What is Steel?
Steel Browser is an open-source browser API from Nen Labs, Inc. of Beaverton, Oregon. It runs Chrome under Puppeteer and wraps it in an HTTP service that creates sessions, keeps cookies and local storage between requests, chains proxies, loads Chrome extensions, applies stealth plugins and fingerprint settings, and offers quick /scrape, /screenshot and /pdf endpoints. Puppeteer, Playwright and Selenium connect to its sessions, and a built-in UI shows sessions live and replays them.
The repository dates from November 2024, has about 7,960 GitHub stars and is Apache-2.0. It is still labelled public beta; v0.5.5-beta shipped on 31 October 2026.
Steel Cloud is the hosted product: many sessions at once, managed residential proxies, CAPTCHA solving, persistent profiles, a Credentials API, a Files API and a hosted MCP server. Steel's own comparison lists most of those as cloud-only.
Is Steel worth it?
Steel's open-source project and its paid service are different products, and the gap between them is the review. Self-hosted steel-browser is a tidy HTTP and CDP layer over one Chrome: sessions, cookies, proxies you bring yourself, extensions, quick scrape and screenshot calls, and a viewer for live and past sessions. Steel's own documentation puts self-hosted concurrency at 1 and lists CAPTCHA solving, the Credentials API, the Files API and the MCP server as unavailable locally, with stealth described as limited. A team that wants dozens of parallel agents either builds its own cluster from the self-hosting guide or pays for Steel Cloud.
The cloud prices are clear and billed by the minute. Launch costs nothing up front and includes $30 of credits for 90 days, which the docs say buys about 300 browser hours at $0.10 an hour; Scale is $250 a month with $100 of credits and hours at $0.08. Session length is capped at 15 minutes on Launch and 1 hour on Scale, up to 24 hours on Enterprise, which matters more than the hourly rate for agents that work through long logged-in flows. Steel's Stealth Browser, its own Chromium fork, is Enterprise only.
The security model needs reading before deployment. SECURITY.md says plainly that the self-hosted service has no authentication: anyone who can reach port 3000 (API and UI) or 9223 (raw CDP) can make the browser fetch any URL and read the result, which includes cloud metadata addresses. It tells you to publish the ports on 127.0.0.1 only, put your own authentication in front and block 169.254.169.254, and warns that Docker-published ports bypass host firewalls such as UFW. The README's one-line docker run publishes both ports on every interface, so copying it onto a server is the mistake to avoid.
In the cloud, your browsing state lives with Steel. Profiles are snapshots of the whole Chrome user data directory, cookies and saved logins included, up to 300 MB each and deleted after 30 days unused. The Credentials API stores usernames, passwords and TOTP secrets encrypted against your organisation and fills them into pages without exposing them to the agent. Session data is kept 7 days on Launch and 14 on Scale. Steel's privacy policy says its servers are in the United States but covers the website and your account, not the contents of sessions; Scale includes a HIPAA-ready BAA, and no SOC 2 report is named in the documents we read.
Against lightpanda and obscura, the trade is the opposite one. Those replace Chrome's engine to save memory and accept that some pages break; Steel keeps Chrome, so compatibility is Chrome's and so is the memory bill. Its CAPTCHA solving, residential proxies and mobile fingerprints are aimed at sites that resist automation, and the terms-of-service exposure on those sites sits with the customer, not with Steel.
Where it earns its place
A two-person start-up building an agent that books appointments on clinic portals
Keep agents logged in across runs without handing passwords to the model
Store each portal login with the Credentials API and reuse a persisted profile per account; Steel fills and blurs the fields, typically within 2 seconds. On Scale that is $250 a month with $100 of credits, then $0.08 per browser hour.
A QA engineer with an existing Selenium suite
Run the suite on hosted browsers instead of a self-managed grid
Create sessions with isSelenium and point the WebDriver client at Steel; the docs warn the Selenium path lacks some features of CDP sessions. Launch's 15-minute session cap rules out long suites, so Scale's 1-hour limit is the realistic tier.
