Donut Browser
Donut
Get Started

AGPL-3.0 · Source on GitHub

The open source antidetect browser you can rebuild yourself

Yes, one exists. Donut Browser is an open source antidetect browser: the app you actually run — profile manager, local REST API, MCP server and sync service — is published under AGPL-3.0 at github.com/zhom/donutbrowser, with zero telemetry and no account required. One part is not open: the Wayfern Chromium engine underneath is proprietary. That split is the honest answer, and this page shows you how to check both halves yourself.

View the source on GitHub Read the AGPL-3.0 licence Download Donut Browser
Licence
AGPL-3.0 — app, local API, MCP, sync
Source
github.com/zhom/donutbrowser
Telemetry
None. No account to start.
Not open source
The Wayfern Chromium engine

"Open source" is a word an anti-detect vendor can put on a landing page without publishing a line of code, so the useful question is not whether a product says it, but what you can open. On the pages read on 6 August 2026, GoLogin, Multilogin, Dolphin Anty and AdsPower named no open-source licence and no public source repository anywhere on their homepages or pricing pages. That is not an accusation of anything — it is simply the reason this search term has so few real answers.

Donut Browser has a repository, a licence file and build instructions. The profile manager you click, the local REST API on 127.0.0.1:10108, the MCP server and the sync service are all in it, under AGPL-3.0. You can clone it, read it, change it, and build the application yourself.

It would be easy to stop there and let you assume the whole product is open. It is not. The Wayfern Chromium engine that renders pages and enforces fingerprint spoofing is proprietary, and this page repeats that in every section it is relevant to — because a claim about auditability is worth exactly as much as the honesty of the person making it.

Key Takeaways

  • The Donut Browser app is licensed AGPL-3.0 and its source is at github.com/zhom/donutbrowser. The LICENSE file is one click away rather than a sentence in a marketing paragraph.
  • The Wayfern Chromium engine is proprietary. Any page telling you Donut Browser is 100% open source is wrong, including one written by Donut Browser.
  • Zero telemetry is the claim open source genuinely changes: you can record what leaves the machine, then read the code that would have produced it, and check that the two agree.
  • Nothing needed to evaluate it is paywalled — unlimited local profiles, per-profile HTTP, HTTPS, SOCKS4 and SOCKS5 proxies, WireGuard, the local REST API and the MCP server are free and need no account.
  • Closed-source competitors are genuinely ahead on bundled residential proxies, Android clients and Firefox-engine profiles. Donut Browser ships none of the three.

What is the difference between a closed binary and auditable source?

The claim is not that one box holds better software. It is that only one of them can be checked: clone the repository, build it, and compare the result against the binary you downloaded. A closed binary has no equivalent step — which is also why the proprietary engine is drawn sealed here instead of quietly left out.

What licence is this open source antidetect browser under?

AGPL-3.0. The GNU Affero General Public License v3 covers the Donut Browser app: the profile manager, the local REST API on 127.0.0.1:10108, the MCP server and the sync service. The LICENSE file sits in the root of github.com/zhom/donutbrowser, where a licence belongs, and you do not have to email anyone to read it.

AGPL is the strong end of copyleft. If you modify Donut Browser and let other people use your modified version — including over a network, which is the gap the Affero clause closes — you owe them the same source you received. Companies that cannot accept that obligation are not stuck with it: the Pro plan and above include a commercial licence that lifts it. Neither licence grants the right to resell, sublicense or redistribute Donut Browser as a standalone product or a competing service.

For an anti-detect browser the licence politics matter less than one mechanical consequence: a binary you can rebuild from published source is verifiable in a way a downloaded binary is not. You can read what the code sends, compile it yourself, and check that what you were handed matches what you read.

Two things sit deliberately outside that boundary, and both are stated on this site elsewhere. The Wayfern Chromium engine is proprietary. Team collaboration features are not open source and are available only on paid plans. Personal cloud sync is open source and can be self-hosted, and the Playwright humanizer published as the wayfern npm package is MIT-licensed and in its own repository.

What does open source actually buy you in an antidetect browser?

Very little, if the answer stops at "you could read the code", because almost nobody will. It buys something narrower and far more useful: a handful of claims stop being promises and become checkable — by you, or by any one person who bothers, once, in public.

