Website profiles · Technology insights · Alternatives

luakit.github.io

No paid content found
Visit website
Profile views 8 Outbound visits 1 Normal
Luakit Web Browser Full homepage screenshot

At a glance

Category
Development
Language
English
Paid-content signal
No paid content foundObserved
Registered
2013
Hosting
FastlyInferred
HTTPS certificate trusted
PassedObserved
Last updated

Website review

This review may include AI-generated content and is not individually verified. Domain, certificate and other facts come from the observed data on this page.

What is Luakit?

Luakit is a lightweight, keyboard-driven web browser framework built on the WebKit content engine and the GTK+ toolkit. It is licensed under GPLv3 and configured and extended with Lua, which is what makes it unusual: instead of a fixed settings menu, you edit Lua files to change keybindings, interface layout, and behavior. Its stated audience is power users, developers, and anyone who wants fine-grained control over how their browser works.

The project describes itself as fast and highly configurable. It ships a small codebase (around 9,000 lines, per the site), so building from source is quick. Features visible on the homepage include a normal browsing mode, a "follow mode" that overlays link hints for keyboard navigation, an ad blocker with configurable filter lists, themes, and vertical tabs.

Who it suits

  • Keyboard-centric users who dislike reaching for a mouse
  • Developers comfortable editing Lua configuration files
  • People on Linux, BSD, Solaris, or HURD who want a minimal browser they can reshape
  • Users who want to inspect and control ad-blocking filter lists directly

Who should look elsewhere

  • Anyone who expects a conventional graphical settings dialog
  • Windows and macOS users: Windows is only supported through WSL and is not actively maintained, and macOS is not listed at all
  • Users who want a browser that updates itself independently of the operating system

Practical trade-off: security depends on your distribution

Luakit relies on WebKitGTK+ for rendering, so its security posture is tied to whichever version your package manager provides. The project's own notice warns that some distributions ship outdated, vulnerable builds. As of the site's September 2019 note, Arch, Debian, Fedora, Gentoo, and Ubuntu packaged current versions, while OpenSUSE's stable channel did not. If you try Luakit, check your installed WebKitGTK+ version first — that single check matters more than any feature comparison.

Getting started

On Arch, install the luakit community package or luakit-git from the AUR; FreeBSD and OpenBSD have packages. Elsewhere you build from source with GTK 3, WebKitGTK+, Lua 5.1 or LuaJIT, Lua File System, and SQLite 3. OpenBSD users should compile with clang rather than GCC.

To judge whether it fits you, spend an evening editing the Lua config: if remapping keys and rewriting the interface feels natural, Luakit is a good match. If it feels like unnecessary work, a mainstream browser with a keyboard-extension will serve you better. The project lives at Luakit Web Browser, where releases, documentation, and screenshots are available.

How does Luakit compare to other lightweight browsers for power users?

Luakit is best understood as a browser framework, not a finished lightweight browser. It pairs the WebKit engine with GTK and exposes its behaviour through Lua, so power users can rewrite keybindings, modes, and interface elements rather than just toggling settings. That puts it in a different category from most "lightweight browser" alternatives, which tend to offer fewer options but work out of the box.

Where it fits among lightweight options

  • Luakit — aimed at power users, developers, and anyone wanting fine-grained control over browser behaviour and interface. Extensible in Lua; around 9,000 lines of code, so building from source is usually quick. Linux, BSD, and Solaris are supported; Windows works only through WSL, and Windows, Solaris, and HURD are described as not actively supported but known to work.
  • Terminal or keyboard-centric browsers such as qutebrowser suit people who want modal, keyboard-driven browsing with a Python configuration layer, but they are a different tool rather than a drop-in substitute.
  • Small graphical browsers such as Midori target users who want something lighter than Firefox or Chrome without writing configuration code.
  • Mainstream browsers with a minimal mode, such as Firefox, remain the safer default if you value automatic updates, extension ecosystems, and predictable rendering over deep customisation.

The trade-off that matters most

The page's own WebKit security notice is the deciding factor. Because Luakit depends on the WebKitGTK+ version your distribution packages, your security posture is tied to your distro's update channel. The page notes that as of September 2019, Arch, Debian, Fedora, Gentoo, and Ubuntu shipped the latest WebKitGTK+, while OpenSUSE shipped an outdated and vulnerable version in its stable channel. That is a distribution-level issue, not something Luakit can fix for you.

