Shroudbyte is a free, open-source privacy-focused web browser for Linux built on Chromium and PyQt6. It blocks 111 tracker domains at the network level, strips 34 tracking parameters from URLs, spoofs 6 fingerprint vectors, encrypts passwords locally, and routes DNS queries through HTTPS.

How do I install Shroudbyte?

Install Shroudbyte in three commands: git clone https://github.com/WebWalker3D/Shroudbyte.git, then cd Shroudbyte && pip install -r requirements.txt, then python3 run.py. Requires Python 3.10+ on Linux with PyQt6 >= 6.5.0, PyQt6-WebEngine >= 6.5.0, cryptography >= 41.0.0, argon2-cffi >= 23.1.0, and keyring >= 24.0.0.

Does Shroudbyte collect any data or telemetry?

No. Shroudbyte collects zero telemetry, has no analytics, no crash reporting to external servers, and no usage metrics. All data stays locally on your machine in ~/.shroudbyte/. Browsing history never leaves the device. Passwords are encrypted locally with AES-256-GCM and Argon2id key derivation.

What trackers does Shroudbyte block?

Shroudbyte blocks 111 tracker domains at the network level including Google (9 domains), Facebook (4), Twitter/X (3), TikTok (6), Samsung (4), Xiaomi (6), Yahoo (10), and 17+ ad network domains. It also uses 6 filter lists including EasyList, EasyPrivacy, Fanboy's Annoyance, Peter Lowe's List, and URLhaus.

How does Shroudbyte resist browser fingerprinting?

Shroudbyte spoofs 6 fingerprint vectors: Canvas reads get per-session noise, WebGL reports a generic GPU, AudioContext oscillators are micro-detuned, hardware concurrency reads as 4 cores, device memory as 8 GB, and screen resolution is rounded to standard values. A seeded PRNG ensures consistent noise per session.

What operating systems does Shroudbyte support?

Shroudbyte is built Linux-first and requires Python 3.10+ on Linux. It uses PyQt6 and Chromium's QtWebEngine as its rendering engine.

Is Shroudbyte open source?

Yes. Shroudbyte is fully open source under the GPL v3. The source code is available on GitHub at https://github.com/WebWalker3D/Shroudbyte.

How does DNS-over-HTTPS work in Shroudbyte?

Shroudbyte routes DNS queries through Cloudflare DoH by default, keeping your ISP blind to your lookups. You can choose off, automatic, or secure mode, or point to your own provider. For maximum control, you can run the included pfSense DNS server with HMAC-SHA256 signed queries, replay protection, and TLS 1.2+ cert pinning.

Open Source / Linux-First / GPL v3

What they don't know
can't be sold.

Shroudbyte is a privacy-first browser built on Chromium & PyQt6. It blocks trackers at the network level, spoofs your fingerprint, encrypts your passwords, and routes DNS through HTTPS — all without phoning home.

111 Tracker domains
blocked

34 Tracking params
stripped

6 Fingerprint
protections

6 Built-in
filter lists

Install Shroudbyte See How It Works

Every time you open a browser, hundreds of companies track your every click, build a detailed profile of your behavior, and sell it to the highest bidder.

Shroudbyte makes you invisible.

Features

Everything you need.
Nothing you don't.

A full-featured privacy browser that puts privacy first, without sacrificing the tools you depend on.

Ad & tracker blocking

111 hardcoded tracker domains blocked at the network layer — Google, Facebook, Twitter/X, Yahoo, TikTok, Samsung, Xiaomi, and dozens more. Combined with 6 downloadable filter lists.

Tracking parameter stripping

Automatically strips 34 tracking parameters from every URL: utm_*, fbclid, gclid, msclkid, _ga, _gl, HubSpot, Yandex, and more.

Fingerprint resistance

Spoofs Canvas, WebGL, AudioContext, hardware concurrency, device memory, and screen resolution. Seeded PRNG keeps noise consistent per session.

Encrypted password vault

AES-256-GCM + Argon2id key derivation. Auto-fill on load, auto-detect form submissions. Nothing leaves your machine.

DNS-over-HTTPS

Cloudflare DoH by default. Choose off, automatic, or secure mode — or point to your own provider. Optional self-hosted pfSense with HMAC-SHA256 signed queries.