  1. Zero telemetry becomes checkable rather than promised

    Every vendor in this category says it does not track you. With the source published the claim is testable twice: point a proxy at the app and record what leaves the machine, then read the code that would have produced any traffic you found. Two independent checks that agree are worth more than a privacy policy.

  2. The tool that hides you cannot quietly be the leak

    An anti-detect browser holds every profile, cookie and login you own. That is the most concentrated data in your entire workflow, handed to a program you did not write. Published source is the difference between that concentration being inspectable and it being trusted.

  3. The fingerprint logic is readable

    Spoofing is only as good as its internal consistency. When the code that assembles a profile's timezone, locale and geolocation is public, you can see how those values are made to agree with one another instead of inferring it from a test site's score.

  4. It survives the company

    A closed anti-detect browser that shuts down takes its profiles with it. AGPL-3.0 source that has already been cloned cannot be withdrawn — someone can keep building it — and your profiles are directories on your own disk either way.

None of that makes you undetectable. What a site sees is decided by the fingerprint your profile presents and the network it arrives from, both of which you can measure yourself with the browser fingerprint tool and the bot detection test — free, and equally applicable to any browser, open or closed.

How do you verify an open source anti detect browser yourself?

In an afternoon, with tools you already have. This is the sequence, and it is worth running against any candidate that claims a licence — including this one.

  1. Read the licence before the README

    Open the LICENSE file in the repository root and confirm it is a licence you recognise — here, AGPL-3.0. A project that calls itself open source in its marketing and ships no licence file has published something you can look at, not something you can rely on.

  2. Clone the repository and build it

    Build instructions live with the code. Source that cannot be built from a fresh clone is a reading exercise rather than a verification one, and the difference only shows up at the moment you actually want to check a release.

  3. Compare your build against the download

    Hash the binary you built and the binary you downloaded, and compare them. This is the step with no closed-source equivalent: it turns "this is what we ship" from an assertion into an observation.

  4. Watch the network while it runs

    Run the app behind a proxy you control and log every connection it opens. Zero telemetry is a claim about outbound traffic, so measure outbound traffic — then return to the source and confirm the code agrees with what you recorded.

One honest caveat

A byte-identical rebuild is not guaranteed. Reproducible builds are genuinely hard, and compiler versions, timestamps and build paths can all move the hash without anything being wrong. Treat a mismatch as a question worth asking rather than proof of tampering — and note that a closed binary never lets you reach the question at all.

The surfaces you would be auditing are documented rather than reverse-engineered: the quickstart gives the local API's address and token, and the REST API reference lists every endpoint the app serves on your machine.

Where are closed-source antidetect browsers still ahead?

In several real places, and they are about scope rather than about openness. A page that concedes nothing is an advertisement, and the argument above is worthless if it is only willing to make claims that flatter. Everything below is either verifiable in this repository or was read on a competitor's own page on 6 August 2026.

  • The part of Donut Browser you cannot audit

    Fingerprint spoofing is enforced inside the Wayfern Chromium engine, at the C++ layer — and that engine is proprietary. It is the single component you cannot read. Everything on this page about auditability applies to the application around the engine, not to the engine inside it.

  • Bundled residential proxies

    GoLogin's pricing page lists included residential proxy traffic as a plan benefit (read 6 August 2026). Donut Browser sells no IP traffic at all: you bind HTTP, HTTPS, SOCKS4, SOCKS5 or WireGuard from whichever provider you already use, which means a second vendor, a second invoice and a second support queue.

  • Mobile clients

    GoLogin's homepage lists an Android application alongside its Windows, Mac and Linux downloads (read 6 August 2026). Donut Browser is a desktop application for macOS, Windows and Linux with no mobile client, and no licence fixes that for someone who manages accounts from a phone.

  • One engine, and it is Chromium

    Donut Browser ships the Wayfern anti-detect Chromium engine and imports only Chromium-family profiles — Chrome, Brave, Edge, Opera, Opera GX, Vivaldi, Arc and Yandex. If your work requires Firefox-engine profiles, this is the wrong tool, and being able to read the source does not change that.

  • Local-first costs you portability

    Profiles are directories on your own disk. Reaching the same profile from a second machine means the paid sync tier or self-hosting the open-source sync server. A hosted competitor hands you that by default — because your profiles were never on your machine to begin with.