Practical guidance

If you run Arch, Debian, Fedora, Gentoo, or Ubuntu and enjoy scripting your browser, Luakit is a strong fit: install the community package or build from source, then check that your WebKitGTK+ is current. If you are on OpenSUSE, or you want a browser that stays secure without you monitoring engine versions, choose a mainstream browser instead. On Windows, expect to work through WSL and a source build.

A useful first test: install it, open the ad blocker settings page shown in the screenshots, and try editing a keybinding in Lua. If that feels like a feature rather than a chore, Luakit is for you; if it feels like maintenance, a conventional lightweight browser will serve you better.

How do I configure Luakit using Lua to customize its behavior and interface?

Luakit's configuration is Lua code, not a settings dialog. You edit a user config file that the browser loads at startup, and the same language that extends the browser also defines its keybindings, interface and behavior. That is why the project describes itself as a framework for fine-grained control rather than a browser with a preferences panel.

The typical workflow is:

  1. Start from the default configuration that ships with Luakit, so you keep working defaults.
  2. Copy it into your own config directory and edit that copy, leaving the packaged version untouched.
  3. Change one thing at a time and restart or reload Luakit to see the effect.
  4. Keep your config under version control once it grows, since a broken file can make the browser hard to use.

H3 What you can change

Because configuration is code, the practical categories are broad:

  • Keybindings and modes. Luakit uses modal input, and the screenshots on the project page show normal mode and a follow mode with link hints. You bind keys per mode, so you can add your own shortcuts or change existing ones.
  • Interface. The project shows themes and vertical tabs in its screenshots, both of which are configuration choices rather than fixed features.
  • Behavior. Settings such as ad blocking are exposed as configurable pages and Lua settings; the screenshots show an ad blocker settings page listing active filter lists.
  • Extensions. New commands, status bar indicators and small features are written in Lua, which is the "extensible with Lua" part of the description.

H3 A concrete scenario

Suppose you read long articles and want fewer distractions. You could bind a key in normal mode to toggle a minimal interface, add a command that opens the current page in a reader-style view, and set your ad blocker filter lists once in your config so they persist across sessions. None of that requires patching the browser; it is Lua you keep in your own file.

H3 Trade-offs to expect

Approach Strength Cost
Edit Lua config Full control over keys, UI and behavior You must learn the API and Lua basics
Use defaults as-is Works immediately Little customization beyond built-ins
Write extensions Add genuinely new functionality More code to maintain and debug

The main risk is not difficulty but drift: after an upgrade, a config written against an older API may need small fixes. Keeping your config small and commented makes that cheap.

H3 Where to look next

The project's own documentation is the authoritative reference for available settings and functions, and the source repository is the place to check current behavior. Luakit is distributed under the GNU GPLv3 and targets power users, developers and anyone wanting precise control, so expect to read documentation rather than click through menus. For a starting point, see Luakit Web Browser. If you prefer a browser configured through a graphical preferences window, Luakit is the wrong trade-off; if you want your keybindings and interface expressed as code, it is the right one.

How can I install Luakit on Linux or BSD?

Install Luakit on Linux or BSD either from your system's package manager (fastest, if a package exists) or by building from source (works everywhere, but you must supply the dependencies).

Package-manager installs

  • Arch Linux: install the luakit community package, or luakit-git from the AUR if you want to track development.
  • FreeBSD and OpenBSD: install the luakit package.
  • Other Linux distributions: build from source. The project notes that a Debian package was in the works, so check your distribution's repositories first before compiling.

Building from source

Install these dependencies first, then download and build:

  • GTK 3
  • WebKitGTK+ (webkit2gtk)
  • Lua 5.1 or LuaJIT
  • lfs (Lua File System)
  • SQLite 3

Luakit is small — roughly 9,000 lines of code — so compilation is usually quick. On OpenBSD, build with clang rather than GCC; the GCC shipped there is outdated and will produce compilation errors.

One thing to check before you commit

Luakit depends on WebKitGTK+, and your distribution's version matters for security. The project's own notice states that as of September 2019, Arch, Debian, Fedora, Gentoo and Ubuntu packaged the latest WebKitGTK+, while OpenSUSE shipped an outdated, vulnerable version in its stable channel. Verify your distribution's WebKitGTK+ version before relying on Luakit for everyday browsing; if it lags, consider a distribution that keeps it current.

