You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
On top of the defaults, stealth mode adds a default residential proxy and an automatic CAPTCHA solver. Both are opt-out so you can BYO proxy and/or CAPTCHA tooling.
31
+
On top of the defaults, stealth mode adds a default ISP proxy and an automatic CAPTCHA solver. Both are opt-out so you can BYO proxy and/or CAPTCHA tooling.
32
32
33
33
### [Configurable Proxies](/proxies/overview)
34
34
Bring your own proxy network or use Kernel's managed pool (selectable down to ZIP-code level). If needed, use the same IP to reduce detection and allow for regional testing or QA.
Controls the browser without using the Chrome DevTools Protocol (CDP), which can reduce bot detection signals.
48
48
Emulates native keyboard and mouse input directly at the OS level and includes human-like [bezier curves](/browsers/computer-controls#move-the-mouse) by default.
Many detection systems fingerprint canvas and WebGL rendering output and cross-check it against the claimed GPU. Software-rendered browsers produce pixel hashes that don't match any real consumer GPU, which is a strong bot signal on sites with rendering-based fingerprinting. GPU-enabled Kernel browsers render through real hardware, producing output consistent with a normal user's device.
52
+
50
53
## Getting Started
51
54
52
55
Before you start automating your workflow, we recommend that you manually test your website to understand how it behaves with Kernel's browsers. Here's how to do that:
@@ -72,5 +75,29 @@ Once you have a stable baseline, replicate those conditions in your automations.
72
75
|**Session Persistence**| Use **Profiles** to retain cookies and local storage between sessions. |
73
76
|**Typing & Scrolling**| Add natural variation to interaction timing. |
74
77
|**Rate Limits**| Many sites monitor request frequency; rapid / concurrent actions can trigger blocking. |
75
-
|**Network Identity**| Use stable IP addresses, especially if logging in. |
78
+
|**Network Identity**| Use stable IP addresses, especially if logging in. See [Choosing a proxy type](#choosing-a-proxy-type) below. |
76
79
|**Extensions**| Use the [Extensions API](/browsers/extensions) carefully — each adds its own fingerprint, which can be detected. |
80
+
81
+
## Choosing a Proxy Type
82
+
83
+
IP address is one of the strongest signals bot detection systems use. Kernel offers several [proxy types](/proxies/overview), each with different trade-offs for detection avoidance.
84
+
85
+
### ISP proxies
86
+
87
+
[ISP proxies](/proxies/isp) route traffic through data centers using IP addresses assigned by real internet service providers. They offer datacenter-level speed with better legitimacy than pure datacenter proxies, and every connection in a session exits through the same static IP — making them ideal for login flows and session-based workflows.
88
+
89
+
Kernel's [stealth mode](/browsers/bot-detection/stealth) uses static ISP proxies that are hosted in data centers but announced on residential ISP networks, so they tend to appear residential by ASN to most of the internet. This matters for IP-reputation-based detection systems: a static IP on a residential ASN looks like a normal ISP customer, which generally achieves better pass rates than rotating residential IPs.
90
+
91
+
### Residential proxies
92
+
93
+
[Residential proxies](/proxies/residential) route traffic through real consumer devices, making them the least detectable proxy type by ASN classification. However, exit IPs [rotate per connection](/proxies/residential#ip-rotation-behavior) since the underlying devices come online and offline dynamically — different tabs hitting different domains will likely show different public IPs.
94
+
95
+
Some IP-reputation-based detection systems (such as reCAPTCHA) can detect rotating pool traffic patterns and penalize them, regardless of how clean the individual exit IPs are. On the other hand, residential proxies tend to be a stronger choice against fingerprint-heavy vendors where detection focuses on the browser and behavioral layer rather than the network layer. Residential proxies also offer richer geo-targeting (country, state, city, ZIP, ASN) compared to ISP.
96
+
97
+
### Datacenter proxies
98
+
99
+
[Datacenter proxies](/proxies/datacenter) are the fastest and most cost-effective option, but their IP ranges are well-known to detection systems. Some sites block datacenter IPs outright; others treat them with higher scrutiny.