Cosmetic filtering

Hides ad elements and cookie banners via CSS injection. MutationObserver watches for dynamically-added content, script interception blocks 13 ad-script patterns.

HTTPS-only mode

Enforce HTTPS on all navigations. Local addresses auto-exempted. DNT: 1 header injected on every outgoing request.

Full-featured browsing

Tabs with session restore, bookmarks, history (5,000 entries), downloads, find-in-page, DevTools, print/PDF, 25–500% zoom, private mode.

Google 9 Facebook 4 Twitter/X 3 TikTok 6 Samsung 4 Xiaomi 6 Yahoo 10 Ad Networks 17 + more

Layered Protection

01 — Network Interception Requests to known ad and tracker domains blocked before they leave your machine. Parent domain matching catches subdomains. DNT: 1 header injected on every request.
02 — URL Sanitization 34 tracking query parameters stripped before page load. Covers Google, Facebook, Microsoft, HubSpot, Yandex, and common analytics tags.
03 — Content Filtering Cosmetic CSS hides ad containers and cookie banners (20 selectors for OneTrust, Cookiebot, Osano). 32+ ad-element selectors. MutationObserver catches dynamic injection.
04 — Fingerprint Resistance Canvas gets per-session noise. WebGL reports “ANGLE (Generic GPU)”. AudioContext oscillators micro-detuned. Hardware reads as 4 cores / 8 GB. Screen resolution rounded.
05 — Encrypted DNS DNS queries through Cloudflare DoH. Optional pfSense DNS server with HMAC-SHA256 signed queries, timestamp/nonce replay protection, and TLS 1.2+ cert pinning.
06 — Local Encryption Passwords encrypted with AES-256-GCM. Key derived via Argon2id (memory-hard). PBKDF2 fallback if argon2-cffi unavailable. Nothing plaintext.

How It Works

Privacy is not a feature. It's the architecture.

Every layer of Shroudbyte is designed to minimize your exposure. It's not just a content blocker, and it's not just a browser with a privacy mode checkbox. It's a more deliberate browsing path.

Page-level protection

Cosmetic filtering hides 32+ ad-element selectors and cookie banners. MutationObserver catches dynamically injected ad content. Script interception blocks 13 ad-script patterns at document load.

Request-level protection

34 tracking parameters stripped from URLs. HTTPS-only enforcement on all navigations. DNT headers on every outgoing request. Local addresses auto-exempted.

Network-level protection

111 tracker domains blocked at the network layer with parent-domain matching. DNS-over-HTTPS via Cloudflare. Optional self-hosted pfSense with HMAC-signed queries and TLS cert pinning.

Canvas: Noised
WebGL: Generic GPU
Audio: Detuned
CPU Cores: 4 (spoofed)
Memory: 8 GB (spoofed)
Screen: Rounded

Filter Lists

Community-powered protection.

Six curated filter lists, five enabled by default. Updated from their sources with a single click.

EasyList

Primary ad-blocking rules

EasyPrivacy

Tracking scripts & pixels

Fanboy's Annoyance

Cookie notices & popups

Fanboy's Social

Social media widgets

Peter Lowe's List

Domain-level ad blocklist

URLhaus Blocklist

Known malware & phishing

Comparison

More control than a typical browser. More network awareness than most privacy claims.

Comparison of privacy features across Shroudbyte, typical browsers, and privacy browser baselines
Feature	Shroudbyte	Typical Browser	Privacy Browser Baseline
Network-level tracker blocking	111 domains hardcoded	Usually extension-dependent	Often included
Tracking parameter stripping	34 params stripped	Rare	Sometimes partial
Fingerprint resistance	6 vectors spoofed	Mostly absent	Varies widely
Cosmetic filtering	32+ selectors + MutationObserver	Extension-dependent	Some support
DNS-over-HTTPS	Built-in, configurable provider	Some support	Limited
Encrypted password vault	AES-256-GCM + Argon2id, local-only	Cloud-synced	Varies
HTTPS-only mode	Built in + DNT headers	Some support	Common
No telemetry / no phone home	Zero telemetry	Usually phones home	Claims vary
Linux-first focus	Built for Linux	Rarely	Sometimes
Open source	GPL v3	Varies	Often

Architecture

Clean, readable code.