A practical next step

If you are on Arch, FreeBSD or OpenBSD, try the package first — it handles dependencies and updates for you. If you are elsewhere, or you want a specific Luakit version, install the five dependencies above and build from source. For reference material and support channels, see Luakit Web Browser.

How do I use Luakit's follow mode for keyboard-driven link navigation?

Follow mode turns Luakit's page into a numbered set of keyboard targets: you press the follow key, every visible link gets a short hint, you type the hint, and the browser follows that link without touching the mouse.

How it works in practice

  • Trigger follow mode from normal mode (the default binding is f, with F for opening a link in a new tab in most configurations).
  • Luakit overlays hint labels on links and other clickable elements. The page shows this state in its screenshots: "Luakit in follow mode with several link hints visible."
  • You type the label shown next to the link you want. Typing narrows the match, so you rarely type the whole label.
  • The link opens according to the command you used — same tab, new tab, or another action you have bound.

Because hints are generated from what is currently visible, follow mode is most reliable on pages where all targets are on screen. On long pages, scroll first, then trigger follow mode.

Making it fit your habits

Luakit is described as a browser framework built on WebKit and GTK+, extensible with Lua and aimed at "power users, developers and anyone who wants to have fine-grained control over their web browser's behaviour and interface." Follow mode sits squarely in that design: the keybindings, hint characters and what happens after a hint is matched are configuration, not fixed behaviour. If the default hint alphabet or trigger key clashes with your muscle memory, change it in your Lua configuration rather than adapting to it.

A practical starting workflow:

  1. Keep one hand on the home row and treat follow mode as your primary way to open links.
  2. Bind a separate key for "open in new tab" so you can queue up several links without leaving the page.
  3. Use the same hint style consistently, so you stop reading labels and start typing them by reflex.

Trade-offs

Follow mode is fast and precise once learned, but it has real costs. Hint labels compete visually with page content, and on link-dense pages the labels can overlap or become ambiguous. It also assumes a keyboard-centric setup; if you switch between Luakit and a mouse-driven browser, the reflex takes time to rebuild. For occasional browsing, ordinary clicking may simply be less effort.

Next step

Read the documentation and default keybinding list that ship with the project, then copy the follow-mode bindings into your own configuration and adjust the trigger keys. The project publishes releases, documentation and support links from its home page at Luakit Web Browser, which is the authoritative place to check current defaults rather than relying on remembered bindings.

How do I enable and configure Luakit's ad blocker?

Luakit's ad blocker is configured in Lua rather than through a graphical settings menu, which fits its design as a browser framework for people who want direct control. The page shows a settings view that lists currently active filter lists, so the blocker is part of the normal configuration surface rather than a hidden extension.

Where to start

Open Luakit's ad blocker settings page (reachable from the browser's own settings interface) to see which filter lists are active. From there you manage lists and rules; for deeper changes you edit Luakit's Lua configuration files, since the browser is extensible in Lua and ships as a framework rather than a fixed product.

What to expect

  • Filter lists are the main control: enabling or disabling a list changes what gets blocked.
  • The page evidence confirms an ad blocker settings page exists and shows active filter lists, but it does not document specific Lua keys or file paths, so consult Luakit's documentation and help pages for exact option names before editing.
  • Because configuration is code, you can tune behaviour beyond simple on/off, but you also take responsibility for keeping it correct.

Practical scenario

If you want a quieter reading experience without touching code, start with the settings page and toggle the lists you need. If you want per-site exceptions or custom rules, plan to work in the Lua config and keep a backup so you can revert a broken change.

A trade-off to weigh

Luakit's approach rewards power users and developers who want fine-grained control over browsing behaviour. It is less convenient if you expect a click-through blocker with no configuration. Also note the page's security warning: your distribution's WebKitGTK+ version matters, and outdated packages can carry known vulnerabilities—so keep the underlying engine current regardless of how you configure blocking. See Luakit Web Browser for releases, downloads and documentation links.

