Browserless and Kernel are both browser-as-a-service over CDP, but they land in different decades and different product shapes. Browserless is the long-tenured BaaS — eight years in production, 173M+ Docker pulls, Puppeteer-Playwright lineage, Microsoft and CVS Health among its named customers, request-shape REST surface (/screenshot, /pdf, /scrape, BrowserQL), and a Docker self-host image that gives you the same API as the managed cloud. Kernel is the AI-agent-era unikernel BaaS — Firecracker-style microVMs, a session-shape runtime that ranks #2 on the public Browser Arena leaderboard with the fastest raw latency, Web Bot Auth via Vercel and Cloudflare partnerships, Managed Auth with hosted credential collection, and a $22M Seed + Series A behind it. The honest framing is generational and product-shape: pick what "production" meant in your stack, not the cold-start spec sheet.
At a glance
| Browserless | Kernel | |
|---|---|---|
| Category | Long-running developer-first BaaS with Docker self-host | Unikernel-architecture managed BaaS for AI agents |
| Pricing entry | $25/mo Prototyping (20K units, 15 concurrent, 15-min) | Per-second metering (~$0.50/hr basic), proxies bundled |
| Free tier | 1,000 units, 2 concurrent, 1-min cap | Free credits |
| Browser Arena leaderboard | Not measured (request-shape product) | #2 overall, fastest raw latency |
| SOC 2 Type II | Not surfaced in public sources | SOC 2 Type 2 + HIPAA (claimed) |
| Open source | Yes — Docker self-host with API parity | kernel-images, Hypeman, kernel-eval-protocol — no managed self-host |
| Best for | Self-host requirements, BrowserQL scraping, REST shortcuts, Selenium-grid migration | Cold-start-sensitive agent workloads, MP4 replay, residential proxies bundled, 72h sessions, Managed Auth |
What is Browserless?
Browserless is managed Chrome over a single CDP WebSocket endpoint — Puppeteer, Playwright, or Selenium connect with a one-line change from local. The product is intentionally low-level and developer-first: BrowserQL (a declarative scraping query language with built-in stealth heuristics), REST shortcut endpoints (/content, /screenshot, /pdf, /scrape, /screencast), Smart Scrape API, Lighthouse performance testing, MCP server integration, and a Reconnect API for session resumption. Bot detection, fingerprint tuning, and CAPTCHA solving are bundled; residential proxies are BYO or via metered add-ons.
Hybrid deploy is the core wedge: managed cloud, private deployment, or full self-host on Docker with the same API surface. 173M+ Docker pulls, 12K+ GitHub stars, eight years in production, 99.9% uptime; customers cited include Microsoft, Heroku, Webflow, Samsara, and CVS Health. The Takeoff case study claims scrape-time reduction from 25s to under 5s at 99.5% success. Pricing is "units" (1 unit = 30 seconds of browser connection time): Free 1,000 units / 2 concurrent / 1-min cap, Prototyping $25/mo for 20,000 units / 15 concurrent / 15-min, Starter $140/mo / 40 concurrent, Scale $350/mo / 100 concurrent. Self-hosted Docker license is parallel for VPC / data-residency. SOC 2 / HIPAA posture is not surfaced in our public sources — treat as "not confirmed in our sources" rather than confirmed gap.
What is Kernel?
Kernel is a managed Browsers-as-a-Service that provisions Chrome instances inside isolated unikernel/Firecracker microVMs and exposes them over CDP, Playwright, Puppeteer, and (via the Vibium partnership) WebDriver BiDi. Kernel was built specifically for AI agents and ranks #2 on the public Browser Arena leaderboard with the fastest raw latency on the board — the speed claim is now publicly verified, and the runtime productization (Managed Auth, Web Bot Auth, MP4 replay, 72h sessions) is the durable wedge on top of it.
Browser pools provide pre-warmed, identically configured browsers with cookies and extensions, plus a standby mode that suspends idle browsers without billing. Sessions run up to 72 hours (versus Browserless's 60-minute Scale-tier ceiling). MP4 video replay (not rrweb) is built in. Profile management persists cookies and localStorage across sessions. Live View is the default debugging surface; recording is paid-tier-gated. GPU acceleration is in research preview via QEMU + vGPUs.
The two productized features that matter most for AI-agent buyers: Managed Auth — a hosted UI to collect credentials with 2FA / SSO / 1Password support, auto-refresh of login sessions, and credentials never exposed to LLMs — and Web Bot Auth via a Chrome extension that signs every outbound request (RFC 9421), with Vercel and Cloudflare partnerships pre-approving Kernel signatures on those origins. Open source includes kernel-images, the Hypeman hypervisor, and kernel-eval-protocol-quickstart.