None of those are arguments against reading the source. They are the reason to decide what your work actually requires before deciding what licence you want it under. If bundled proxies or an Android client are on that list, a closed-source product is the better purchase, and this page would rather say so than win the click.

Is there a genuinely free open source antidetect browser?

Yes, with the boundary drawn where it actually falls. The free tier is not a trial: there is no clock, no card and no account. You download the application and use it. What it does not cover is the hosted and cross-machine features, which cost money to run and are therefore sold.

Free · no account

  • Unlimited local profiles, each isolated with its own cookies, extensions and data
  • Per-profile proxies: HTTP, HTTPS, SOCKS4 and SOCKS5
  • Per-profile WireGuard VPN
  • The Wayfern browser engine
  • The local REST API on 127.0.0.1:10108 and the MCP server
  • Cookie and extension management, and set as default browser
  • The complete AGPL-3.0 source

Paid plans · from $29/month

  • Fingerprints for operating systems other than the one you are on
  • The browser manipulation API and MCP surface, and automation throughput
  • Cloud profile backups and the profile synchronizer
  • Team collaboration and profile sharing — not open source
  • A commercial licence lifting the AGPL obligation, on Pro and above

That split describes running costs rather than a lever: nothing in the free tier is deliberately limited in order to sell the paid one. Current figures live on the pricing page, and the free tier does not expire if you never go there.

If you arrived from a job rather than from a licence question, the multi-account, automation and privacy pages describe what the free tier does for each of them.

Open source antidetect browser: frequently asked questions

What is the best open source antidetect browser?

A page published by one of the candidates is the last place to look for a neutral superlative, so here is only what can be stated factually. Donut Browser publishes its app under AGPL-3.0 at github.com/zhom/donutbrowser. On the pages read on 6 August 2026, GoLogin, Multilogin, Dolphin Anty and AdsPower named no open-source licence and no public source repository. If open source is your filter, that is the comparison that matters — and the licence and build checks on this page are worth running against every candidate, this one included.

Is there a free open source antidetect browser?

Yes. Donut Browser's free tier needs no account and no card, and includes unlimited local profiles, per-profile HTTP, HTTPS, SOCKS4 and SOCKS5 proxies, WireGuard, the local REST API and the MCP server. Paid plans start at $29 a month and cover hosted, cross-machine and team features rather than unlocking the browser itself.

Where is the anti detect browser source code on GitHub?

At github.com/zhom/donutbrowser. The repository holds the profile manager, the local REST API, the MCP server and the sync service, with the AGPL-3.0 LICENSE file in the root. The Playwright humanizer is published separately at github.com/donutbrowser/wayfern-humanizer under the MIT licence.

Is Donut Browser completely open source?

No, and claiming otherwise would undo everything else on this page. The app is AGPL-3.0. The Wayfern Chromium engine underneath it is proprietary. Personal cloud sync is open source and can be self-hosted, while team collaboration features are not open source and are available only on paid plans.

Can I use an open source antidetect browser commercially?

Yes. AGPL-3.0 permits commercial use. It requires that if you modify Donut Browser and make the modified version available to others, including over a network, you publish those changes under the same licence. The Pro plan and above include a commercial licence that removes that obligation. Neither licence grants the right to resell, sublicense or redistribute Donut Browser as a standalone product or a competing service.

Does open source make an antidetect browser harder to detect?

No. Detection is decided by the fingerprint a profile presents and the network it arrives from, not by the licence on the source. Open source changes who is able to verify how that fingerprint is assembled and whether the application phones home. It does not change what a detection script sees.

Should you choose an open source antidetect browser?

If one program holds every account you own, the ability to check that program is worth more than a feature you will use twice. If bundled proxies or a phone client matter more to you than that, buy the closed product — the honest recommendation depends on your work rather than on a licence. Either way, the checking costs you an afternoon and nothing else.

  1. Next 10 minutes

    Open github.com/zhom/donutbrowser, read the LICENSE file, and download the app. None of it requires an account.

  2. This week

    Build from a fresh clone, compare your build against the download, and run the app behind a proxy you control to see what leaves the machine.

  3. Before you pay

    Put the free tier on real work first. Paid plans buy hosted sync, automation throughput and team features — none of which you need in order to evaluate the browser.

Download Donut Browser See pricing

Keep reading