Related questions

More questions →
Luakit WebKit Security Notice: What You Need to Know

Luakit's own documentation carries an explicit security warning: because Luakit is built on the WebKitGTK+ engine, your security depends on the version of WebKitGTK+ your distribution packages — not on Luakit itself. The project states that "not all distributions of Linux package the most up-to-date version of WebKitGTK+, and several package very outdated versions that have many known vulnerabilities." If you browse with Luakit, the documentation puts the responsibility on you: "it is your responsibility to ensure that your distribution packages an up-to-date version of WebKitGTK+."

Why the engine version matters more than the browser

Luakit is a browser framework: it provides the interface, keybindings, and Lua-based extensibility, while WebKitGTK+ does the actual rendering and page processing. That means patched vulnerabilities in the web engine reach you through your package manager's WebKitGTK+ package, not through a Luakit release. Running the newest Luakit on top of an old WebKitGTK+ leaves the known engine flaws in place.

The notice also notes a positive side: switching to the WebKit 2 API "means a vastly improved security situation" compared with the older API. The remaining risk is purely about how current the packaged engine is.

What the documentation says about distributions

As of September 2019, the project listed the following status:

Distribution WebKitGTK+ status per the notice
Arch Latest version
Debian Latest version
Fedora Latest version
Gentoo Latest version
Ubuntu Latest version
OpenSUSE Outdated and vulnerable version in the stable channel

Two caveats on reading this table:

  • It is a snapshot dated September 2019. Package versions change, so verify your own system rather than relying on this list.
  • It covers only the distributions named. If yours isn't listed, the notice gives no verdict either way — you still need to check.

How to check and act on your own system

The notice doesn't prescribe an exact command, but the practical steps follow from what it asks you to confirm — that your distribution ships an up-to-date WebKitGTK+:

  1. Find your installed engine version. Query your package manager for the WebKitGTK+ package (commonly named webkit2gtk or similar) and note the version string.
  2. Compare it against the current upstream release for WebKitGTK+.
  3. If your distribution lags, you have three realistic options: enable a repository channel that carries a newer build, build WebKitGTK+ from source, or use a different browser for untrusted sites. The documentation does not recommend one over the others.
  4. Re-check after distribution upgrades, since the gap can open or close with a release cycle.

Who this affects most

The notice is aimed at anyone who browses with Luakit, but the exposure is uneven:

  • Users on a distribution the notice flagged as outdated (OpenSUSE stable, per the 2019 snapshot) face the clearest risk if nothing has changed since.
  • Users who installed Luakit from source still depend on the system WebKitGTK+ package, so building Luakit yourself does not bypass the issue.
  • Users on distributions that track current WebKitGTK+ have the smallest gap, though "current" is only as good as the last package update.

Practical takeaway

Treat WebKitGTK+ as the security-critical component of your Luakit setup and Luakit as the layer on top. Before relying on Luakit for everyday browsing, confirm your distribution's WebKitGTK+ version is current; if it isn't, either change how you obtain the engine or reserve Luakit for contexts where an outdated engine is acceptable. The project's own framing is unambiguous: keeping the engine patched is the user's job, not something Luakit can do for you.

What Is Luakit Web Browser?

Luakit is a highly configurable browser framework built on the WebKit web content engine and the GTK+ toolkit. It is written to be fast, extensible with Lua, and licensed under GNU GPLv3. It is primarily targeted at power users, developers, and anyone who wants fine-grained control over their browser's behavior and interface. If you want a browser you can script and reshape rather than a finished consumer product, Luakit is aimed at you; if you want a conventional point-and-click browser, it is probably not.

What Luakit actually is

Luakit is best understood as a framework rather than a fixed application. The page describes it as "a highly configurable browser framework based on the WebKit web content engine and the GTK+ toolkit." Two consequences follow from that framing:

  • WebKit + GTK+ means rendering and widgets come from established libraries, so Luakit focuses on the control layer rather than reinventing a rendering engine.
  • Lua extension means behavior and interface are customized through Lua rather than through a settings dialog. The project notes the codebase is only around 9000 lines, which is why building from source is described as usually very fast.

The current release listed on the site is Luakit 2.4.0, with a list of older releases also available.