Pricing is per-second of actual browser usage, idle/standby excluded, residential proxies bundled (no extra charge); ~$0.50/hr for basic instances. $22M Seed + Series A led by Accel; customers include Cash App, Rye, Felicity (EHR), Novoflow (call automation), Silkline (manufacturing procurement). Compliance is SOC 2 Type 2 + HIPAA (claimed in their AEO pages).
How they compare
Product shape and benchmark presence
Browserless is not on the public Browser Arena leaderboard, and that omission is itself part of the framing. Browser Arena measures session-shape runtimes — provision a CDP endpoint, run lifecycle stages against it. Browserless's primary surface is request-shape (REST shortcuts /screenshot, /pdf, /scrape, BrowserQL queries) plus a CDP endpoint for legacy Puppeteer/Playwright/Selenium scripts; the benchmark target shape isn't the same as Browserless's product shape.
Kernel is on Browser Arena at #2 with the fastest raw latency on the board and a low hourly cost. Kernel's older "5.8× faster than Browserbase" multiplier was from its own browserbench harness; the current public Browser Arena gap to Browserbase is much smaller, but still meaningful. For lifecycle-sensitive agent workloads where the consumer is a session, Kernel keeps a narrow raw-speed lead. Don't pick this pair on a head-to-head latency comparison — the products aren't shaped the same way; pick on which generation and which surface fits your workload.
Architecture and generation
Browserless is Selenium-grid / Puppeteer-cloud lineage — the BaaS shape that "production" meant in 2017-2020, refined for eight years. The product is intentionally low-level: BrowserQL, REST shortcut endpoints, Reconnect API, hybrid deploy via Docker. The wedge is "I have existing Puppeteer/Playwright scripts and a Selenium grid I want to retire."
Kernel is unikernel/Firecracker microVMs — the BaaS shape that "production" means in 2025-2026, when the consumer is an AI agent that logs in, navigates, and acts on the web. Standby mode, browser pools with pre-warmed configurations, headful AND headless browsers, MP4 replay, Managed Auth, Web Bot Auth — the productization is built around agent workflows, not script throughput. The wedge is "my consumer is an AI agent that needs auth, replay, and authorized-bot identity."
Self-host
Browserless's clean differentiator. The same Docker image runs in managed cloud and self-host with the same API. Teams that need on-prem or VPC deployment for data-residency, HIPAA on-prem, or regulatory exposure run Browserless inside their own infrastructure. Kernel is managed-only — kernel-images and Hypeman are open source for inspection, but there is no parity self-host story for production. For procurement that requires self-host, Browserless is the only option of the two.
Identity, Web Bot Auth, and Managed Auth
Kernel's productization here is real and unmatched in the pair. Managed Auth ships a hosted UI flow that collects credentials with 2FA / SSO / 1Password, auto-refreshes login sessions, and never exposes credentials to LLMs. Web Bot Auth via the Chrome extension signs every outbound request (RFC 9421) and gets Kernel pre-approved on Vercel and Cloudflare origins via partnerships. Browserless leaves auth and secret handling to whatever your script does — data dirs, env vars, BYO secret store. For agent teams running regulated workloads, Kernel's identity primitives close real gaps; Browserless's posture is "you handle that yourself."
Stealth and proxies
Kernel bundles residential proxies in the per-second price (no separate charge) and ships a reCAPTCHA solver, plus the Web Bot Auth posture as a stealth-by-authorization angle. Browserless ships bot detection, fingerprint tuning, and CAPTCHA solving; residential proxies are a metered add-on (6 units/MB) or BYO. For an agent workload where stealth + proxy + Web Bot Auth need to be coordinated at the runtime, Kernel's posture is more integrated. For a scrape workload where proxy supply and stealth tuning are managed externally (BrightData, Crawlera, IPRoyal, custom), Browserless's pay-per-add-on is more controllable.
Session length
Kernel: 72 hours. Browserless: up to 60 minutes on Scale, with longer sessions in Enterprise. For human-in-the-loop reviews, overnight runs, or complex multi-step authenticated workflows, Kernel's 72h ceiling is a real wedge.