A platform engineer prototyping internal browser automation
Run a browser API on a private network with no vendor in the loop
Run the ghcr.io/steel-dev/steel-browser image with ports published on 127.0.0.1 behind a reverse proxy that adds authentication. Free, but one session at a time per instance; the docs describe a cluster setup for more.
Before you commit
- Setup
- docker run the GHCR image for the API and UI on port 3000 and CDP on 9223, use the one-click Railway or Render templates, or run it with Node.js and a local Chrome. Steel Cloud needs an API key, available from the dashboard, the Steel CLI or Stripe Projects.
- Integrations
- Puppeteer, Playwright and Selenium; steel-sdk for Node and Python; guides for Stagehand and browser-use; a hosted MCP server at mcp.steel.dev for cloud accounts; the Steel CLI for Claude Code, Codex and OpenCode.
- Data and privacy
- Self-hosted, pages and cookies stay on your machine; the only telemetry code in the repository is optional OpenTelemetry tracing. Steel Cloud keeps session data 7 days on Launch and 14 on Scale, keeps profiles until 30 days unused and encrypts stored credentials; servers are in the United States.
- Cost at scale
- At 1,000 browser hours a month, Launch costs about $100 in usage and Scale about $230 ($250 plus $80, less $100 of credits), before proxies at $6 to $10 a GB and CAPTCHA solves at $1 to $3 per 1,000.
- Limits
- Launch: 10 concurrent sessions, 15-minute sessions, 60 requests a minute, 3 seats. Scale: 100 sessions, 1 hour, 600 requests a minute. CAPTCHA solving and Steel proxies on Launch need a $10 paid deposit. About 87 open issues and pull requests.
What’s good
- Real Chrome, so Puppeteer, Playwright and Selenium sessions behave as in Chrome
- Apache-2.0, with Node and Python SDKs that work against self-hosted and cloud
- Per-minute cloud billing from $0.08 a browser hour
- Stored credentials filled into pages without the agent seeing them
What’s not
- Self-hosted build runs one session at a time, without CAPTCHA solving or credentials
- No authentication on self-hosted ports 3000 and 9223
- Still labelled public beta at v0.5.5
- Cloud profiles keep cookies and logins on Steel's US servers
Best for
Teams building browser agents that need logged-in, long-running Chrome sessions and would rather pay per browser hour than run a Chrome fleet.
Steel alternatives
Steel: common questions
- Is Steel worth it?
- Steel wraps real Chrome in a sensible agent API and prices its cloud fairly, but the open-source build runs one session at a time and leaves the features people buy it for in the cloud. We rate it 3.9 out of 5.
- How much does Steel cost?
- Free to self-host (Apache-2.0). Steel Cloud: Launch $0 plus usage, with $30 of one-time credits valid 90 days, browser hours at $0.10, proxies $10/GB, CAPTCHA solves $3 per 1,000, 10 concurrent sessions; Scale $250/month plus usage, with $100 of credits a month, $0.08 an hour, $6/GB, $1 per 1,000, 100 concurrent sessions; Enterprise custom.
- What are the downsides of Steel?
- Self-hosted build runs one session at a time, without CAPTCHA solving or credentials; no authentication on self-hosted ports 3000 and 9223; still labelled public beta at v0.5.5; cloud profiles keep cookies and logins on Steel's US servers.
- Who is Steel best for?
- Teams building browser agents that need logged-in, long-running Chrome sessions and would rather pay per browser hour than run a Chrome fleet.
- How much does Steel cost for a team or in production?
- At 1,000 browser hours a month, Launch costs about $100 in usage and Scale about $230 ($250 plus $80, less $100 of credits), before proxies at $6 to $10 a GB and CAPTCHA solves at $1 to $3 per 1,000.
- Is Steel safe for company data?
- Self-hosted, pages and cookies stay on your machine; the only telemetry code in the repository is optional OpenTelemetry tracing. Steel Cloud keeps session data 7 days on Launch and 14 on Scale, keeps profiles until 30 days unused and encrypts stored credentials; servers are in the United States.
- What are the best Steel alternatives?
- The closest alternatives we have reviewed are Lightpanda, Obscura, Stagehand and Browser Use.
Answers checked Nov 13, 2026.