Who it suits

You are… Luakit fits if…
A power user You want to define keybindings, modes, and interface behavior yourself
A developer You are comfortable editing Lua and building software from source
Someone wanting fine-grained control You care more about scriptable behavior than about a polished default UI

The site states the target audience directly: power users, developers, and anyone who wants fine-grained control over their web browser's behaviour and interface.

Interface and features shown

The screenshots on the site illustrate the modes and customization the framework supports:

  • Normal mode when reading a web page
  • Follow mode with several link hints visible (keyboard-driven link selection)
  • An ad blocker settings page listing currently active filter lists
  • A different theme with vertical tabs enabled

These are examples of what the configuration layer can produce, not a fixed feature list you get out of the box.

Supported operating systems

  • Linux — actively supported
  • BSD — actively supported
  • Solaris — marked as not actively supported, but known to work
  • Windows 10 — marked as not actively supported, but known to work, via WSL
  • HURD — marked as not actively supported, but known to work

Because WebKitGTK+ does not natively support Windows, the Windows path runs through the Windows Subsystem for Linux.

Installing it

Linux

  • Arch Linux: install the luakit community package or the luakit-git package from the AUR.
  • Other distributions: download and build from source. The site notes a Debian package is in the works.

BSD

  • FreeBSD and OpenBSD: install the luakit package.
  • OpenBSD from source: build with clang instead of GCC, because the GCC version shipped with OpenBSD is outdated and will cause compilation errors.

Windows 10

Install the Windows Subsystem for Linux first, then download, build, and install Luakit from source following the source instructions.

Building from source

Required dependencies listed on the site:

  • GTK 3
  • WebKitGTK+ (webkit2gtk)
  • Lua 5.1 or LuaJIT
  • lfs (Lua File System)
  • SQLite 3

The security condition you must check

The site carries an explicit WebKit security notice, and it is the single most important practical caveat. Switching to the WebKit 2 API improved the security situation considerably, but not all Linux distributions package an up-to-date WebKitGTK+, and several package very outdated versions with many known vulnerabilities.

As of September 2019, the page states that Arch, Debian, Fedora, Gentoo, and Ubuntu all had the latest version of WebKitGTK+, while OpenSUSE shipped an outdated and vulnerable version in their stable channel. The site puts the responsibility on the user: if you browse with Luakit, you must ensure your distribution packages an up-to-date WebKitGTK+.

Treat that date as a snapshot. Before relying on Luakit for everyday browsing, verify what WebKitGTK+ version your distribution currently ships rather than assuming the list still holds.

Deciding whether to use it

Choose Luakit if you are on Linux or BSD, you are willing to build from source where no package exists, and you want a Lua-scriptable browser you can shape to your own workflow. Look elsewhere if you need a supported Windows-native browser, a packaged installer with no build step, or a distribution whose WebKitGTK+ you cannot verify as current.

How Customizable and Extensible Is Luakit?

Luakit is a browser framework built on WebKit and GTK+ that is configured and extended entirely in Lua, giving you fine-grained control over both browser behavior and interface. It is aimed at power users and developers who want to shape their browser rather than accept fixed defaults. The trade-off is that you build and install it yourself on most systems, and you are responsible for keeping WebKitGTK+ current.

What "customizable" means in Luakit

Luakit is not a browser with a settings menu you click through. It is a framework: the browser logic, key bindings, modes, and interface are defined in Lua, and you edit that Lua to change how it behaves. The project describes itself as "highly configurable" and "extensible with Lua," targeted at anyone who wants fine-grained control over the browser's behavior and interface.

Two consequences follow from that design:

  • Behavior is scriptable. Modes such as normal mode and follow mode are part of the framework, and you can add or change bindings rather than only remap a fixed set of shortcuts.
  • Interface is scriptable. Theming and layout are not locked. The project's own screenshots show a different theme with vertical tabs enabled, which indicates the tab layout itself is configurable, not just colors.

Extensibility through Lua

The extension language is Lua (5.1 or LuaJIT), and Lua is also the configuration language — there is no separate plugin API to learn. The project lists Lua as a required dependency alongside GTK 3, WebKitGTK+ (webkit2gtk), lfs (Lua File System), and SQLite 3.

Practical implications:

  • Small surface to read. Luakit contains only around 9000 lines of code, so the framework you are extending is small enough to read and modify directly.
  • Fast to build. The same small codebase means building from source "is usually very fast."
  • Extensions are code, not packages. Because Lua is the whole extension mechanism, what you can add is bounded by what the framework exposes to Lua rather than by a curated add-on store.

