Architecture

How Clearcote layers privacy and identity control onto Chromium — transparently.

The stack

The open build is a thin, auditable stack. Each layer is open and replaceable:

            Chromium  (Google, BSD-3)
                |
   ungoogled-chromium  ->  removes Google services, telemetry, integration
                |
       Clearcote patches  ->  engine-level identity & privacy controls
                |
   reproducible build  ->  checksummed, GPG-signed, rebuildable by anyone (open build)
                |
        Clearcote Browser  +  SDK (Playwright objects) / CDP endpoint

The licensed build (Free with GitHub and Pro) adds patches that aren't public on top of this stack. It is SHA-256-verified on download but can't be rebuilt from public source.

Engine-level, not script injection

Most "stealth" tooling injects JavaScript to overwrite navigator properties at runtime. That is brittle and self-revealing — the overrides themselves become a fingerprint (wrong prototype chains, getter timing, missing native code stringification).

Clearcote instead modifies the C++ engine. The values a page reads are produced by the same code paths Chromium always uses, so there is no injected layer to detect. This covers APIs that JavaScript can't cleanly intercept at all.

Coherent identity, per-site render noise (farbling)

Randomizing each signal independently produces an identity that doesn't add up — a dead giveaway. Clearcote derives the persona from one seed, and derives render noise from that seed combined with the site's registrable domain:

• Internally consistent — platform, GPU, screen and hardware agree with each other; timezone and language come from your options or geoip.
• Stable per site — the same site sees the same identity across a session.
• Per-site render noise — canvas and WebGL readbacks differ from one site to the next, so render hashes don't match across domains. Hardware-class values stay the same everywhere, as a real machine's would.

This per-eTLD+1 noise model is inspired by Brave's farbling approach. The noise is seed-gated: without a --fingerprint seed there is none.

Coherent persona — one seed, one believable machine

Clearcote goes a step beyond per-signal noise. A single --fingerprint seed derives one coherent persona for the platform you present — a single believable machine whose properties agree with each other. The SDK presents your host OS by default (Windows or Linux); a macOS UA and a best-effort Android persona are available on request. From the seed it draws a hardware tier (CPU cores and RAM that actually ship together — never 20 cores with 4 GB), a matching screen resolution, colour depth and device-pixel ratio, a coherent GPU, and a real Chrome version.

From the licensed Chromium 156 build (r51) the persona is derived in the Clearcote persona service rather than in the browser: at every start the launcher (SDK, Profile Manager or Docker image) sends your seed or profile selection with the licence's run token and passes the signed persona it receives to the browser, which does not start without one. The result is unchanged — a seed gives the same persona on r51 as on r50 — but a copied engine without a licence launches nothing.

Hardware-class properties stay constant for the session — a real machine doesn't change its core count or screen size between sites — while the perturbed render surfaces (canvas and WebGL pixels) stay per-site farbled, so you stay decorrelated across domains. Client rects and rendered audio are not perturbed — though AudioContext sampleRate, baseLatency and outputLatency are served from the persona whenever one is active; what is farbled, and what deliberately isn't explains the trade.

Why it matters: the strongest modern detection signal isn't any single value, it's internal contradiction — a machine that claims one OS but renders like another, or pairs a high-core CPU with too little RAM. Deriving every signal from one persona table keeps them telling the same story. It runs off the same --fingerprint seed you already pass (no new flags).

There are three ways to present an identity: the light-stealth preset (a few metadata values, no seed, no noise), the seeded persona above, or a captured profile from a real machine (fingerprint_profile, or profile="auto" from the licensed profile library). See Recommendations for which to start from.

What it controls

Build target

The open build targets Windows x64 (cross-compiled from Linux) and Linux x64 (native), on Chromium 151; the licensed build is on Chromium 156. The open build's full recipe — and every cross-build gotcha — is documented so anyone can reproduce it. See Build from source.