Patchright: The Undetected Playwright Fork That Slips Past Cloudflare

Patchright is a patched fork of Playwright that removes the automation fingerprints bot detection systems look for, so your scrapers run without triggering Cloudflare challenges. In 22 seconds, @howtowebdev walks through the GitHub repo for a tool aimed at data scrapers who want stealth without rewriting anything. Because it works as a drop-in replacement, existing Playwright code keeps running while the detection surface shrinks underneath it. The video is a screen recording of the repo README, which turns out to contain the most useful details.

A Drop-In Replacement, With One Hard Limit

The README shown on screen states the pitch plainly: Patchright is a patched and undetected version of the Playwright Testing and Automation Framework, usable as a drop-in replacement. You swap the import and keep your existing scripts. The same frame also shows the catch that the narration skips: Patchright only patches Chromium-based browsers. Firefox and WebKit are not supported. If your automation depends on either of those engines, this project does nothing for you.

How It Actually Evades Detection

The frames scroll through a "Patches" section that explains the mechanics. The biggest fix targets the Runtime.enable leak, a Chrome DevTools Protocol signal that detection vendors use to spot automation. Patchright avoids calling Runtime.enable and instead executes JavaScript in isolated ExecutionContexts. It also patches the Console.enable leak by disabling the Console API entirely, which means console functionality does not work inside Patchright. That is a real tradeoff for debugging, and the README suggests JavaScript loggers as a workaround while admitting those can be detected too.

Command Flag Cleanup

Another frame lists the browser launch flags Patchright changes because default Playwright flags give automation away. It removes --enable-automation to avoid navigator.webdriver detection, removes --disable-popup-blocking to prevent popup crashes, removes --disable-component-update to avoid being flagged as a stealth driver, and removes --disable-default-apps and --disable-extensions so the browser behaves like a normal install. It also adds a --disable-blink-features flag to suppress the webdriver signal at the rendering-engine level. The repo additionally patches general leaks in the Playwright codebase and adds the ability to interact with elements inside closed Shadow Roots using normal locators and XPaths, something stock Playwright cannot do.

The Detection Systems It Claims to Pass

The final frames show a stealth scorecard. With the right setup, Patchright is considered undetectable and passes Brotector (with CDP patches), Cloudflare, Kasada, Akamai, Shape/F5, Bet365, Datadome, Fingerprint.com, CreepJS, Sannysoft, and Incolumitas. That list covers the major commercial bot detection vendors, which explains why the video calls out Cloudflare challenges specifically. These are the walls most scrapers hit first.

Getting It Into Your Stack

The repo shown in the video serves the Patchright driver. Actual usage goes through language packages: an official Python package (pip install patchright, then patchright install chromium), an official NodeJS package (npm i patchright, then npx patchright install chromium), and a community-driven .NET package. The project is licensed under Apache 2.0, so commercial use is fine. One caution the video does not raise: bypassing bot detection can violate the terms of service of the sites you scrape, so check what you are automating before you deploy this.

Key Takeaways

Patchright is an Apache 2.0 licensed fork of Playwright built to evade bot detection, usable as a drop-in replacement for existing Playwright code.
It works only with Chromium-based browsers. Firefox and WebKit are unsupported.
Its main technique is avoiding the Runtime.enable CDP leak by running JavaScript in isolated ExecutionContexts, plus disabling the Console API and cleaning up telltale browser launch flags.
The README claims it passes Cloudflare, Datadome, Akamai, Kasada, Fingerprint.com, and other major detection systems when set up correctly.
Official Python and NodeJS packages install with pip install patchright or npm i patchright, followed by a Chromium driver install.
Disabled console functionality is the notable developer-experience tradeoff.