# Donut Browser and ShardBrowser: what is open source > Donut Browser's app is AGPL-3.0 and ShardBrowser's launcher is MIT, but both run a closed Chromium binary. The part a site reads is the part you cannot audit. Source: https://mosaicbrowser.com/blog/donut-and-shard-browsers ## Donut and ShardBrowser: open apps, closed engines Donut Browser's app is AGPL-3.0 and ShardBrowser's launcher is MIT, but both run a closed Chromium binary. The part a site reads is the part you cannot audit. ![Donut Browser versus ShardBrowser, each name in its own tile: An open app around a closed engine](https://mosaicbrowser.com/covers/donut-and-shard-browsers.webp) Donut Browser is an anti-detect browser whose app is open source under AGPL-3.0, and ShardBrowser is one whose launcher is open source under MIT. In both, the browser engine that actually sets the fingerprint is a closed Chromium binary. You can read, build and fork everything around the engine. You cannot read the part that decides what a website sees. Neither project hides this; both say it plainly on their own pages. It still matters what the words "open source" buy you in each case. We make Mosaic, a closed product, so read this with that in mind; corrections to [hello@mosaicbrowser.com](mailto:hello@mosaicbrowser.com). ## What Donut Browser ships as an anti-detect browser Donut's GitHub repository holds a desktop app for macOS, Windows and Linux. The profile manager, a local REST API, the MCP tooling and the sync server are all in it under AGPL-3.0. Its README says the free tier needs no account and the app sends no telemetry. Profiles live on your disk. Sync between machines is optional, encrypted end to end with a password, and you can run the sync server yourself. The engine is Wayfern, which Donut describes as a privacy-focused Chromium fork that sets fingerprints inside the engine rather than with scripts on the page. Donut's page on open source lists Wayfern in its own row: not in the repository, proprietary. The same page makes a fair point against its own headline: open source does not make you harder to detect, it turns a few promises into things you can check. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Local first](https://mosaicbrowser.com/features/local-first) ## What ShardBrowser ships ShardBrowser, which also goes by ShardX, comes from ProxyShard, a proxy seller. The launcher repository is MIT: a Tauri shell, a React interface and Rust code, with a local HTTP API, an MCP server and SDKs for Python, Node and Rust. The README describes fingerprint changes made in Chromium's C++, across Blink, V8 and the network stack, and a starter library of device profiles. The engine is downloaded from ProxyShard's CDN on first launch, and the licensing section of the README is direct about it. The binary is closed and its source is not published anywhere. Reverse engineering it is not permitted, nor is redistributing a modified version, nor using it inside a commercial anti-detect or fingerprint product. Personal projects, scraping and running several accounts are listed as allowed. The launcher is free, and the README lists the cost as proxies only. The README also says the releases are not code-signed, and gives the `xattr -dr com.apple.quarantine` command for macOS. That is honest, and it tells you which checks the operating system will not be doing for you. ## The two side by side | | Donut Browser | ShardBrowser | | --- | --- | --- | | App licence | AGPL-3.0 | MIT | | Engine | Wayfern, Chromium-based | Patched Chromium | | Engine source | Proprietary, not published | Closed binary, not published | | Account to start | None for the free tier, per its README | None described in its README | | Automation | Local REST API, MCP | Local HTTP API, MCP, SDKs | Read from each project's own README and pages on GitHub and its website. ## What open source buys you here Three things, and all of them are real. You can check what the app sends: run it behind a proxy you control, log every connection, and read the code that would make them. You can read how it stores the cookies and logins for every account you run, instead of trusting a sentence about it. And if the project stops, the code you cloned stays yours under its licence. What it does not buy is any way to verify the fingerprint. The values a site reads come from the engine, and in both projects the engine is a binary you run on trust. A claim that its spoofing is "not detected" by some service is as checkable as the same claim from a closed vendor: you test it