Antidetect browser

Antidetect browser: the fingerprint is changed in the kernel, not by injected JavaScript

Every browser hands a website a few hundred small facts about the machine it runs on: screen size, font list, graphics card, audio stack. Together they identify that machine well enough that a second account signed in from it is recognised as the same person. An antidetect browser exists to make each profile look like a different machine. How it does that is the whole difference between one and another, and it is the part most product pages skip.

Start free
Where each kind of tool writes the fingerprint A page script runs at the top of this stack, so a value injected there can be read before it is overwritten, and nothing below it is touched at all. SigoLogin writes in the two layers underneath, where no page script reaches. Page script Web API: navigator, canvas, WebGL Browser engine (C++) Network: headers, Client Hints, handshake Injected JavaScript writes here SigoLogin writes here
A page script runs at the top of this stack, so a value injected there can be read before it is overwritten, and nothing below it is touched at all. SigoLogin writes in the two layers underneath, where no page script reaches.

What you get

Changed in the kernel

Values are written in C++ before any page script runs, not injected over Chrome afterwards.

Fonts filtered three ways

Width measurement, name lookup and the local font API all answer from one list, so they agree.

A proxy per profile

HTTP and SOCKS5 with authentication, no DNS leaking around it, time zone taken from its country.

One real device per profile

Screen, cores, memory and graphics card all come from the same measured machine, never mixed.

Stable between sessions

The same profile draws the same canvas every time it opens. A fingerprint that drifts is worse than none.

Measured, not claimed

Measured against real Chrome on the same machine, not argued from design.

What an antidetect browser is

An antidetect browser runs many browser profiles on one computer and gives each one its own identity: its own fingerprint, its own cookies, its own proxy, its own folder on disk. Nothing is shared between them, so a site that sees profile A has no way to tie it to profile B.

What a browser fingerprint actually is

A fingerprint is not one value. It is the set of answers a browser gives to questions any page may ask: what the user agent says, how large the screen is, how many CPU cores are reported, which fonts resolve, what string the graphics driver returns, what a canvas draws down to the pixel. SigoLogin writes fifteen such surfaces for every profile, the ones that carry the identifying weight.

The danger is not any single answer. It is the combination. A machine claiming macOS in its user agent while its WebGL renderer names a Direct3D driver is a machine that does not exist, and a machine that does not exist is far easier to spot than an ordinary one.

Why a proxy on its own is not enough

A proxy changes the address a request comes from. It changes nothing inside the browser. Two accounts behind two different proxies still report the same screen, the same font list, the same graphics card and the same canvas pixels, and that is enough to tie them together.

It works the other way too. A profile claiming a Jakarta time zone while its address is in the United States has contradicted itself before any fingerprint is read. SigoLogin takes the time zone and the language from the proxy's own country, so the two cannot disagree.

Two ways to build one, and why it matters

Most antidetect browsers are ordinary Chrome with JavaScript injected into every page to overwrite navigator, canvas and WebGL. That is cheap to build and it defeats simple checks. It also leaves marks.

Tools that inject JavaScript

  • An overwritten function stops looking native: calling toString on a patched method returns different text from the real one.
  • Injection happens after the page starts loading. A script that reads a value on its first line reads the real one.
  • Anything outside JavaScript stays untouched: request headers, the order of Client Hints, the language sent with each request.
  • Hiding a font from JavaScript cannot change how wide that font actually draws text.
  • Every new surface needs another injected script, and every script is one more thing to notice.

SigoLogin

  • Values are written in C++ before any page script runs, so there is no patched function to find.
  • The kernel answers with the profile's value from the first line onwards.
  • Client Hints, headers and locale are set in the network layer, where they match the user agent the page can read.
  • Font lookup is filtered in the font engine, so measured widths agree with the declared list.
  • Nineteen patches compiled into one Chromium 152 build, applied before the browser starts.

The cost of our approach deserves saying plainly: we compile a whole browser, so following a new Chrome version takes us days rather than minutes, and the kernel is about 2 GB to download instead of a few megabytes.

Compare

What SigoLogin changes, surface by surface

Each profile gets a fingerprint generated from a seed, so the same profile is identical every time it opens. A fingerprint that drifts between sessions is more suspicious than no spoofing at all. Every value comes from one real device family, and fields are never mixed between machines.

Identity

  • platform
  • browser
  • locale

Noise added

  • canvas
  • webgl
  • webgpu
  • audio
  • clientRects

Machine

  • screen
  • hardware
  • battery

Environment

  • fonts
  • mediaDevices
  • webrtc
  • network
The fifteen surfaces written for every profile. All of them come from one real device family, so the answers agree with each other; mixing fields between machines is what produces a computer nobody has.

Fonts

The installed font list is one of the strongest signals a page can read, and pages count it three ways: by measuring how wide text draws, by asking for a font by name, and through the local font API. All three are filtered in the kernel, so all three answers agree.

A Windows profile declares about 300 fonts, measured on real machines rather than copied from a list. The macOS corpus, measured the same way, comes to about 1,185. There is a hard limit here and we would rather state it than hide it: the kernel can conceal a font, it cannot create one. Concealing a font that the operating system always installs invents a machine nobody has, which is why the list is measured rather than guessed.

