Smorster

CloakBrowser: when open-source destroys SaaS pricing

Indie Hacker News · 6m 01s · Watch on YouTube · 19 sources

Decision Card

Effort: Weekend evaluation — pip install cloakbrowser (or npm), swap one import in an existing Playwright scraper, and run it against browserleaks.com plus your actual target site to see if the block goes away; the binary auto-downloads (~200 MB) on first launch.

Honest take: The video frames CloakBrowser as “MIT licensed, fully free, suddenly free forever,” but that’s the late-April snapshot — the live repo now runs a delayed-release model where only the older Chromium build (v146) is free and current builds (v148+) sit behind a Pro subscription. The truly stealthy part is monetized, so the “kills a $50/month category for free” thesis is already softening. Also note the “receipts” (star counts, 30/30 pass) are the project’s own self-reported numbers, not independent audits.

Concrete next steps:

  • Clone github.com/CloakHQ/cloakbrowser and confirm which Chromium version is on the free tier before betting a pipeline on it (~15 min).
  • Compare against Camoufox (Firefox-based, source-level, genuinely MIT/free) if you want a no-paywall option (~1 hr eval).
  • Skip if your targets throw hard interactive CAPTCHAs — CloakBrowser prevents challenges from appearing but does not solve them; you still need a separate solver and your own proxy rotation.

TL;DR

CloakBrowser is an open-source stealth Chromium fork claiming to patch fingerprint surfaces at the C++/binary level while keeping the native Playwright/Puppeteer API, positioned as a free replacement for $50–$300/month anti-detect browsers. It’s real and technically credible, but the current repo has shifted to a free-old-build / paid-current-build model, undercutting the video’s “suddenly free” pitch.

Key Points

  • Commercial anti-detect browsers (Multilogin, GoLogin, AdsPower) charge $50–$300/month to make bots look human to Cloudflare and reCAPTCHA 00:08
  • CloakBrowser is a custom Chromium binary with source-level patches, MIT-licensed, drop-in compatible with Playwright and Puppeteer 00:27
  • Claims 30/30 pass against bot-detection sites including Cloudflare Turnstile and FingerprintJS, with a new rebase roughly every 2 weeks 00:35
  • Migration is a one-line import swap; existing scraper code otherwise unchanged 01:05
  • Positioned as first to do source-level Chromium patches while keeping the native Playwright API — prior tools either inject JS (Playwright Stealth), patch detectable flags (undetected-chromedriver), or fork Firefox and break the API (Camoufox) 02:11
  • Self-reported receipts: 9.4k stars in 12 weeks, 57 compiled patches, reCAPTCHA v3 score of 0.9 (human band) 02:21
  • Patches cover canvas, WebGL, audio context, fonts, GPU strings, WebRTC ICE candidates, hardware concurrency — all modified at binary level 02:46
  • humanize=True adds Bézier mouse paths, per-character keyboard timing, realistic scroll; proxy stack has native SOCKS5 UDP associate, WebRTC IP spoofing, GeoIP auto-detect 03:17
  • Honest trade-offs: does not solve CAPTCHAs (only suppresses them), proxy rotation not bundled, you accept the legal risk 05:21

Notable Quotes

“It is a custom chromium binary with source-level patches compiled in MIT licensed drop-in compatible with Playwright and Puppeteer.” 00:27

“Cloak Browser is the first project to do source level patches on Chromium while keeping the native Playwright API. That is the whole reason it broke through.” 02:11

“This thing does not solve captchas. It just prevents most of them from showing up. So, the hard challenges still need a separate solver.” 05:21

Verified Claims

Claim: CloakBrowser is a source-level-patched Chromium, drop-in Playwright/Puppeteer replacement. 00:27

Claim: MIT-licensed and “suddenly free” replacement for paid anti-detect browsers. 00:23

  • Sources: CloakHQ/cloakbrowser GitHub
  • Verdict: Disputed — wrapper is MIT, but the current repo runs a delayed-release model: older Chromium build (v146) free, current builds (v148+) require a Pro subscription. The most-stealthy current binary is not free.

Claim: ~9.4k stars in 12 weeks; 57 patches (video). 02:21

  • Sources: CloakHQ/cloakbrowser GitHub
  • Verdict: Inconclusive — repo now shows ~28.6k stars and 71 patches, i.e. numbers grew past the video’s snapshot; the video-era figures can’t be re-verified but trend is consistent (self-reported).

Claim: reCAPTCHA v3 score of 0.9, the human band. 02:32

Claim: Prior open-source tools each have a structural flaw — undetected-chromedriver’s patched flags are themselves detectable. 01:54

Claim: “Camouflage” does source-level work but forks Firefox, so the API isn’t Playwright. 02:04

  • Sources: daijro/camoufox GitHub, camoufox.com/stealth
  • Verdict: Disputed on details — the real project is Camoufox (not “Camouflage”), and it does patch Firefox/Gecko at C++ level, but it actually exposes a Playwright-compatible API, contradicting the video’s “you rewrite your scraper” claim.

Claim: Commercial anti-detect browsers charge $50–$300/month. 00:14

Tools, Papers & Standards Mentioned

Follow-up Questions

  1. When did CloakBrowser move from “fully free MIT” to the free-old-build / paid-Pro model, and does that make it functionally another paid anti-detect browser for anyone needing current Chromium?
  2. Has any independent researcher (not the project itself) reproduced the 30/30 pass and 0.9 reCAPTCHA score against live enterprise anti-bots like DataDome or Akamai?
  3. How long does a source-level patched Chromium stay undetected once anti-bot vendors fingerprint the specific rendering artifacts its patches introduce — i.e., does the same arms-race that broke undetected-chromedriver eventually catch binary-level forks?

Sources