Guides

Stealth Mode

SessionKit applies anti-detection patches at multiple layers to make automated browsers indistinguishable from real users. Choose from three stealth levels depending on your target.

Stealth Levels

Level Description Use Case
none No stealth patches applied Testing, internal tools
basic Hides common automation signals Low-security sites
max Full anti-detection suite Anti-bot protected sites (Cloudflare, DataDome, PerimeterX)

Tip: Use max stealth by default. The performance overhead is negligible (~50ms added to session launch).

What max Stealth Does

When you set stealth: 'max', SessionKit applies:

  • Removes navigator.webdriver flag
  • Spoofs navigator.plugins (mimics real Chrome plugin list)
  • Patches navigator.languages to match fingerprint locale
  • Spoofs navigator.hardwareConcurrency and navigator.deviceMemory

WebGL Fingerprint

  • Renders unique WebGL canvas hashes per session
  • Spoofs GPU vendor and renderer strings
  • Randomizes WebGL parameters within realistic bounds

Canvas Fingerprint

  • Adds subtle noise to canvas rendering
  • Each session produces a unique canvas hash
  • Noise is consistent within a session (doesn't change between calls)

Timing Attacks

  • Patches performance.now() to add realistic jitter
  • Randomizes event timing patterns
  • Spoofs Date.now() precision

Chrome Internals

  • Patches chrome.runtime to appear as a real extension environment
  • Spoofs window.chrome object structure
  • Hides DevTools protocol indicators

Configuration

const session = await sk.sessions.create({
  stealth: 'max',
  fingerprint: {
    platform: 'MacIntel',
    userAgent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...',
    locale: 'en-US',
    timezone: 'America/New_York',
    viewport: { width: 1920, height: 1080 },
  },
})

Verifying Stealth

You can verify your stealth configuration against popular detection tools:

const page = await browser.newPage()

// Test against CreepJS
await page.goto('https://abrahamjuliot.github.io/creepjs/')
await page.waitForTimeout(5000)
const score = await page.$eval('.grade', el => el.textContent)
console.log(`CreepJS trust score: ${score}`)

// Test against BotD
await page.goto('https://fingerprint.com/products/bot-detection/')

Stealth vs. Performance

graph TD
    A[stealth: none] -->|+0ms| B[Session Ready]
    C[stealth: basic] -->|+20ms| B
    D[stealth: max] -->|+50ms| B

The added latency is a one-time cost during session creation. Runtime performance is identical across all stealth levels.