The screenshots also show an ad blocker settings page listing currently active filter lists, which is an example of a feature surfaced through the Lua-configured interface rather than a fixed built-in dialog.

What you can change, concretely

Area What the evidence shows
Key bindings and modes Normal mode and follow mode (with visible link hints) are shown as distinct modes
Theme A different theme is demonstrated in the screenshots
Tab layout Vertical tabs can be enabled
Content filtering An ad blocker settings page lists active filter lists
Browser behavior generally Described as fine-grained control over behavior and interface

The cost of that control

Customizability here is not free, and the project is explicit about the main risk. Luakit moved to the WebKit 2 API, which the project calls a vastly improved security situation — but it warns that not all Linux distributions package an up-to-date WebKitGTK+, and several ship very outdated versions with known vulnerabilities. As of September 2019, Arch, Debian, Fedora, Gentoo, and Ubuntu had the latest WebKitGTK+, while OpenSUSE shipped an outdated and vulnerable version in its stable channel. The project states plainly that if you browse with Luakit, ensuring your distribution packages an up-to-date WebKitGTK+ is your responsibility.

Installation reflects the same power-user posture:

  • Arch Linux: install the luakit community package or luakit-git from the AUR.
  • Other Linux: download and build from source; a Debian package is in the works.
  • FreeBSD and OpenBSD: install the luakit package. When building from source on OpenBSD, use clang instead of GCC, because OpenBSD's GCC is outdated and will cause compilation errors.
  • Windows 10: install WSL first, since WebKitGTK+ does not natively support Windows, then build and install from source.
  • BSD, Solaris, HURD, Windows 10 (with WSL): listed as supported; Windows, Solaris, and HURD are not actively supported but known to work.

Who should choose it

Choose Luakit if you want to define your browser's behavior and interface in Lua, you are comfortable building from source or using a distribution package, and you will keep WebKitGTK+ updated yourself. Look elsewhere if you want a browser that works out of the box with a graphical settings panel, or if your distribution ships an outdated WebKitGTK+ and you cannot change that.

Which operating systems does Luakit support and how do I install it?

Luakit runs natively on Linux, BSD, Solaris, and HURD. Windows 10 is not natively supported — you can only run it there through WSL (Windows Subsystem for Linux). On Linux and BSD you can usually install a prebuilt package; otherwise you build from source, which is quick because Luakit is only around 9,000 lines of code.

Supported operating systems

OS Support status Install route
Linux Actively supported Distro package or build from source
BSD Actively supported Package (FreeBSD, OpenBSD) or source
Solaris Known to work Build from source
HURD Known to work Build from source
Windows 10 Not actively supported, known to work via WSL Install WSL, then build from source

The site notes that Solaris, HURD, and Windows 10 are not actively supported but are known to work. Windows is excluded from native support because WebKitGTK+ does not natively support Windows.

Installing on Linux

  • Arch Linux: install the luakit community package, or luakit-git from the AUR.
  • Other distributions: download and build from source. A Debian package is described as "in the works," so at the time of writing Debian users also build from source.

Installing on BSD

  • FreeBSD and OpenBSD: install the luakit package.
  • OpenBSD from source: build with clang instead of GCC. The GCC version shipped with OpenBSD is outdated and will cause compilation errors.

Installing on Windows 10

  1. Install the Windows Subsystem for Linux if you have not already done so.
  2. Download, build, and install Luakit from source, following the source instructions below.

Building from source

Install these required dependencies first:

  • GTK 3
  • WebKitGTK+ (webkit2gtk)
  • Lua 5.1 or LuaJIT
  • lfs (Lua File System)
  • SQLite 3

Then download the source and build it. The process is usually very fast given the small codebase.

Before you install: check your WebKitGTK+ version

Luakit is built on the WebKit web content engine and the GTK+ toolkit, and its security depends on the WebKitGTK+ version your distribution packages. The project warns that not all Linux distributions ship an up-to-date WebKitGTK+, and some package outdated versions with known vulnerabilities.

