# sardanioss/httpcloak

Go HTTP client with browser-identical TLS/HTTP2 fingerprinting. Bypass bot detection by perfectly mimicking Chrome, Firefox, and Safari at the cryptographic level (JA3/JA4, Akamai fingerprint, header order). Supports HTTP/1.1, HTTP/2, HTTP/3, sessions, cookies, and proxies.

Repository: https://github.com/sardanioss/httpcloak
Canonical: https://ross.abutalabs.com/products/httpcloak
Homepage: https://httpcloak.dev
Language: Go
License: MIT
License Family: permissive
Topics: anti-bot, bot-detection, browser-fingerprint, browser-fingerprinting, cloudflare, go, golang, http-client, http2, http3, ja3-fingerprint, ja4-fingerprint, quic, tls-fingerprint, tls-fingerprinting, web-scraping, js, nodejs, python, python3
Last push: 2026-09-02T22:53:58+00:00

## Health v2 (maintenance only)
Score: 61/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 100, release rhythm 35, longevity 17
- inputs: {"age_days": 248, "days_push": 0, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1276, forks 93 (observed 2026-09-03T02:15:17.650149+00:00)

## What it is
httpcloak is a Go HTTP client library that reproduces browser-identical TLS, HTTP/2, and HTTP/3 fingerprints (JA3/JA4, Akamai, header ordering) to bypass bot detection. It ships bindings for Python, Node.js, and .NET via a shared cgo library, with sessions, cookies, and proxy support including MASQUE.

## Use cases
- scrape sites protected by Cloudflare bot detection
- make requests indistinguishable from Chrome at the TLS level
- bypass JA3/JA4 fingerprint blocking
- send HTTP/3 requests with browser-matching QUIC parameters
- rotate browser presets like chrome-latest or firefox in a scraper
- use encrypted SNI (ECH) to avoid SNI-based blocking
- persist sessions with cookies and TLS tickets across processes

## When to choose
- you need HTTP/3 or ECH support that curl_cffi lacks
- you're blocked by TLS or HTTP/2 fingerprinting on a target site
- you want one API across Go, Python, Node.js, and .NET
- you need MASQUE proxying or domain fronting

## When to avoid
- you just need a normal HTTP client with no anti-bot concerns
- your use case violates a site's terms of service or local law
- you need a pure-Python or pure-JS implementation without native binaries
- you require long-term stability guarantees from a mature ecosystem library

## Facets
- artifact type: library
- maturity: active
- function: http-client, web-scraping, security, networking, proxy
- domain: web-development, security, crawlers, developer-tools, privacy
- platform: go, python, dotnet, windows, cross-platform
- tags: tls-fingerprinting, ja3, ja4, anti-bot-bypass, http2, http3, quic, ech, browser-impersonation, utls, curl-cffi-alternative, nodejs, linux, macos

## Member repositories
- sardanioss/httpcloak (main) score 61

## Provenance
- Observed fields: from GitHub, fetched 2026-09-03T02:15:17.650149+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T05:07:30.486667+00:00, confidence not recorded.
  - readme: https://github.com/sardanioss/httpcloak (fetched 2026-09-03T02:15:17.650149+00:00, sha 39c349437020)
  - homepage: https://httpcloak.dev (fetched 2026-08-29T12:18:08.828093+00:00, sha 2ffa164990bd)
  - site_page: https://httpcloak.dev/installation (fetched 2026-08-29T12:18:08.837753+00:00, sha cfba9709ae73)
  - site_page: https://httpcloak.dev/getting-started (fetched 2026-08-29T12:18:08.839702+00:00, sha e573756742d8)
  - site_page: https://httpcloak.dev/changelog (fetched 2026-08-29T12:18:08.841452+00:00, sha f803672a48a0)
- Data as of 2026-08-30T08:39:29.467469+00:00.