Pure Python. No Electron. No bloated framework. Just PyQt6, Chromium's QtWebEngine, and the standard library.

mainwindow.py

Tabs, toolbar, menus, settings dialog, content blocking injection, session auto-save (every 30s), keyboard shortcuts.

adblock.py

QWebEngineUrlRequestInterceptor. Network-level domain blocking, DNT header injection, tracking parameter stripping.

filterlists.py

Downloads and parses hosts-file and ABP-format filter lists. Generates cosmetic CSS. Batches selectors in groups of 50.

fingerprint.py

JavaScript injection for Canvas, WebGL, AudioContext, hardware, and screen spoofing. Seeded PRNG per session.

passwords.py

AES-256-GCM vault. Argon2id key derivation (PBKDF2 fallback). UUID4 entry IDs. URL matching strips www. prefix.

dns_proxy.py

Local SOCKS5 proxy with HMAC-authenticated DoH. TLS cert pinning. DNS cache with 30–300s TTL. Async relay.

webview.py

Custom QWebEngineView/Page. HTTPS-only enforcement, loopback rewriting, popup support, rich context menus.

storage.py

JSON-based persistence. Bookmarks, history (5,000 max), settings, session state. All data in ~/.shroudbyte/.

crashhandler.py

Global exception handler. Logs to ~/.shroudbyte/crash.log (512 KB max, auto-rotates). Shows Qt dialog on crash.

Built with

Python 3.10+ PyQt6 QtWebEngine (Chromium) cryptography argon2-cffi keyring

Shortcuts

Keyboard-driven workflow.

Familiar shortcuts. No surprises.

Tabs

CtrlTNew Tab

CtrlWClose Tab

CtrlShiftTReopen Closed

Alt1-9Switch to Tab

Navigation

CtrlLAddress Bar

F5Reload

CtrlShiftRHard Reload

CtrlFFind in Page

Privacy

CtrlShiftPPrivate Window

CtrlShiftMPassword Mgr

CtrlShiftLAuto-fill

Tools

F12Developer Tools

CtrlUView Source

CtrlHHistory

CtrlJDownloads

Get Started

Three commands. That's it.

Requires Python 3.10+ on Linux. Dependencies: PyQt6 ≥ 6.5.0, PyQt6-WebEngine ≥ 6.5.0, cryptography ≥ 41.0.0, argon2-cffi ≥ 23.1.0, keyring ≥ 24.0.0.

$ git clone https://github.com/WebWalker3D/Shroudbyte.git
$ cd Shroudbyte && pip install -r requirements.txt
$ python3 run.py

✓ Shroudbyte is running. Happy private browsing.

Clone from GitHub GPL v3

Desktop integration

cp shroudbyte.desktop ~/.local/share/applications/
chmod +x shroudbyte.sh

Self-hosted DNS (pfSense)

HMAC-SHA256 signed queries, replay protection, TLS cert pinning.

ssh admin@pfsense "sh -s" < pfsense/deploy.sh

Dependencies

PyQt6 ≥ 6.5.0
PyQt6-WebEngine ≥ 6.5.0
cryptography ≥ 41.0.0
argon2-cffi ≥ 23.1.0
keyring ≥ 24.0.0

Data Storage

Your data stays local.

Everything lives in ~/.shroudbyte/. No cloud. No accounts. No sync servers.

~/.shroudbyte/

bookmarks.json Saved bookmarks

history.json Browsing history (5,000 max)

settings.json All preferences

session.json Open tabs for restore

passwords.enc Encrypted credentials

passwords.salt Argon2id / PBKDF2 salt

blocked_hosts.txt Custom block rules

filter_settings.json Filter list toggles

filters/ Cached filter lists

Trust & Privacy

Zero telemetry. Zero phone-home. Zero accounts.

Shroudbyte collects no data. No analytics, no crash reporting to external servers, no usage metrics. Everything stays on your machine in ~/.shroudbyte/.

No data collection or telemetry of any kind
Browsing history never leaves the device
Passwords encrypted locally with AES-256-GCM + Argon2id
DNS queries routed through DoH (Cloudflare or self-hosted)
Crash logs stored locally (512 KB max, auto-rotated)
Open source under GPL v3 — audit the code yourself

View Source Code Report Issues

What they don't know can't be sold.

Everything you need.Nothing you don't.