The architectural difference
playwright-stealth hides a bot by injecting JavaScript into the page (via Page.addInitScript) that rewrites built-in browser properties — navigator.webdriver, WebGLRenderingContext.prototype.getParameter, HTMLCanvasElement.toDataURL, and dozens more. The trick works, until an anti-bot script asks to see the source of one of those rewritten functions: Function.prototype.toString.call(navigator.__lookupGetter__("webdriver")). A genuine browser function answers [native code]; a patched one shows the injected JavaScript instead. At that point the patch itself becomes the giveaway.
PatchRight takes a different route. It edits Playwright's Python source so the underlying CDP commands (CDP - the Chrome DevTools Protocol, the channel Playwright uses to steer Chrome) are sent in a way that achieves the same result without ever touching JavaScript. The browser's built-in functions are left exactly as they were, so Function.toString() still returns [native code] — there was no JavaScript patch to expose.
Where PatchRight fits
JavaScript-heavy sites that inspect function source. Because PatchRight avoids runtime JavaScript injection, it does not leave a Function.toString() signature the way runtime patches do. This is the main reason it exists.
Cloudflare with active Turnstile/JS challenges. On sites you are authorized to automate, a consistent browser configuration matters, and PatchRight's source-level approach is one way to keep the function-source surface consistent.
Any case where you have confirmed playwright-stealth leaves a detectable runtime signature. Switching is easy — PatchRight is a near drop-in replacement with very few API changes.
It is not the right tool for everything. It addresses only the function-source surface; it does not change the canvas/WebGL/audio fingerprint layer. For those, CloakBrowser (Chromium) or Camoufox (Firefox) work at the canvas/WebGL/audio layer instead.
What PatchRight does not address
PatchRight covers the toString-detectable surface in Playwright Python. It does not handle:
- Canvas / WebGL / AudioContext fingerprinting — these read your GPU and hardware. Use CloakBrowser or Camoufox.
- TLS fingerprinting — TLS is the encryption layer behind https, and it sits below the browser. Whatever TLS signature your Chromium ships with is what sites see.
- Behavioural detection — input timing and interaction patterns. This is handled by other layers such as Botasaurus.
- IP reputation — that is the proxy's job. Use residential or ISP static.
Think of PatchRight as one layer in a stack, addressing only the function-source surface.