These are the browsers whose source you can read: anti-detect forks of Firefox and Chromium, hardened builds pursuing uniformity rather than disguise, and the profile managers built on top of them. Two opposing strategies are filed here side by side, and knowing which one a build is pursuing matters more than any feature list it publishes.
Browsers whose source you can read: anti-detect Firefox and Chromium forks, hardened builds, and the profile managers built on top of them.
Why ACTIVE: pushed_at = 2026-08-12 — 2 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-12
archived
false
latest_release
v152.0.4-beta.28 · 2026-07-19
license.spdx_id
MPL-2.0
stargazers_count
11100
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/daijro/camoufox
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Engine-level patching is the reason this one keeps working when JS-patch stacks stop. The beta tag has been the shipping tag for months; read that as a release policy, not as instability. — ED.
Why ACTIVE: pushed_at = 2026-08-08 — 6 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-08
archived
false
latest_release
151.0.7922.47 · 2026-08-06
license.spdx_id
MIT
stargazers_count
2600
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/botswin/BotBrowser
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
The vendor list in its README is a claim about vendors, not a measurement of them. This catalogue records that the claim is made; it does not repeat it as a result. — ED.
Anti-detect browser and profile manager. Ships the Wayfern Chromium fork, which spoofs at the engine level over CDP rather than by patching JavaScript, plus a local REST API and MCP server on the user's own machine.
Why ACTIVE: pushed_at = 2026-08-12 — 2 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-12
archived
false
latest_release
v0.29.3 · 2026-08-12
license.spdx_id
AGPL-3.0
stargazers_count
3600
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/zhom/donutbrowser
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Both halves are in the repo — the desktop app and the sync server — under AGPL-3.0, and a grep of src/, src-tauri/src and the manifests finds no analytics SDK. Twelve releases between 2026-03-24 and 2026-08-12. Its README's claim about not being detected by named vendors is unsupported by anything in that repo; ignore it and judge the fields. — ED.
Why NRND: pushed_at = 2025-04-25 — 476 days, inside the 365–1095 day NRND band.
Field
Value at this printing
pushed_at
2025-04-25
archived
false
latest_release
—
license.spdx_id
null (none declared)
stargazers_count
850
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/itbrowser-net/undetectable-fingerprint-browser
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
No licence file means no grant of rights, whatever the README implies. Read the state mark and the licence field together before you build on it. — ED.
Why ACTIVE: pushed_at = 2026-08-12 — 2 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-12
archived
false
latest_release
—
license.spdx_id
BSD-3-Clause
stargazers_count
27400
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/ungoogled-software/ungoogled-chromium
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ACTIVE: pushed_at = 2026-08-14 — 0 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-14
archived
false
latest_release
—
license.spdx_id
MPL-2.0
stargazers_count
23300
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/brave/brave-browser
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ACTIVE: pushed_at = 2026-07-23 — 22 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-07-23
archived
false
latest_release
—
license.spdx_id
null (none declared)
stargazers_count
2500
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/mullvad/mullvad-browser
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
No SPDX identifier is declared on the repository; the upstream it derives from is MPL. That is inference, not a field, so the licence column stays empty. — ED.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://www.torproject.org/download/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://support.torproject.org/tor-browser/features/fingerprinting-protections/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: No repository. The link check returned 200 at 2026-08-14T09:12:00Z, and 200–399 is ACTIVE for a non-repository entry.
Field
Value at this printing
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: HEAD https://librewolf.net/
No repository, so there is no API field to re-read from a browser. A cross-origin liveness check has to be made server-side; this entry's status comes from the register's own sweep.
Why ACTIVE: pushed_at = 2026-08-10 — 4 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-10
archived
false
latest_release
—
license.spdx_id
MIT
stargazers_count
12800
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/arkenfox/user.js
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ACTIVE: latest_release.published_at = 2026-08-11 (pushed_at not captured; release date stands in) — 3 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
—
archived
false
latest_release
chromium-v150…-pro · 2026-08-11
license.spdx_id
MIT
stargazers_count
30000
created_at
2026-02-22
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/CloakHQ/CloakBrowser
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Thirty thousand stars on a repository created 2026-02-22 is 173 stars a day sustained across six months. The release history is genuine and the contributor count is real; the star curve is the part this catalogue will not vouch for. Verify independently before you build a pipeline on it. — ED.
