Camoufox: the anti-detect browser for undetected scraping

Most scrapers die the same way. You write a clean Playwright script, it works great for a day, then the target starts serving CAPTCHAs, blank pages, and 403s. Nine times out of ten the problem isn't your code. It's that headless Chrome leaks a dozen signals that quietly announce "a bot is driving this," and modern anti-bot vendors read every one of them.

Camoufox is one of the better answers to that problem. It's an open-source browser built for a single job: automate the web without getting flagged.

What Camoufox actually is

Camoufox (people constantly misspell it "camofox") is a custom build of Firefox that hides the fact it's being automated. It's maintained by a developer who goes by daijro, shipped under the Mozilla Public License 2.0, and it costs nothing.

Here's the part that matters. Most stealth tools patch a running browser from the outside. They inject JavaScript that overwrites navigator.webdriver, fakes a handful of properties, and hopes nobody looks too closely. Camoufox goes the other way. The spoofing is compiled into the browser itself, down at the C++ level, so the values a site reads back look native because they basically are. There's no evasion script sitting in the page for a detector to trip over.

It talks to your code through a modified version of Firefox's Juggler protocol, kept isolated from the page, so the automation channel stays invisible to JavaScript running on the site. In plain terms: the website can't see the strings that usually give a bot away.

Camoufox vs Selenium, undetected-chromedriver, and playwright-stealth

You can absolutely scrape with plain Selenium or Playwright. For a site with no bot protection, that's the right call, and reaching for anything fancier is a waste of time. The trouble starts on protected targets.

Tools like undetected-chromedriver and playwright-stealth help, but they share a structural weakness. Because they patch things from JavaScript, a determined detector can catch them. Overwrite a native function and its toString() stops reading [native code]. Redefine a property and the descriptor looks wrong. Anti-bot services like Cloudflare, DataDome, and friends test exactly those tells. And headless Chromium is the single most-scrutinized setup on the web: it exposes Chrome DevTools Protocol artifacts, renders canvas a little too consistently, and generally draws more heat than anything else.

Firefox gets less attention by default, and Camoufox strips the automation tells at the source instead of painting over them. That's the whole pitch.

Install it

Two commands. The Python package, then the patched browser binary:

pip install -U camoufox[geoip]
python3 -m camoufox fetch

The [geoip] extra pulls in a location dataset (roughly 50 MB) that maps an IP to a timezone, locale, and coordinates. Skip it and you'll get an InvalidDatabaseError the first time you use geoip=True, so just install it now. The fetch step downloads the actual Camoufox build, a debloated Firefox around 200 MB with telemetry stripped and uBlock Origin bundled in. On Windows, drop the python3 -m and run camoufox fetch directly.

A minimal working Python example

If you've written Playwright before, this will look boringly familiar, and that's the point. Camoufox is a drop-in. Same page objects, same methods.

from camoufox.sync_api import Camoufox

with Camoufox(headless=True) as browser:
    page = browser.new_page()
    page.goto("https://www.browserscan.net/")
    page.screenshot(path="fingerprint.png")
    print(page.title())

That opens the stealth browser, loads a fingerprint-checking site, and saves a screenshot so you can see what your bot looks like from the outside. Prefer async? Swap in from camoufox.async_api import AsyncCamoufox and await the calls. Every Playwright action you know, clicking, typing, scrolling, waiting for selectors, works unchanged.

Fingerprints, OS spoofing, and humanized cursors

A few constructor options do most of the heavy lifting:

from camoufox.sync_api import Camoufox

with Camoufox(
    os=("windows", "macos"),   # pick the fingerprint OS at random
    humanize=True,             # curved, human-like cursor paths
    block_images=True,         # skip images to load faster
) as browser:
    page = browser.new_page()
    page.goto("https://example.com")

os controls which operating system your fingerprint claims to be, and you can hand it a list to rotate. humanize replaces robotic straight-line mouse jumps with curved paths that look like a hand moved them; pass a number like humanize=1.5 to cap how long a movement can take.

Anything you don't set gets filled in for you. Camoufox leans on BrowserForge to generate the rest of the fingerprint from real-world device distributions, so your fake screen size, WebGL vendor, and fonts land inside the range of actual traffic instead of sticking out as a weird outlier. That's a big deal. A "perfect" fingerprint that nobody in the real world has is its own red flag.

