Donut Browser is an anti-detect browser whose app is open source under AGPL-3.0, and ShardBrowser is one whose launcher is open source under MIT. In both, the browser engine that actually sets the fingerprint is a closed Chromium binary. You can read, build and fork everything around the engine. You cannot read the part that decides what a website sees.
Neither project hides this; both say it plainly on their own pages. It still matters what the words "open source" buy you in each case. We make Mosaic, a closed product, so read this with that in mind; corrections to hello@mosaicbrowser.com.
What Donut Browser ships as an anti-detect browser
Donut's GitHub repository holds a desktop app for macOS, Windows and Linux. The profile manager, a local REST API, the MCP tooling and the sync server are all in it under AGPL-3.0. Its README says the free tier needs no account and the app sends no telemetry. Profiles live on your disk. Sync between machines is optional, encrypted end to end with a password, and you can run the sync server yourself.
The engine is Wayfern, which Donut describes as a privacy-focused Chromium fork that sets fingerprints inside the engine rather than with scripts on the page. Donut's page on open source lists Wayfern in its own row: not in the repository, proprietary. The same page makes a fair point against its own headline: open source does not make you harder to detect, it turns a few promises into things you can check.
Your profiles, cookies and proxies stay on your computerIn Mosaic: Local first. Profiles, cookies and proxies stay on your computer. Free holds 3 profiles. Pro is $49 a month for any number.
Mosaic is a desktop app
Email yourself the link and open it on your computer.
What ShardBrowser ships
ShardBrowser, which also goes by ShardX, comes from ProxyShard, a proxy seller. The launcher repository is MIT: a Tauri shell, a React interface and Rust code, with a local HTTP API, an MCP server and SDKs for Python, Node and Rust. The README describes fingerprint changes made in Chromium's C++, across Blink, V8 and the network stack, and a starter library of device profiles.
The engine is downloaded from ProxyShard's CDN on first launch, and the licensing section of the README is direct about it. The binary is closed and its source is not published anywhere. Reverse engineering it is not permitted, nor is redistributing a modified version, nor using it inside a commercial anti-detect or fingerprint product. Personal projects, scraping and running several accounts are listed as allowed. The launcher is free, and the README lists the cost as proxies only.
The README also says the releases are not code-signed, and gives the xattr -dr com.apple.quarantine command for macOS. That is honest, and it tells you which checks the operating system will not be doing for you.
The two side by side
| Donut Browser | ShardBrowser | |
|---|---|---|
| App licence | AGPL-3.0 | MIT |
| Engine | Wayfern, Chromium-based | Patched Chromium |
| Engine source | Proprietary, not published | Closed binary, not published |
| Account to start | None for the free tier, per its README | None described in its README |
| Automation | Local REST API, MCP | Local HTTP API, MCP, SDKs |
Read from each project's own README and pages on GitHub and its website.
What open source buys you here
Three things, and all of them are real. You can check what the app sends: run it behind a proxy you control, log every connection, and read the code that would make them. You can read how it stores the cookies and logins for every account you run, instead of trusting a sentence about it. And if the project stops, the code you cloned stays yours under its licence.
What it does not buy is any way to verify the fingerprint. The values a site reads come from the engine, and in both projects the engine is a binary you run on trust. A claim that its spoofing is "not detected" by some service is as checkable as the same claim from a closed vendor: you test it yourself, on the day, from your own address. Open code also leaves the network side alone. That half depends on the proxy and on whether the timezone, language and location agree with it.
If an engine you can read and rebuild is the point, the option is a patched open browser, such as Camoufox, which is Firefox and comes with its own maintenance question (is Camoufox maintained). Commercial vendors' own engines, such as GoLogin's Orbita and Kameleo's Junglefox, are covered in what Orbita is and Kameleo's Junglefox.
Where Mosaic sits
Mosaic is closed: the app and Tesseract Chrome, its engine, both. The engine is stock Chromium source plus our own patch series, compiled by us, with fingerprint values set in C++ so every page, frame and worker reads the same machine. You cannot audit that from source, and we will not pretend otherwise. What we can do is say what we measured and on which detector, and keep profiles, cookies and proxies on your computer (local-first has the details). The wider field, open and closed, is laid out in the best anti-detect browsers.
Use any of these tools only on accounts you are entitled to run, and within each site's terms.