Why ACTIVE: latest_release.published_at = 2026-06-21 (pushed_at not captured; release date stands in) — 54 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
—
archived
false
latest_release
v0.1.10 · 2026-06-21
license.spdx_id
MIT
stargazers_count
638
created_at
2026-05-30
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/ProxyShard/ShardBrowser
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Why ACTIVE: pushed_at = 2026-08-13 — 1 days, within the 90-day ACTIVE threshold.
Field
Value at this printing
pushed_at
2026-08-13
archived
false
latest_release
—
license.spdx_id
BSD-3-Clause
stargazers_count
75
created_at
2026-06-15
http_status
200
fetched_at
2026-08-14T09:12:00Z
rubric_edition
2nd, in force
Endpoint: GET https://api.github.com/repos/clearcotelabs/clearcote-browser
unauthenticated · 60 req/hr
A live read does not change what is printed above it. The site records that you ran it; what GitHub returned is not kept. The printed state moves only when the register is swept and a new printing is issued. raw JSON
Uniformity or randomisation — the split that runs through this section
There are only two coherent answers to the fingerprinting problem and they contradict each other. The first is uniformity: make every user of this build present identical readings, so that being identified as a user of the build tells an observer nothing about which user. The second is randomisation: make every reading different, per session or per origin, so there is no stable value to link across visits.
Both are represented here, and neither is free. Uniformity costs usability — fixed window sizes, letterboxed viewports, disabled surfaces — and only protects you inside a crowd large enough to hide in. Randomisation costs coherence, and the literature filed in section 05 includes an explicit finding that some randomisation strategies make a browser more identifiable rather than less, because visibly randomising is itself a signal. A build that does not say which one it is pursuing has usually not decided.
Where the spoofing happens, and why the layer matters
The other axis worth reading these entries on is the layer at which values are changed. A stack that patches JavaScript from inside the page has to overwrite getters after the document exists, which leaves a residue: a property whose own source no longer looks native, a worker that was never patched, an iframe created before the script ran. A build that changes values in the engine has no such residue, because there is nothing to overwrite — the value is simply produced differently.
That distinction is the reason several entries here are full browser forks rather than extensions, and it is expensive: a fork has to track upstream releases forever, which is why the push dates in this section are worth more attention than in any other. A fork that stops tracking upstream is a browser presenting a version string it can no longer honour.
State marks used in this section
ACTIVE — Shipping. Safe to build on today.
13 here
NRND — Not Recommended for New Designs. Works; do not start here.
1 here
Questions about open-source anti-detect browsers
Answered from the fields printed above, and from nothing this register has not checked.
What is the best open-source anti-detect browser?
This register does not rank, because it has tested no tool and publishes no score. What it prints for every entry in this section is the licence, the last push, the latest tagged release and a derived maintenance state, so the comparison you make is between dated facts rather than between marketing claims.
Is a hardened browser the same as an anti-detect browser?
No, and conflating them is the most common mistake in this section. A hardened build removes telemetry and reduces attack surface, which makes it quieter but not less identifiable. An anti-detect build changes what a page reads. Several entries here do the first and are filed as a clean base to start from rather than as a defence.
Do any of these browsers get past a particular anti-bot vendor?
Nothing on this site answers that. No entry here has been tested against Cloudflare, DataDome, Kasada or anyone else by this register, and where a project's own README claims it is undetected, this catalogue records that the claim was made and does not repeat it as a finding.
Donut Browser is filed in section 01 of this same catalogue, under the
same rubric, with the same fields printed against it and no exemption:
an open-source anti-detect browser under AGPL-3.0 whose Wayfern Chromium
fork applies fingerprint overrides at engine level over CDP rather than
by patching page JavaScript, with a local REST API and MCP server on your
own machine, self-hostable sync, zero telemetry, and a pre-launch gate
that refuses to start a profile when the proxy's exit geography
contradicts the profile's fingerprint. It is judged here the same way
everything in this section is judged.