Playwright stealth for Python and Node: what it patches
What playwright-stealth (Python) and playwright-extra (Node) patch, what a detector still sees, and what Playwright's own typing looks like to a page.
Davide Valli · Founder, Scalebrowser
Published Sep 25, 2026 · 5 min read
Short answer
Playwright is the test framework underneath Playwright MCP and browser-use, and "playwright stealth" is what people search for when the first site refuses it. There are two packages behind that phrase, one for Python and one for Node, and both are still downloaded hundreds of thousands of times a week. We read their source and our own recordings of Playwright's input on 24 September 2026 to see which of Playwright's traces they cover.
What is playwright-stealth?
playwright-stealth is the name of two small packages that inject evasion scripts into every page Playwright opens. In Python it is the playwright_stealth package, which describes itself as a "Fork of AtuboDad's port of puppeteer-extra-plugin-stealth, with some improvements". In Node it is playwright-extra, "a modular plugin framework for playwright", which loads the Puppeteer stealth plugin with chromium.use(StealthPlugin()).
| Package | Latest release | Downloads |
|---|---|---|
| playwright-stealth, Python | 2.0.3, 4 April 2026 | 2,393,782 in the last month |
| playwright-extra, Node | 4.3.6, 1 March 2023 | 874,602 from 15 to 21 September |
The Node side has not changed since March 2023. The Python side ships releases, and its README is candid about the result: "Don't expect this to bypass anything but the simplest of bot detection methods. Consider this a proof-of-concept starting point."
What does it patch and what not?
The Python package patches values a script inside the page can reach, and nothing below that, the shallowest of the three depths at which a stealth browser can work. Its source holds 18 evasion scripts and 19 switches, one for each script plus one that rewrites the sec-ch-ua client hints. We sorted the surfaces a detector reads by whether one of those scripts touches them.
| Surface a detector reads | Patched by playwright-stealth |
|---|---|
navigator.webdriver, plugins, languages, permissions, platform | yes |
| user agent string and user agent client hints | yes |
the chrome object: app, csi, loadTimes, runtime | yes, runtime switched off by default |
| WebGL vendor and renderer strings | yes, set to "Intel Inc." and "Intel Iris OpenGL Engine" by default |
| pixels a canvas or WebGL scene draws | no |
| TLS handshake before any script runs | no |
| side effects of the automation protocol | no |
| pointer and keyboard events | no |
The WebGL default is the same fixed Intel pair on every machine, so a scene drawn by the real graphics card, or by a software renderer where no GPU is available, comes back next to a string that describes different hardware. Changing the engine itself instead of injecting scripts is covered in Chromium fork for automation.
Why does Playwright itself get detected?
Playwright gets detected through the protocol it speaks and the events it sends, and an evasion script reaches neither. In Ian L. Paterson's benchmark of 7 tools against 31 targets, published on 13 May 2026, vanilla Playwright reached 24 targets and rebrowser-playwright, a patched fork, the same 24. His conclusion: "Playwright forks fail regardless of patch quality, and defeating that layer takes a control plane that is not Playwright."
The input is the second trace. We recorded Playwright's two ways of entering text on our signature bench, two runs each, against Chrome 141 on 24 August 2026.
| Input path | What the page receives |
|---|---|
fill() | no key events at all; the whole text arrives in one insertion |
type() | paired key events; capital letters typed without a Shift key |
click() | pointer pressure 0.5, the value the specification asks for |
A person cannot put a sentence into a field without a single key event, and no keyboard produces a capital letter without Shift or Caps Lock. playwright-stealth changes none of this, because the events come from Playwright's driver and not from a value the page could read.
Is Patchright the better Playwright?
Patchright is the better Playwright for protocol leaks and the same Playwright for everything else. It patches Runtime.enable and Console.enable inside the driver, which an evasion script cannot do, and in Paterson's benchmark it reached 25 of 31 against vanilla Playwright's 24. Its list of patches names no fingerprint surface and no change to input; the Patchright review puts Playwright's input next to Puppeteer's and Selenium's.
Scalebrowser runs real browser profiles on your own PC: your AI agent drives them over MCP and signs in without ever seeing a password.
Download freeSo which should you use?
| Situation | Pick | Why |
|---|---|---|
| Playwright tests against your own site | plain Playwright | nothing there is looking for automation |
A site that only checks navigator.webdriver | playwright-stealth | the evasion scripts cover the JavaScript values |
| A site that fingerprints the automation protocol | Patchright or a driver without Playwright | the leak sits in the driver, not the page |
| A site that scores input timing | an input layer modelled on people | neither package changes the events |
Our verdict: playwright-stealth is a reasonable first step on a site that checks a handful of JavaScript values, and it stops there, as its own README says. The human input page of the documentation describes what an input layer has to produce instead, and the Playwright migration guide shows how existing Playwright code attaches to a profile over CDP.