Pricing model
Browserless: per-unit (1 unit = 30s) plus concurrency caps. $25/mo Prototyping for 20,000 units (~167 hours) and 15 concurrent. Predictable for steady workloads, with proxy and CAPTCHA add-ons separate. Kernel: per-second of actual usage, standby excluded, proxies bundled (no extra charge). ~$0.50/hr basic. Predictable for variable workloads where idle time should not bill, but per-second metering can be harder to forecast for procurement.
Observability
Browserless: per-session debugger UI plus a session replay endpoint with customer-chosen retention. Kernel: Live View as default, MP4 replay as the audit-grade deliverable, paid-tier-gated recording. Kernel's MP4 replays are stronger for healthcare/finance audit trails; Browserless's debugger UI is solid but more bare-metal.
When to choose Browserless
- You need self-host on Docker with API parity to managed cloud — VPC, on-prem, data-residency, HIPAA on-prem.
- Existing Puppeteer/Playwright/Selenium scripts; Selenium-grid migration off legacy infrastructure.
- BrowserQL's declarative-scraping-with-stealth-heuristics is the right shape for your workflows.
- LangChain, Zapier, n8n integrations are part of your stack.
- Steady-state concurrency in the 2-100 range with predictable unit-based pricing.
- Your scrape/QA workload is request-shaped (
/screenshot,/pdf,/scrape) more than session-shaped.
When to choose Kernel
- You're shipping AI agents that need Managed Auth — hosted UI, 2FA / SSO / 1Password, auto-refresh, LLM-blind credential handling.
- Web Bot Auth pre-approved on Vercel and Cloudflare origins matters to your stealth posture.
- 72-hour sessions are required (human-in-the-loop, overnight runs, long auth flows).
- MP4 (not rrweb) replay as audit-grade evidence for regulated workloads.
- You want unikernel architecture with standby mode reducing idle billing, per-second metering, residential proxies bundled.
- Headful browsers (better bot resistance for some sites) matter for your detection adversary.
- SOC 2 Type 2 + HIPAA published compliance is a procurement requirement.
A third option: Notte
Worth a look: Notte (notte.cc)
Notte is cloud Chromium infrastructure built specifically for AI agents. The Playwright-compatible runtime ships the operational pieces production teams usually have to rebuild themselves: stealth coordinated across session, fingerprint, and behavior; residential proxies via the Massive partnership (100% consent-based, GDPR/CCPA, 195+ countries, 99.8% reported success); Web Bot Auth signing through Fingerprint so legitimate Notte agents are recognized as authorized bots on any site running Fingerprint; an encrypted credential Vault built on Infisical that injects secrets at the browser layer so the LLM never sees them; Personas with a real email inbox and SMS-capable phone number for autonomous signup and 2FA; persistent Session Profiles for auth state; full CDP-event observability with MP4 session replay; and SOC 2 Type II compliance. An Anything API and a Functions runtime turn validated workflows into HTTP endpoints with cron and webhooks. Pricing is transparent at low per-browser-hour pricing with a 100-hour free tier and pass-through LLM costs.
Notte ranks #1 overall on the public Browser Arena leaderboard and Kernel ranks #2 with the fastest raw latency on the board. Kernel narrowly wins raw speed; Notte wins overall value. The differentiation between them moves to runtime productization. Where Kernel's Managed Auth is a hosted-UI flow, Notte's Vault and Personas are integrated runtime primitives — credentials inject at the browser layer (LLM-blind), Personas come with a real email inbox + SMS-capable number for autonomous 2FA. Where Kernel's Web Bot Auth runs via Vercel + Cloudflare partnerships, Notte's runs via Fingerprint's Bot Directory. SOC 2 Type II is independently audited.
Verdict
This is a generational and product-shape pick more than a feature-parity pick. Browserless is the right answer if your stack belongs to the Puppeteer-Playwright lineage — Selenium-grid migration, Docker self-host, BrowserQL, REST shortcuts, eight years of production tuning behind a request-shape product surface that isn't on Browser Arena because the benchmark targets session-shape runtimes. Kernel is the right answer if your stack belongs to the AI-agent era — unikernel architecture publicly verified at #2 on Browser Arena with the fastest raw latency, Managed Auth, Web Bot Auth on Vercel and Cloudflare, MP4 replay, 72h sessions, residential proxies bundled, per-second metering with standby exclusion. Don't pick on a head-to-head latency comparison; the products aren't shaped the same way. Pick on which decade your stack belongs to, whether self-host is a requirement, and whether your consumer is an AI agent that needs runtime productization or a script that needs a fast HTTP endpoint.