100
+
101
+
### Which to use
102
+
103
+
Start with ISP — it's the stealth default for good reason. Consider residential if you need fine-grained geo-targeting or your specific target site doesn't rely on IP reputation as its primary detection signal. Use datacenter when speed and cost matter more than detection avoidance.
Copy file name to clipboardExpand all lines: browsers/bot-detection/stealth.mdx
+5-1Lines changed: 5 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,11 +6,15 @@ All Kernel browsers ship with anti-detection optimizations by default — you do
6
6
7
7
Enabling `stealth` mode adds two managed services on top:
8
8
9
-
1.**Default residential proxy** — traffic routes through Kernel's residential proxy pool.
9
+
1.**Default proxy** — traffic routes through a static ISP proxy, providing a stable exit IP for the session.
10
10
2.**Automatic CAPTCHA solver** — solves [reCAPTCHAs](https://www.google.com/recaptcha/api2/demo), Cloudflare challenges, and similar tests automatically.
11
11
12
12
Both are opt-out so you can [bring your own](#bring-your-own-proxy-or-captcha-solver) where it makes sense.
13
13
14
+
### IP Rotation Behavior
15
+
16
+
The default stealth proxy provides a **static exit IP** — all connections within the session exit through the same IP address. If you override the default with a [residential proxy](/proxies/residential), exit IPs will rotate per connection. See [Residential IP Rotation Behavior](/proxies/residential#ip-rotation-behavior) for details.
17
+
14
18
To turn on stealth mode, set its flag when instantiating Kernel browsers:
Kernel browsers [benchmark](https://www.kernel.sh/benchmarks) as the fastest, most performant browsers in the market.
6
+
7
+
### Kernel browser creation latency
8
+
| Benchmark | Latency | Last reported |
9
+
|-----------|---------|---------------|
10
+
| P50 | 30ms | April 24, 2026 |
11
+
| P99 | 105ms | April 24, 2026 |
12
+
13
+
### Troubleshooting latency
14
+
If you're experiencing slower-than-expected browser creation (or [browser pool acquisition](/browsers/pools/overview)), review your configuration for the following:
15
+
16
+
1. App code ⇔ Kernel browser region
17
+
18
+
Kernel browsers run in `us-east`. Use our [app platform](/apps/develop) to colocate your browser agent or automation.
19
+
20
+
2. Create browser rate limit
21
+
22
+
Kernel enforces [rate limits](/info/pricing#rate-limiting) on browser creation based on your plan. Our SDKs automatically retry, respecting the `Retry-After` header for delay timing. If retries are exhausted, the SDK throws a typed `RateLimitError` with the response headers accessible for custom backoff logic.
23
+
24
+
3. Non-default browser configurations
25
+
26
+
Certain browser configurations trigger Chromium to restart, which can take several seconds. Use [browser pools](/browsers/pools/overview) to access browsers with custom configurations faster. The following configurations cause browser restarts, as well as disrupt active CDP connections:
27
+
- Custom viewport configurations
28
+
- Chrome extensions
29
+
- Setting the live view to `kiosk mode`
30
+
31
+
4. Browser pool refill rate
32
+
33
+
Browser pools fill at a [specified rate](https://www.kernel.sh/docs/api-reference/browser-pools/create-a-browser-pool#body-fill-rate-per-minute). Read about browser pool lifecycle best practices [here](/browsers/pools/overview#how-browser-pools-work).
Copy file name to clipboardExpand all lines: browsers/pools/overview.mdx
+31Lines changed: 31 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,6 +5,37 @@ description: "Pre-configure pools of reserved browsers for immediate acquisition
5
5
6
6
Browser pools let you maintain a set of reserved, identical browsers ready for immediate use. Use them to set your preferred browser configuration in advance, allowing you to minimize browser start-up latency and scale your workloads in production.
7
7
8
+
## How browser pools work
9
+
10
+
Browser pools are a way to pre-configure a fixed set of browsers without being charged for them until they are used (i.e. `acquired`). All browsers in the pool share the same settings upon instantiation.
