8 entries in this register are declared substitutes for, successors to or predecessors of Camoufox, and 7 of them are still shipping at the last field check. Camoufox itself reads ACTIVE, and 1 of the candidates carry a state mark other than ACTIVE or SEMI, which is the part a list without check dates cannot tell you. Every row is judged by the same rubric, from the same sweep, on the same fields.
Every row below is judged by the same rule as Camoufox itself, from the
same field check. Supersession is only printed where a project or its
author says so — this register does not infer that one tool replaces
another because it is newer.
Read the state column with the licence column. A permissively licensed
project that stopped shipping is not safer than a copyleft one that did
not.
What Camoufox does, so you know what you are replacing
Camoufox edits Firefox's own C++ sources so the values a page reads are produced by the engine itself. Nothing is overwritten after the fact by injected script, which removes the whole class of tell where a property getter's own source no longer looks native.
A substitute has to do that job, not merely occupy the same category. It tracks one Firefox release line at a time, so the build you compile decides which surfaces are covered and which browser version you are presenting as. Read the Python launcher's fingerprint options rather than assuming the defaults describe a coherent device.
How this register decides what counts as an alternative
Nothing on this page is a ranking, a score or a recommendation, and nothing on it is a detection-test result — no entry in this register has been run against any anti-bot system by this register. What the table gives you is four measured columns and one derived one, applied identically to every row.
How to read the comparison above
7 of the 8 candidates read ACTIVE or SEMI and 1 do not. Start by reading the state column, then read the last-push and latest-release columns against each other, because they answer different questions: a push says somebody is there, and a tag says there is something you can pin a dependency to.
2 of the entries in the table declare no licence at all — Mullvad Browser, Undetectable Fingerprint Browser. Read that column before the state column if you intend to ship anything: an absent licence file is an absent grant, and no amount of recent activity substitutes for one. Every no-licence entry in the register is grouped together for the same reason.
Why ACTIVE: pushed_at = 2026-08-08 — 6 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-08
archived
false
latest_release
151.0.7922.47 · 2026-08-06
license.spdx_id
MIT
stargazers_count
2600
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/botswin/BotBrowser
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
The vendor list in its README is a claim about vendors, not a measurement of them. This catalogue records that the claim is made; it does not repeat it as a result. — ED.
Commercial anti-detect browser aimed at affiliate and multi-account teams.
https://dolphin-anty.com/ — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://dolphin-anty.com/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Anti-detect browser and profile manager. Ships the Wayfern Chromium fork, which spoofs at the engine level over CDP rather than by patching JavaScript, plus a local REST API and MCP server on the user's own machine.
Why ACTIVE: pushed_at = 2026-08-12 — 2 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-12
archived
false
latest_release
v0.29.3 · 2026-08-12
license.spdx_id
AGPL-3.0
stargazers_count
3600
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/zhom/donutbrowser
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Both halves are in the repo — the desktop app and the sync server — under AGPL-3.0, and a grep of src/, src-tauri/src and the manifests finds no analytics SDK. Twelve releases between 2026-03-24 and 2026-08-12. Its README's claim about not being detected by named vendors is unsupported by anything in that repo; ignore it and judge the fields. — ED.
Commercial anti-detect browser with public API documentation.
https://gologin.com/ — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://gologin.com/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Commercial anti-detect browser; documentation lives on help.kameleo.io, not /docs.
https://kameleo.io/ — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://kameleo.io/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: pushed_at = 2026-07-23 — 22 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-07-23
archived
false
latest_release
—
license.spdx_id
null (none declared)
stargazers_count
2500
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/mullvad/mullvad-browser
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
No SPDX identifier is declared on the repository; the upstream it derives from is MPL. That is inference, not a field, so the licence column stays empty. — ED.
The long-running commercial incumbent; the product most open-source entries are positioned against.
https://multilogin.com/ — printed, not linked
Evidence
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://multilogin.com/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why NRND: pushed_at = 2025-04-25 — 476 days, inside the 365–1095 day NRND band.
Field
Value at this printing
pushed_at
2025-04-25
archived
false
latest_release
—
license.spdx_id
null (none declared)
stargazers_count
850
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/itbrowser-net/undetectable-fingerprint-browser
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
No licence file means no grant of rights, whatever the README implies. Read the state mark and the licence field together before you build on it. — ED.
Answered from the same fields the table above prints, and from no other source.
What is the best alternative to Camoufox?
This register does not answer that, because it publishes no ranking and has tested no tool to rank. What it can tell you is which candidates are still shipping: BotBrowser, Dolphin Anty, Donut Browser, GoLogin, Kameleo, Mullvad Browser, Multilogin. The rest of the decision is fit, licence and how much of your own stack you are prepared to change.
Are these Camoufox alternatives still maintained?
BotBrowser reads ACTIVE, Dolphin Anty reads ACTIVE, Donut Browser reads ACTIVE, GoLogin reads ACTIVE, Kameleo reads ACTIVE. Each of those states is derived from that entry's own measured fields by the rubric in force, at the field check printed in the folio, and the clause that produced it is printed on the entry page.
Why does this list not rank the alternatives?
Because a ranking would be an opinion wearing a number's clothes. Every figure on this site is a date, a count, an SPDX identifier or an HTTP status you can re-fetch from the endpoint named beside it, and there is no honest way to compress those into an ordering without inventing weights nobody published. The rubric sets states; it does not rate them against each other.
Where does the alternatives data for Camoufox come from?
From declared edges in the register itself, never inferred. Each edge is stored once and reversed at build time, and every field in the table is read from the same sweep that produced the rest of the catalogue. The whole set is downloadable as CC0 JSON and CSV, including the supersedes, superseded_by and alternative_to columns.
You are reading section 01, which is where the browsers live, so the comparison is direct: Donut Browser is filed here too, under the same rule, with the same fields printed against it. What it does differently is where the spoofing happens — the Wayfern Chromium fork applies fingerprint overrides at engine level over CDP rather than by patching page JavaScript after load, which is the same architectural argument several of its neighbours in this section make and a different implementation of it.