What they don't know can't be sold.
Shroudbyte is a privacy-first browser built on Chromium & PyQt6. It blocks trackers at the network level, spoofs your fingerprint, encrypts your passwords, and routes DNS through HTTPS — all without phoning home.
Everything you need.
Nothing you don't.
A full-featured browser that puts privacy first, without sacrificing the tools you depend on.
Network-Level Ad & Tracker Blocking
93 hardcoded tracker domains blocked at the network layer — Google, Facebook, Twitter/X, Yahoo, TikTok, Samsung, Xiaomi, and dozens more. Combined with 6 downloadable filter lists for comprehensive coverage.
Encrypted Password Vault
AES-128-CBC + HMAC-SHA256 via Fernet with PBKDF2 key derivation (100k iterations). Auto-fill on load, auto-detect form submissions.
DNS-over-HTTPS
Cloudflare DoH by default. Choose off, automatic, or secure mode — or point to your own provider. Optional self-hosted pfSense with HMAC-SHA256 signed queries.
Cosmetic Filtering
Hides ad elements and cookie banners via CSS injection. MutationObserver watches for dynamically-added content, script interception blocks 13 ad-script patterns.
Tracking Param Stripping
Automatically strips 34 tracking parameters from every URL: utm_*, fbclid, gclid, msclkid, _ga, _gl, HubSpot, Vero, Yandex, and more.
Fingerprint Resistance
Spoofs Canvas, WebGL, AudioContext, hardware concurrency, device memory, and screen resolution. Uses a seeded PRNG for consistent-per-session noise so sites don't break while your fingerprint stays generic.
Full-Featured Browsing
Tabs with session restore, bookmarks, history (5,000 entries), downloads, find-in-page, DevTools, print/PDF, 25–500% zoom, private mode.
HTTPS-Only Mode
Enforce HTTPS on all navigations. Local addresses auto-exempted. Do Not Track headers on every request.
Privacy is not a feature.
It's the architecture.
Every layer of Shroudbyte is designed to minimize your exposure.
Network Interception
Requests to known ad and tracker domains are blocked before they leave your machine. The interceptor checks all parent domains — sub.doubleclick.net is caught by the doubleclick.net rule. A DNT: 1 header is injected on every outgoing request.
URL Sanitization
Before a page loads, 34 tracking query parameters are stripped. This covers Google, Facebook, Microsoft, HubSpot, Yandex, and common analytics tags like utm_source, fbclid, gclid, _ga, and _gl.
Content Filtering
Cosmetic CSS rules hide ad containers, cookie banners (20 selectors for OneTrust, Cookiebot, Osano), and 32+ ad-element selectors. MutationObserver catches dynamically injected ads. Script interception blocks ad script creation at document load.
Fingerprint Resistance
Canvas reads get per-session noise. WebGL reports "ANGLE (Generic GPU)". AudioContext oscillators are micro-detuned. Hardware concurrency reads as 4 cores, memory as 8 GB. Screen resolution rounded to standard values.
Encrypted DNS
DNS queries go through Cloudflare DoH, keeping your ISP blind. For maximum control, run the included pfSense DNS server — HMAC-SHA256 signed with timestamp/nonce replay protection and TLS 1.2+ cert pinning.
Local Encryption
Passwords encrypted with Fernet (AES-128-CBC + HMAC-SHA256). Key derived via PBKDF2-HMAC-SHA256 with 100,000 iterations and 16-byte random salt. Nothing plaintext. Nothing leaves your machine.
Community-powered protection.
Six curated filter lists, five enabled by default. Updated from their sources with a single click.
EasyList
Primary ad-blocking rules
EasyPrivacy
Tracking scripts & pixels
Fanboy's Annoyance
Cookie notices & popups
Fanboy's Social
Social media widgets
Peter Lowe's List
Domain-level ad blocklist
URLhaus Blocklist
Known malware & phishing
Clean, readable code.
Pure Python. No Electron. No bloated framework. Just PyQt6, Chromium's QtWebEngine, and the standard library.
Tabs, toolbar, menus, settings dialog, content blocking injection, session auto-save (every 30s), keyboard shortcuts.
QWebEngineUrlRequestInterceptor. Network-level domain blocking, DNT header injection, tracking parameter stripping.
Downloads and parses hosts-file and ABP-format filter lists. Generates cosmetic CSS. Batches selectors in groups of 50.
JavaScript injection for Canvas, WebGL, AudioContext, hardware, and screen spoofing. Seeded PRNG per session.
Fernet-encrypted vault. PBKDF2 key derivation. UUID4 entry IDs. URL matching strips www. prefix.
Local SOCKS5 proxy with HMAC-authenticated DoH. TLS cert pinning. DNS cache with 30–300s TTL. Async relay.
Custom QWebEngineView/Page. HTTPS-only enforcement, loopback rewriting, popup support, rich context menus.
JSON-based persistence. Bookmarks, history (5,000 max), settings, session state. All data in ~/.shroudbyte/.
Custom shroud:// URL scheme. Serves newtab and about pages. Shows Python, Qt, Chromium versions.
HTML new-tab page. Time-based greeting, search bar, up to 8 bookmark quick-link cards with staggered animations.
Forged Dark theme. Warm copper (#cd8d6a) accents on deep dark (#0c0b10) backgrounds. Full Qt stylesheet system.
Global exception handler. Logs to ~/.shroudbyte/crash.log (512 KB max, auto-rotates). Shows Qt dialog on crash.
Keyboard-driven workflow.
Familiar shortcuts. No surprises.
Tabs
Navigation
Privacy
Tools
Three commands.
That's it.
Requires Python 3.10+ on Linux.
git clone https://github.com/WebWalker3D/Shroudbyte.git
cd Shroudbyte && pip install -r requirements.txt
python3 run.py
Desktop integration
cp shroudbyte.desktop ~/.local/share/applications/ && chmod +x shroudbyte.sh
Self-hosted DNS (pfSense)
HMAC-SHA256 signed queries, replay protection, TLS cert pinning.
ssh admin@pfsense "sh -s" < pfsense/deploy.sh
Your data stays local.
Everything lives in ~/.shroudbyte/. No cloud. No accounts. No sync servers.