11
+
12
+
<Steps>
13
+
<Steptitle="Declare a pool">
14
+
First, declare a pool of browsers with your specified configuration. The pool takes time to fill (see [fill rate per minute](https://www.kernel.sh/docs/api-reference/browser-pools/create-a-browser-pool#body-fill-rate-per-minute)), so declare your pool outside your browser automation / agent runtime logic.
15
+
16
+
<Info>
17
+
Pool declarations should be decoupled from browser runtime logic for the best performance.
18
+
</Info>
19
+
</Step>
20
+
<Steptitle="Acquire a browser">
21
+
You can acquire a browser as soon as you've created a pool. The request returns immediately if a browser is available, or waits until one becomes available.
22
+
23
+
The total number of browsers is fixed to the `size` specified upon browser pool creation. When you acquire a browser, the pool's available count is decremented by one. When you release a browser, the pool's available count is incremented by one.
24
+
25
+
<Info>
26
+
Put differently, the pool does not top up when you acquire a browser: browsers are "borrowed" from the pool and must be returned when you're done with them, either by [releasing them](#release-a-browser) or allowing them to [timeout](#timeout-behavior).
27
+
</Info>
28
+
</Step>
29
+
<Steptitle="Release a browser">
30
+
When you're done with a browser, release it back to the pool. this step is important; otherwise, the browser will continue to be in an `acquired` state until it times out.
31
+
32
+
<Info>
33
+
Failing to release browsers may result in unexpected latency when acquiring future browsers.
34
+
</Info>
35
+
</Step>
36
+
</Steps>
37
+
38
+
8
39
## Create a pool of reserved browsers
9
40
10
41
Create a browser pool with a specified size and configuration. All browsers in the pool share the same settings.
- Launched [Projects](/info/projects) so you can keep `production` and `staging` separate, split resources between teams, scope API keys to a single environment, and cap concurrency per project so one workload can't exhaust your org quota. Existing resources have been moved into a **Default** project, so nothing changes for current workloads.
15
16
- Kernel is now a [Cloudflare Web Bot Auth partner](https://www.kernel.sh/blog/cloudflare). Kernel browsers can [cryptographically identify themselves](/browsers/bot-detection/web-bot-auth) to Cloudflare-protected sites, so Kernel traffic isn't blocked.
16
17
- Anti-detection features are now on by default for all Kernel browsers. [Stealth mode](/browsers/bot-detection/stealth) now specifically adds the managed residential proxy and CAPTCHA solver (both opt-out), and non-stealth browsers fully support [custom proxies](/proxies/custom).
17
18
- Revamped the [managed auth hosted login page](/auth/hosted-ui): all available sign-in options (password fields, SSO providers, MFA, alternate sign-in methods) now render together on a single page, so end users can pick the path they want, instead of being funneled through one at a time.
18
-
-[Managed auth connections](/auth/overview) now automatically re-authenticate expired sessions during health checks when credentials are available, reducing the need for manual reauth.
19
19
- Managed auth input fields now display contextual helper text when the site surfaces hints, reducing user confusion on multi-step logins.
20
20
- The "Save credentials after login" option is now automatically disabled when [1Password](/integrations/1password) is selected as the [credential source](/auth/credentials), since those credentials are already managed externally.
21
21
- Kernel now supports WebSocket connections through its API, enabling `process attach` and other long-lived streaming workflows.
@@ -56,7 +56,7 @@ For API library updates, see the [Node SDK](https://github.com/onkernel/kernel-n
56
56
## Documentation updates
57
57
58
58
- Documented MFA token auto-retry behavior for [managed auth](/auth/overview) sessions.
59
-
- Added a new [Managing Browsers](/browsers/pools/managing-browsers) page to the Reserved Browsers documentation.
59
+
- Added a new [policy.json](/browsers/pools/policy-json) page to the Reserved Browsers documentation.
60
60
- Clarified that [profiles](/auth/profiles) can have multiple auth connections.
61
61
- Added a Headful + GPU acceleration option to the [pricing calculator](/info/pricing#pricing-calculator).
0 commit comments