Pairing it with residential proxies

Read this part twice, because it's the mistake everyone makes first. Camoufox spoofs the browser, not your IP address. Run it straight off your server and the target still sees your datacenter IP, which is often enough to get blocked before your beautiful fingerprint even matters.

So you route it through a proxy, and for anything serious that means residential proxies, real IPs assigned to home internet connections. Camoufox takes a proxy the same way Playwright does, and geoip=True is the setting that makes the two line up:

from camoufox.sync_api import Camoufox

with Camoufox(
    geoip=True,
    proxy={
        "server": "http://gate.example-proxy.com:8080",
        "username": "user",
        "password": "pass",
    },
) as browser:
    page = browser.new_page()
    page.goto("https://www.browserscan.net/")

With geoip=True, Camoufox looks up the proxy's exit IP and sets the browser's timezone, locale, language, and geolocation to match it. Why bother? Because sites cross-check your IP's location against your browser's timezone and language. A residential IP in Frankfurt paired with a browser set to America/New_York is a dead giveaway, and the block comes with no warning. Matching them removes one of the easiest catches in the book.

Common pitfalls

A few things that bite people, roughly in the order they'll bite you:

• No proxy, no point. Worth repeating. The stealthy browser still leaks your real IP unless you put a proxy in front of it.
• It's Firefox, not Chrome. Almost every site renders the same, but a small number lean on Chromium-only APIs or behave differently on Firefox. If a specific target acts weird, that's usually why.
• Humanized cursors aren't full behavior. The humanize flag fixes mouse paths. It doesn't randomize your request timing, scroll rhythm, or click cadence. On aggressive targets you still need to add those yourself.
• Headless on a bare server. Make sure you ran fetch and that the box has the system libraries Firefox needs. On Linux, headless="virtual" runs the browser on a virtual display, which some detectors trust more than pure headless mode.
• It's still pre-1.0. The project is under active development and the author says so plainly. Pin your version in production and expect the odd breaking change between releases.

Even with the browser sorted and proxies in place, some targets will still throw a CAPTCHA at you, especially on login or checkout flows. Camoufox often slides past invisible challenges because it's a genuine browser, but the visible ones are a different problem, and hand-solving them doesn't scale.

When it's overkill

Camoufox is the right tool less often than the hype suggests. Don't reach for it when:

• The site has no bot protection. Plain Playwright, or even requests plus a parser, is faster and simpler. Stealth you don't need is just overhead.
• There's an API or JSON endpoint. If the data comes from a call you can hit directly, don't run a whole browser to click around the page. Grab the JSON.
• It's a one-off. For a single small pull, a paid anti-detect browser with a GUI, or honestly just doing it by hand, beats standing up a headless pipeline.

That last case is where paid anti-detect browsers earn their keep: managing many accounts by hand, each with its own persistent profile, through a point-and-click interface. That's a different job from headless scraping at scale, and it's worth knowing which one you're actually doing.

FAQ

Is Camoufox free?

Yes. It's open source under the Mozilla Public License 2.0. No license fee, no seat count.

Is web scraping with Camoufox legal?

Scraping publicly available data is broadly legal in a lot of places, but it isn't a blank check. A site's terms of service, its robots rules, rate limits, and privacy law all still apply, and they vary by where you and the site sit. This isn't legal advice. If a project is high-stakes, talk to a lawyer before you point a scraper at someone's servers.

Camoufox vs playwright-stealth: which should I use?

For light detection, playwright-stealth is quick and fine. For targets with real anti-bot vendors in front of them, Camoufox's binary-level spoofing holds up better than JavaScript patches that a detector can inspect. Start simple, and move to Camoufox when you're actually getting blocked.

Do I still need proxies if I use Camoufox?

For anything protected, yes. Camoufox hides that you're automating a browser. It does nothing about your IP. Residential proxies handle that half.

Does it work headless on a server?

It does. Run python3 -m camoufox fetch on the box, make sure Firefox's system libraries are present, and use headless=True or headless="virtual" on Linux.