Platforms

Canvas, WebGL and WebGPU

Canvas, audio and text-rectangle readings get deterministic noise derived from the profile seed: one profile always draws the same pixels, and a different seed draws different ones. WebGL and WebGPU report the same card as each other, because a page can ask both and compare. We added that check after finding a build where WebGL claimed a GeForce RTX 3060 while the WebGPU adapter named the Intel chip in the developer machine.

Screen, hardware and devices

Screen size, available height, pixel ratio, CPU cores, reported memory, touch points and the labels of microphone, speaker and camera all come from the same device family. Small details decide this. On macOS, Chrome reports physical cores rather than threads, and the ceiling on reported memory moved between Chrome versions. Getting either wrong describes a computer nobody sells.

WebRTC, time zone and language

WebRTC is the classic leak: it can report the real local address even behind a proxy. On a profile with a proxy that path is shut, so the real address has nowhere to come out - we close the leak rather than dressing it up as the proxy. A profile without a proxy answers honestly instead of pretending, because very few real machines have WebRTC switched off and switching it off is its own label. Time zone and accepted languages follow the proxy's country rather than the machine's settings.

Proxies and DNS

TLS and HTTP/2 handshake Coming soon

The handshake happens before the first byte of HTML arrives and no page script can reach it, which is exactly why it is worth changing and why a tool built on injected JavaScript cannot touch it. It is being built now and is not in the current release. We would rather list it here as unfinished than let you assume it is done.

How we know it works

We would rather not ask you to take the design on trust. Every surface is measured against real Chrome on the same machine, and the profiles are run through public detection sites.

Where they disagree, the difference gets fixed or written down - not rounded off. What you will not find on this page is a score: the numbers those sites report move between visits and contradict each other, so printing one here would be a promise about someone else's algorithm. What they are genuinely good for is finding our own bugs.

Measuring is also what catches our own mistakes. When the font filter first shipped, a detection site turned on us: a profile that had read as trustworthy started reading as unreliable. The cause was the filter concealing eleven fonts that ship with Windows 11 itself, so the profile described a Windows machine that could not exist. Correcting the list cleared it. No amount of reasoning would have found that; only running it did.

A detection site's verdict before, during and after a bug of our own One detection site's verdict on one profile, before, during and after a bug of our own. The font filter shipped hiding eleven fonts that Windows 11 always installs, which described a machine that cannot exist, and the verdict flipped. Correcting the list restored it. Reasoning would not have found this; running it did. Before the font filter With the bug After the fix trustworthy unreliable trustworthy
One detection site's verdict on one profile, before, during and after a bug of our own. The font filter shipped hiding eleven fonts that Windows 11 always installs, which described a machine that cannot exist, and the verdict flipped. Correcting the list restored it. Reasoning would not have found this; running it did.

What an antidetect browser does not do

A fingerprint is one signal among many, and being clear about the rest is worth more than a promise we cannot keep.

Questions people ask

Is an antidetect browser legal?

The software is a browser, and running several browser profiles on your own computer is not in itself unlawful. What carries rules is what you do with them: the law where you live, and the terms of the sites you use. We do not help with fraud or impersonation, and our terms say so.

Is Chrome an antidetect browser?

No. Chrome profiles separate cookies and history, which removes the most obvious link, but every profile reports the same screen, the same fonts, the same graphics card and the same canvas pixels, because they all run on the same machine. Separate storage is not a separate identity.

How is this different from a VPN or a proxy?

A proxy or a VPN changes the address a request comes from and nothing else; the browser still describes the same computer. The two are complementary rather than alternatives. SigoLogin expects a proxy per profile, and takes the time zone and the language from that proxy's country so they cannot contradict the address.

Is there a free plan?

Three profiles free, with the same fingerprint engine as the paid plans. The free tier is limited in how many profiles you get, not in how well they are protected. Paid plans raise the profile count and the number of devices you can activate.

Does my data go to your servers?

Profiles are folders on your own disk, and the cookies, saved logins and history inside them stay there. The app sends a small set of management fields so you can see your profiles on this site, plus an error log. Sharing a profile with a teammate is the one exception, because they sit at another machine. The privacy page names every field.

Which operating systems does it run on?

Windows 10 and 11, and macOS 13 or later, 64-bit. There are builds for both Intel and Apple silicon. Linux is not started. The platforms page says what is there and what is not.

Read further

Longer answers to the questions this page raises.

Not sure this is the right tool?

Ask an assistant that has no stake in the answer.

How you use it

  1. 1

    Install and link

    Install on Windows, open the app, and press the button that signs it in here. The kernel downloads once.

  2. 2

    Make a profile

    Name it and attach a proxy. The fingerprint is generated from a seed and stays fixed from then on.

  3. 3

    Open it, and keep opening it

    Every open reuses the same identity. Share a profile and a teammate opens the same device on their machine.

Three profiles free, with the same engine as the paid plans

Windows 10 and 11, or macOS 13 and later, 64-bit. No card needed to start.

Keep reading