I build things that most people look at and say "you can't do that." Then I do it, and then I write the documentation nobody asked for.

A year ago I was making websites. Today I'm writing a browser engine in C++. Somewhere in between, I got curious about how things actually work underneath, and I never recovered.

flowchart LR
    A["🌐 Made websites"] --> B["🤔 How does JSX become HTML?"]
    B --> C["⚛️ Tried building a React-like thing: too hard, shelved"]
    C --> D["💬 whatsapp-web.js and a pile of WhatsApp bots"]
    D --> E["🕹️ Discovered you can control a browser and scrape"]
    D --> K["📡 Learned Baileys, then wanted the direct way it talks"]
    K --> L["🎯 Rule of life: go to the source"]
    E --> F["🧱 Cloudflare: blocked, blocked, blocked"]
    F --> G["🐷 Built Nothing Browser on Qt6"]
    G --> H["😤 Injecting JS into Qt was painful"]
    H --> I["🔧 Built my own engine: LucyN"]
    L --> I

Does nothing... except everything that matters.

A scraper-first browser for API reverse engineering, web scraping and automation research. Most browsers hide the web from you; this one exposes it.

_{Nothing Browser, Phase 1 (Qt6 + Chromium WebEngine)}

• 🔍 Full network inspector: every request, response, WebSocket frame, cookie and storage write
• 📤 One-click export to Python requests, curl_cffi, cURL, JS fetch or raw HTTP
• 🎭 Engine-level fingerprint spoofing (UA, WebGL vendor, screen, hardware)
• 🔌 Community plugin system, in-app auto-updates, zero telemetry

📦 Repo · 📚 Docs · 📥 Releases

We don't care about beauty. We care about stealth, capture and truth.

The next phase of Nothing Browser: my own engine, its own API and client, and everything around it, built from the ground up because injecting JS into Qt kept fighting me. It replaces Chromium and the old automation library. One goal: be invisible.

No Qt. No Chromium. No CDP. No remote debugging ports. No automation flags. No difference between headless and headful. The engine always presents itself as a real, human-operated browser, because as far as it's concerned, it always is. No multi-gigabyte toolchains either: Gumbo, QuickJS, stb and Mongoose live in the repo as plain vendored source.

libcurl ──▶ Moonbug ──▶ NULLBYTE ──▶ TinyElysia ──▶ Dashboard
 (fetch)    (capture)     (sign)       (serve)
    │
    ▼
 HTML ──▶ Gumbo ──▶ DOM ◀──▶ QuickJS (DOM bridge)

_{Moonbug, live: every request the engine makes, with timing and headers in wire order}

✅ Built and tested

• 🕸️ Moonbug: LucyN is the HTTP client, so it captures decrypted traffic natively, with a DNS / connect / TLS / first-byte timing breakdown and headers in wire order. No MITM certs, no proxy, nothing a page can reach
• 🔐 NULLBYTE: HMAC-SHA256 signing, so captured traffic can be proven untampered
• 🧩 TinyElysia: HTTP + WebSocket server in C/C++ (Elysia-inspired, zero Bun), serving a live capture dashboard on localhost
• 🌳 DOM + QuickJS bridge: document, fetch, XHR, cookies, timers and per-origin storage, enough to scrape JS-rendered pages with no pixels
• 💉 LucyScript: userscripts injected through a shell page, with @run-at start|end, plus before/after DOM snapshots and diffs
• 🎭 Identity profiles: one consistent "person" per session (UA, client hints, platform values, Chrome header order). Consistency beats randomness
• ⬇️ Streaming downloads straight to disk, using the same identity and cookie jar
• 🔌 JS client over newline-delimited JSON on stdio: visit, extract, eval, click, waitFor, cookies and downloads. No TCP port, nothing the page can see
• 📦 Portable by design: all data lives in nothing-data/ next to the binary. Delete the folder and the browser forgets everything

🔨 Coming next

• 👻 Ghostful Mode: no fake headless, just a real SDL window with the curtains drawn
• 🖼️ SoftwarePainter, block/inline layout and basic flexbox
• 🛡️ Built-in ad blocker at the request layer, cookie persistence
• 🧬 curl-impersonate TLS/HTTP2 fingerprinting (the dashboard honestly flags requests as NOT impersonating until it lands), fingerprint hardening and process isolation

import Lucyn from "nothing-browser";

const a = new Lucyn({ profile: "chrome", moonbug: true });

a.moonbug.onRequest(r => console.log(r.status, r.url, r.sig));   // the wiretap, from JS

const { status, title } = await a.visit("https://books.toscrape.com");
console.log(status, title);
await a.close();

The rendering promise: did it render? ✅ Is it pretty? 💩 Can I scrape it? 👻

Stealth is a measured result, not a claim: the test plan is tls.peet.ws, bot.sannysoft.com, CreepJS and BrowserLeaks, and every failing check becomes a ticket. Named after LucyN. She knows why. 👀

Your midnight cinema, always open. A free Android app for movies, series and anime: adless streaming, offline downloads, a native video player, TMDB metadata, live channels, and weekly Saturday patches. Rebuilt from scratch in 100% native Kotlin because the old version kept crashing and I refused to ship something that falls over.

🌐 Website · 💬 Telegram

_{Part of the Nothing Ecosystem · Built in Kenya 🇰🇪}