As of September 2019, Arch, Debian, Fedora, Gentoo, and Ubuntu all had the latest version of WebKitGTK+, while OpenSUSE shipped an outdated and vulnerable version in its stable channel. If you browse with Luakit, the project states it is your responsibility to ensure your distribution packages an up-to-date WebKitGTK+.

Who this is for

Luakit is a configurable browser framework licensed under GNU GPLv3, extensible with Lua, and targeted at power users, developers, and anyone who wants fine-grained control over their browser's behaviour and interface. If you want a browser you configure rather than one you just use, the install path above is the starting point; if you need native Windows support, Luakit is not the right fit.

What Is the Latest Release of Luakit and Where Can I Download It?

The latest release is Luakit 2.4.0, shown on the project's home page under "Latest release — Luakit 2.4.0." You can get it from the official site at luakit.github.io, which links to the download page, the releases list, documentation, and the GitHub repository. Older versions are available through the "list of older releases" link on the same page.

What Luakit Is

Luakit is a browser framework built on the WebKit web content engine and the GTK+ toolkit. It is written to be fast and extensible with Lua, and it is licensed under GNU GPLv3. The project describes itself as aimed primarily at power users, developers, and anyone who wants fine-grained control over the browser's behavior and interface. The codebase is small — around 9,000 lines — which is why building from source is usually quick.

Where to Download

The home page's "Downloading Luakit" section is the starting point. From there, the available routes depend on your platform:

Platform How to get it
Arch Linux Install the luakit community package, or luakit-git from the AUR
Other Linux Download and build from source (a Debian package is noted as "in the works")
FreeBSD / OpenBSD Install the luakit package
Windows 10 Install WSL first, then download, build, and install from source
BSD, Solaris, HURD Listed as supported; Windows 10 via WSL, Solaris, and HURD are marked as not actively supported but known to work

The site also links to the GitHub repository, which is where the source lives.

Building From Source

If your distribution doesn't package Luakit, you build it yourself. The required dependencies listed on the site are:

  • GTK 3
  • WebKitGTK+ (webkit2gtk)
  • Lua 5.1 or LuaJIT
  • lfs (Lua File System)
  • SQLite 3

Two platform-specific notes from the documentation:

  • OpenBSD: build with clang instead of GCC, because the GCC version shipped with OpenBSD is outdated and will cause compilation errors.
  • Windows 10: WebKitGTK+ does not natively support Windows, so WSL is required before building.

The WebKit Security Notice

This is the most important caveat before you install. Luakit's move to the WebKit 2 API improved its security situation, but the project warns that not all Linux distributions package an up-to-date version of WebKitGTK+, and several ship very outdated versions with known vulnerabilities.

As of September 2019, the site states that Arch, Debian, Fedora, Gentoo, and Ubuntu all had the latest WebKitGTK+, while OpenSUSE shipped an outdated and vulnerable version in its stable channel. The project's position is that if you browse with Luakit, ensuring your distribution packages an up-to-date WebKitGTK+ is your responsibility.

Because that notice is dated, treat the distribution list as a snapshot rather than current fact — check what your own distribution provides before relying on it.

Practical Takeaways

  • Want the newest code: Luakit 2.4.0 is the current release; older releases are listed separately.
  • On Arch: the fastest path is the community package or the AUR git package.
  • On FreeBSD/OpenBSD: use the packaged version.
  • Anywhere else: build from source with the five dependencies above.
  • Before browsing: confirm your WebKitGTK+ version is current, since Luakit's security depends on it.

Website Overview

An established domain and managed infrastructure suggest continuity of operations and may support dependable delivery, although neither guarantees service quality. Several search or sharing settings need attention. Together they may make snippets, preview images or preferred URLs less consistent across platforms.

Domain and Registration

Registered in 2013, this domain has about 13 years of history. That suggests continuity, although ownership and purpose may have changed. The registrar, MarkMonitor Inc., specializes in corporate domain and brand management, suggesting attention to domain asset protection. Transfer-protection status is present, helping reduce the risk of unauthorized domain transfers. The domain uses the common .io extension, which is not an independent safety signal.

DNS and Email

Nameservers are provided by Amazon Route 53, indicating managed DNS hosting. CAA records restrict which certificate authorities are authorized to issue certificates. No CNAME was found; the observed records resolve directly to addresses. No MX record was found. A conventional explicit inbound-mail route is not configured. DNSSEC signatures were not detected, so this additional DNS authenticity protection is not confirmed.

