ShadowBrowser

Sealed session control

Gateway: connecting...

Owner command

Log in once.
Share a sealed stream.

Provision isolated Chromium, hand a helper a time-boxed link, revoke in one click. Cookies stay in the volume — passwords never leave the room.

Fleet

Browser profiles

No profiles yet

Spawn an isolated container to start a sealed session.

Egress

Home proxy gateway

Checking
Egress IP — Residential when home agent is online
Agent Offline No home tunnel connected
Agents 0 online Active home tunnels

Run the home agent on your PC so cloud Chromium exits via your residential IP. Agent dials out — no inbound ports at home.

node home-agent/agent.js

Trail

Audit log

Waiting for gateway events…

Supervision

Live helper stream

No profile selected
Delegated desktop
Latency: —
No active session

Awaiting session

Select a profile or open Helper View for the live stream.

Helper
Permission Full Interaction
Input tracking Armed
Last action —

Select an active profile, then revoke to cut the helper instantly.

Capability link

Active share

Verify helper

Pending claims

Approve only if the IP/device matches the person you phoned. Deny reshared opens.

No pending helper claims

Helper sandbox

What your helper sees: the live Chromium stream, not your passwords. Use Link on a profile to load the real session here.

Sim controls

WebRTC P2P (Home Node)

Helper actions

🔒
Shared Session (Encrypted)

Your News Feed

Logged in as: Oluwafemi Adebayo Adeyemi

Jane Smith 2 hours ago
Looking for recommendations on the best cloud database configurations for small-scale production servers. PostgreSQL or MySQL?
Devon Tech Yesterday
ShadowBrowser is a game changer for remote task delegation! No more password resets or risk-heavy remote desktop apps.

Oluwafemi Adebayo Adeyemi

Cloud Security Architect | Tech Lead

2,482 connections
142 posts

About

Building secure, scalable, and persistent cloud browser sessions to revolutionize delegated workflows and remote operations without compromise.

Inbox Messages

Alex Adeyemi (Brother)

Hey, I'm logging in to check that setting you mentioned...

Sarah Connor

Project updates are uploaded to the shared folder.

Account Settings

Security & Credentials

⚠️ Password: ••••••••••••••••• (Disabled in Remote Session)

You are logged in through an authorized delegated session. Passwords and credentials cannot be read, changed, or revealed.

Session Information

Session IP: 12.84.192.4 (Comcast Residential Network)

Host Region: US-East-1 AWS Cloud

🔒

Session Terminated

Your access to this browser session has been revoked by the owner.

Code: ERR_SHADOWBROWSER_ACCESS_REVOKED

Operator

Remote helper
runbook

Tunnel → create → link → revoke. Keep the tunnel (or VPS) up while the helper is connected. Laptop sleep kills Docker and the share.

  1. 1

    Start the stack

    Docker Desktop running, then from the project folder:

    docker compose up --build -d

    Dashboard: npx serve . -p 3000 → open http://127.0.0.1:3000 (prefer 127.0.0.1 over localhost).

  2. 2

    Expose a public URL

    Quick tunnel (no Cloudflare account). Keep the window open:

    powershell -ExecutionPolicy Bypass -File scripts/start-quick-tunnel.ps1

    Script registers PUBLIC_BASE_URL with the gateway. Banner should say Remote helper access is live. For always-on access, deploy gateway + Docker to a VPS instead.

  3. 3

    Create profile & log in

    Command → Create profile → pick a Customer plan:

    • View — read-only stream, 1h sessions (lower cost)
    • Assist — full control, normal stream, 3h links (standard)
    • Live — full control + WebRTC for video/meetings (premium)

    Open Helper View (or the share link yourself), log into the target site once. Cookies stay in the volume.

  4. 4

    Share the sealed link

    Select the profile → Link. Duration and security defaults come from the plan (View = 1h, Assist/Live = 3h). Keep claim code + owner approve on unless you have a reason to loosen them. Send the URL and tell them the claim code on a call. Approve only their Pending claim.

  5. 5

    Revoke when done

    Select the profile → Revoke access now (or Revoke on the card). Helper stream dies immediately. Resume later if you need the same cookies; Delete wipes the volume.

Home egress (optional)

For residential IP: node home-agent/agent.js on your PC with matching AGENT_TOKEN, then create the profile with Home Gateway tunnel mode.

Secrets before public

Set OWNER_SECRET, SECRET_KEY, and AGENT_TOKEN in .env. Lab defaults in the dashboard config must not ship on a public tunnel.

System

Built for sealed delegation

ShadowBrowser targets the two failure modes of remote help: datacenter IP detection and uncontrolled machine access. Cookies stay in the volume. Helpers get a stream — not your passwords.

Hybrid tunneling

Cloud Chromium exits through your home agent over TLS. Banks and social sites see your residential IP, ISP, and geo — not a VPS fingerprint.

Live stream

KasmVNC / WebRTC pipes the virtual display to the helper’s browser. No install on their side — open the sealed link and work.

DOM sanitization

Proxy strips password autofill, blocks sensitive actions, and fences chrome:// settings so helpers cannot escalate into credentials.

Isolated profiles

Each profile is a Docker container with its own volume. Log in once; cookies persist. Revoke kills the share without wiping the profile.

Customer plans

View (read-only, normal stream) · Assist (full control, normal) · Live (full + WebRTC meeting). Each plan sets permissions, stream quality, and link TTL automatically.

Data flow

Owner Command / Gateway
Sealed stream
ShadowBrowser Chromium container
Home egress
Target sites Bank / social
Success message here