When a Playwright stealth plugin stops being enough

The real competitor to every paid antidetect browser is not another vendor. It is playwright plus a stealth patch, which is free, open source, and running in production right now for a lot of people who are perfectly happy.

If you are writing a script that scrapes a page once and exits, use the plugin. This post is about the point where that stops being the right answer, and being specific about it, because "you should pay us instead" is not an argument.

What a stealth plugin actually does

It runs JavaScript in the page before your script does, overwriting the properties that give away automation: navigator.webdriver, the missing plugin array, the wrong chrome object, permissions that answer too honestly, a WebGL vendor string that says SwiftShader.

That is a real technique and it works. The weakness is structural: the patch lives in the same JavaScript world as the detector. Anything you overwrite, something else can inspect. Property descriptors, toString output, prototype chains, timing, iframe inheritance, worker contexts. Every browser release changes the surface, and every detector release probes a corner nobody patched.

You end up in a loop: something breaks, you find the new tell, you patch it, you ship. That loop is fine when it is occasional. It is a problem when it is your on-call rotation.

The three things a plugin was never trying to solve

This matters more than the arms race, and it gets discussed less.

Identity does not persist. Stealth patches randomise per launch, which is the opposite of what an account-holding agent needs. Logging in on Monday and acting on Thursday requires being the same machine both times: same canvas hash, same WebGL renderer, same fonts, same audio stack, same timezone. A fresh random fingerprint each run is a new device visiting an old account, which is the pattern the risk engine was built to catch.

Nothing binds a proxy to an identity. Route through a residential IP in Frankfurt and your browser still reports your own timezone, your own locale, and a WebRTC path that does not match. That contradiction is easier to detect than any of the properties the plugin patched. Wiring it up correctly is doable, and it is work you are now maintaining.

Passkeys have nowhere to live. Sites are moving passwordless sign-in from optional to default. A passkey is bound to an authenticator. A script with no authenticator cannot enrol one, and cannot use one the next time, so it is locked out of an account it created itself.

What changes with an engine-level approach

AntiBrow applies the fingerprint inside the browser engine rather than patching from JavaScript in the page. There is no override script for a detector to find, because there is no override script.

Around that sits the part that is honestly just software you would otherwise write: profile storage that survives restarts, a proxy binding that pulls timezone, locale and geolocation from the exit IP automatically, a virtual authenticator per profile that captures and replays passkeys, and a concurrency model.

Automation is unchanged. launch() returns standard Playwright Browser and Page objects:

import { AntiDetectBrowser } from 'anti-detect-browser'

const ab = new AntiDetectBrowser({ key: 'your-api-key' })
const { browser, page } = await ab.launch({ profile: 'agent-01' })

await page.goto('https://example.com')
await page.getByRole('button', { name: 'Sign in' }).click()

Every selector, assertion, network intercept and trace you already wrote keeps working. Only the launch line changes.

When to stay on the plugin

• One-off or short-lived scripts. No identity to maintain, nothing to protect.
• Targets that do not fight back. If nothing is checking, you are solving a problem you do not have.
• You want to own the stack. Some teams genuinely prefer maintaining it, and that is a legitimate call rather than a mistake.

What does not change either way

Neither approach makes detection go away. Proxy quality, behaviour, and the history of the account you bring decide most outcomes. A perfect fingerprint on a burnt residential IP, clicking at machine speed, still gets flagged. Anyone selling you a guarantee is selling.

Find out cheaply

The free tier is unlimited local profiles with one concurrent browser and no card, which is the same price as your current stack. Point a profile at whatever is currently breaking and see whether it survives.

Set it up or read the SDK docs.