, and CDP input behavior appear identical to a real browser. Because these patches are compiled into the binary, detection sites recognize it as an actual Chrome browser. As a result, the navigator.webdriver value is reported as false, and the plugin list and window.chrome object appear the same as in real Chrome.
A single-line setting to make it behave like a human
Simply hiding fingerprints may not be enough. Recent bot detection systems analyze behavioral signals such as mouse movement curves, keyboard typing speed, and scroll patterns. This tool modifies all these interactions to resemble a real user by adding just the humanize=True flag. Mouse movements follow Bezier curves, typing delays vary for each character, and natural scroll patterns are applied to pass behavior-based detection. Additionally, using the geoip=True option automatically detects the proxy IP's location to match the timezone and locale, and automatically blocks IP leaks via WebRTC.
Compatibility with existing code
This tool follows the Playwright or Puppeteer API as is. In existing projects, you only need to change the import from playwright to cloakbrowser. Calling the launch() function returns a standard Playwright Browser object, so all previously used methods like new_page(), goto(), and click() work identically. It can be used in Python, JavaScript, and .NET environments, and the required Chromium binary (approximately 200MB) is automatically downloaded on the first run. It works in Docker containers or VPSs in the same way as in local environments, requiring no additional configuration based on the environment.
License keys and free/paid versions
A license key is required to use the latest Chromium binary. Logging in with a GitHub account issues a free key that allows using the latest build, supporting up to one concurrent session. The Pro version expands concurrent sessions to 5, 20, 200, or more than 2,000, and provides priority access to the latest builds with new patches applied. The free version can use the previous version (v146) published in GitHub releases, but because bot detection technology changes rapidly, older binaries are more likely to be detected. You can register the key with the cloakbrowser login command or by setting the environment variable CLOAKBROWSER_LICENSE_KEY.
Things to check before use
The purpose of this tool is not to solve captchas, but to prevent them from appearing. Therefore, it does not include captcha solving services or proxy rotation features, and you must prepare residential proxies yourself. Using residential IPs rather than data center IPs increases the success rate of detection bypass. Also, since some sites can still detect headless mode, it is safer to use headed mode with headless=False. The binary download verifies the Ed25519 signature to check for tampering, but in security-critical environments, it is recommended to always maintain the latest build. The .NET client is maintained by the community, and Widevine (DRM) support is only available in Linux environments.