TLS and Certificates

The certificate uses an RSA 2048-bit public key, offering broad client compatibility. The server supplied a complete certificate chain. No organization name is present in the certificate; the available fields are consistent with domain validation. The certificate was issued by Let's Encrypt, commonly associated with automated certificate services. The certificate's total validity is about 89 days, consistent with a short renewal cycle.

HTTP and Browser Security

The checked browser-security headers were not detected, leaving fewer explicit browser-side safeguards. CORS permits any origin to read this response. This is common for public resources; sensitive responses need narrower handling. No X-Powered-By header was found, reducing one common source of backend fingerprinting information. The x-cache, x-served-by, via response header indicates a CDN or caching proxy in the delivery path. No obvious internal addresses or debug information were found in the headers.

Technology Stack Analysis

The public page identifies Fastly without precise versions, leaving fewer clues for version-specific scanning.

Search and Social Sharing

No homepage meta description was detected, leaving snippet selection more dependent on page text. No homepage canonical URL was detected. If duplicate URLs exist, consolidation may be less explicit. No Open Graph metadata was detected, so social previews may depend on platform inference. The title has 18 characters, within a common display range. The observed directives allow indexing and link following.

Hosting and Email

DNSAmazon Route 53
HostingFastly
EmailUnknown
Approximate IP geolocation (inferred; a CDN or proxy may differ from the origin server) United States flagUnited States Inferred 185.199.108.153

Registration details

RDAP / WHOIS

RegistrarMarkMonitor Inc.
Registered2013-03-08
Expires2027-03-08
Domain statusclientDeleteProhibited https://icann.org/epp#clientDeleteProhibited、clientTransferProhibited https://icann.org/epp#clientTransferProhibited、clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited
Nameserversdns1.p05.nsone.net、dns2.p05.nsone.net、dns3.p05.nsone.net、ns-1622.awsdns-10.co.uk、ns-692.awsdns-22.net
DNSSECunsigned

DNS records

DNS

TypeNameValueTTLPriority
Aluakit.github.io185.199.108.1533600—
Aluakit.github.io185.199.109.1533600—
Aluakit.github.io185.199.110.1533600—
Aluakit.github.io185.199.111.1533600—
AAAAluakit.github.io2606:50c0:8000::1533600—
AAAAluakit.github.io2606:50c0:8001::1533600—
AAAAluakit.github.io2606:50c0:8002::1533600—
AAAAluakit.github.io2606:50c0:8003::1533600—
NSgithub.iodns1.p05.nsone.net1143—
NSgithub.iodns2.p05.nsone.net1143—
NSgithub.iodns3.p05.nsone.net1143—
NSgithub.iodns4.p05.nsone.net1143—
NSgithub.ions-1339.awsdns-39.org1143—
NSgithub.ions-1622.awsdns-10.co.uk1143—
NSgithub.ions-393.awsdns-49.com1143—
NSgithub.ions-692.awsdns-22.net1143—
TXTgithub.iov=spf1 a -all3600—
CAAgithub.io0 issue "digicert.com"3600—
CAAgithub.io0 issue "letsencrypt.org"3600—
CAAgithub.io0 issue "sectigo.com"3600—
CAAgithub.io0 issuewild "digicert.com"3600—
CAAgithub.io0 issuewild "letsencrypt.org"3600—
CAAgithub.io0 issuewild "sectigo.com"3600—

TLS and certificates

TLS / SSL

AssessmentNormal configuration
Supported protocolsTLSv1.2、TLSv1.3
Negotiated protocolTLSv1.3
Certificate subject*.github.io
IssuerLet's Encrypt
Valid until2026-10-31T23:38 · Remaining when checked: 27 days
Verification detailsCertificate trust: Passed · Hostname match: Passed

HTTP response headers

HTTP

HeaderValue
content-typetext/html; charset=utf-8
cache-controlmax-age=600
serverGitHub.com
access-control-allow-origin*

Identified technologies

Fastly

Pages, Search and Sharing

Meta descriptionNot detected
Canonical URLNot detected
LanguageEnglish (default)
Twitter CardNot detected

Unknown

No robots.txt found

No sitemaps found

User reviews (0)

  • No reviews yet.