yourself, on the day, from your own address. Open code also leaves the network side alone. That half depends on the proxy and on whether the timezone, language and location agree with it. If an engine you can read and rebuild is the point, the option is a patched open browser, such as Camoufox, which is Firefox and comes with its own maintenance question ([is Camoufox maintained](https://mosaicbrowser.com/blog/is-camoufox-maintained)). Commercial vendors' own engines, such as GoLogin's Orbita and Kameleo's Junglefox, are covered in [what Orbita is](https://mosaicbrowser.com/blog/orbita-browser) and [Kameleo's Junglefox](https://mosaicbrowser.com/blog/kameleo-junglefox). ## Where Mosaic sits Mosaic is closed: the app and Tesseract Chrome, its engine, both. The engine is stock Chromium source plus our own patch series, compiled by us, with fingerprint values set in C++ so every page, frame and worker reads the same machine. You cannot audit that from source, and we will not pretend otherwise. What we can do is say what we measured and on which detector, and keep profiles, cookies and proxies on your computer ([local-first](https://mosaicbrowser.com/features/local-first) has the details). The wider field, open and closed, is laid out in [the best anti-detect browsers](https://mosaicbrowser.com/compare/best-anti-detect-browsers). Use any of these tools only on accounts you are entitled to run, and within each site's terms. ## Questions ### Is Donut Browser open source? The app is. Its profile manager, local REST API, MCP tooling and sync server are AGPL-3.0 on GitHub. Donut's own page says the Wayfern Chromium engine it runs is proprietary and not in the repository. ### Is ShardBrowser open source? The launcher is, under the MIT licence: the Tauri shell, the React interface and the Rust code. The patched Chromium it downloads on first run is a closed binary whose licence forbids reverse engineering it. ### Does open source make an anti-detect browser harder to detect? No. A site reads the fingerprint and the network, not the licence. Donut's own page says the same. Open source lets you check what the app does on your machine. ### Is Mosaic open source? No. Neither the Mosaic app nor Tesseract Chrome, its engine, is open source. If an open engine is the requirement, Mosaic is the wrong choice. ## Related [Is Camoufox still maintained? Reading the repository](https://mosaicbrowser.com/blog/is-camoufox-maintained): Is Camoufox still maintained? Its repository answers better than forums do: compare the latest release's date and Firefox base with today's Firefox. [What Orbita is, from GoLogin's own pages](https://mosaicbrowser.com/blog/orbita-browser): Orbita is the Chromium-based browser a GoLogin profile opens in. GoLogin says it tracks Chrome releases, and each profile is updated on its own. [Junglefox and Chroma, Kameleo's two engines](https://mosaicbrowser.com/blog/kameleo-junglefox): Junglefox is Kameleo's Firefox-based engine, beside Chroma, its Chromium one. A Firefox profile needs an engine that really is Firefox, and keeping one is work. [The best anti-detect browsers, compared on the same criteria](https://mosaicbrowser.com/compare/best-anti-detect-browsers): Seven anti-detect browsers on one table: free plan, entry price, what they bill by, teams, mobile and automation, from each vendor's own page in November 2026. [Local first: your profiles stay on your computer](https://mosaicbrowser.com/features/local-first): Mosaic has no cloud copy of your profiles. Profiles, cookies and proxies stay on your computer, encrypted on disk, with app lock, daily backups and a trash. [Chrome 136 stopped remote debugging on your default profile](https://mosaicbrowser.com/blog/chrome-136-remote-debugging): Since Chrome 136, --remote-debugging-port is ignored on the default profile. Pass --user-data-dir with a folder of its own and the port opens. [App-Bound Encryption, and why tools stopped reading Chrome's cookies](https://mosaicbrowser.com/blog/chrome-app-bound-encryption): App-Bound Encryption ties Chrome's cookie key on Windows to Chrome itself, so tools reading the Cookies file broke. Export from inside the browser. [Device-bound sessions and the end of copying a cookie](https://mosaicbrowser.com/blog/device-bound-session-credentials): With Device Bound Session Credentials in Chrome, a site reissues its session cookie only to the device with the key. A copied cookie lasts until it expires. ## Mosaic, on your own computer The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.