The Mosaic blog
News from the product, the engineering behind it, and the reasons we made the calls we made.
Switching between client accounts in seconds, not sign-ins
Signing out and back in is where a client switch costs minutes and where wrong-account posts start. A shortcut per client profile makes it one double-click.
Amazon Ads Partner Network access, for agencies
Amazon Ads Partner Network access lets an agency link clients' ad accounts to its own manager account, so nobody hands over a Seller Central password.
Chrome 136 stopped remote debugging on your default profile
Since Chrome 136, --remote-debugging-port is ignored on the default profile. Pass --user-data-dir with a folder of its own and the port opens.
Why hCaptcha gives some browsers a puzzle every time
hCaptcha's challenge is its score. A puzzle every time usually means blocked cookies, a crowded VPN exit or a browser whose values disagree with each other.
Seeing the notification prompt again, as a new visitor would
Chrome asks a site once and keeps the answer, so the tester sees nothing next time. Reset the site's permission, or open a profile that has never visited.
Detecting a proxy with two clocks
A server times the TCP handshake to the exit and a round trip to the browser. Behind a proxy the second is longer, and the gap is the tunnel.
"Unlimited bandwidth" proxies and where the limit really is
An unlimited bandwidth residential proxy still has a limit. It moves to threads, ports, speed or a fair-use clause, and the terms say which one.
Amazon Associates and several websites: one account, many tracking IDs
Amazon Associates wants one account per person, with every site listed in it and a tracking ID for each. A second account for a second site breaks the rules.
App-Bound Encryption, and why tools stopped reading Chrome's cookies
App-Bound Encryption ties Chrome's cookie key on Windows to Chrome itself, so tools reading the Cookies file broke. Export from inside the browser.
Why every Mac's Chrome says Mac OS X 10_15_7
Chrome froze the macOS version in its User-Agent, so every Mac claims 10.15.7. The real one is in Sec-CH-UA-Platform-Version, a hint sites must ask for.
The proxy bill is usually bigger than the browser bill
Past a couple of dozen profiles, the exits cost more each month than the anti-detect browser. That is why we price per month, not per profile.
Seeing both sides of your own A/B test
Testing tools put each visitor in one variant by a cookie or id and keep them there. To see every variant, keep one browser profile per variant for the test.
Through a proxy, your TCP fingerprint is the exit's
A proxy's exit opens its own TCP connection, so the TTL, window and options a site reads come from the exit's system, not your browser or your computer.
Why the User-Agent says Windows 10 on Windows 11
Windows 11 and 10 both send Windows NT 10.0 in the User-Agent. Only the platformVersion client hint, 13 or higher, says Windows 11.
Why Amazon verifies new sellers on a video call
Amazon seller video verification puts a face beside the ID and statement you uploaded. After it, two accounts are linked by the person, not by the browser.
Amazon's unified account in Europe, explained
Amazon's unified account in Europe is one Seller Central login for every European store, so selling in five countries needs one account, not five.
Why Chrome's User-Agent says 0.0.0
Chrome zeroes everything after the major, so the User-Agent says 0.0.0 and the build moves to Sec-CH-UA-Full-Version-List. A real build in the UA is a tell.
Device-bound sessions and the end of copying a cookie
With Device Bound Session Credentials in Chrome, a site reissues its session cookie only to the device with the key. A copied cookie lasts until it expires.
How to test a metered paywall as a new visitor
A meter can count by cookie, by login, by address or by fingerprint. To test yours as a new visitor you need a browser that is new to every one of them.
MSS 1300: what an MSS value says about VPN detection
VPN detection by MSS value: a tunnel shrinks the MSS in every SYN. A proxy opens a new connection at the exit, so a site reads the exit's MSS.
Per-GB vs per-IP proxy pricing for long-lived profiles
Per GB vs per IP proxy pricing over a year: a light profile is cheaper per GB, a busy one per IP, and the crossover is lifetime gigabytes against months.
How much proxy traffic a browser profile uses
How much proxy traffic do you need? It follows the pages a profile loads, not the profile count. Measure one profile for a week, then multiply.
Brand Registry agents: running a brand you don't own on Amazon
Amazon Brand Registry agent access: the trademark owner invites the agency's own account in User Permissions and picks its roles. No password changes hands.
Chrome's IP Protection was cancelled, and proxies stay your job
Chrome's IP Protection would have proxied some Incognito traffic to known trackers. Google retired it with Privacy Sandbox, and sites still see your IP.
A fresh browser for every test run, and why it should be cheap
Leftover cookies and storage are where flaky browser tests come from. A one-time profile gives each run a clean jar and trashes itself when its browser closes.
IPv6 proxies, and why a site may count a /64 as one house
IPv6 proxies are cheap because addresses are plentiful, but sites that score IPv6 count a /64 prefix as one household. Many addresses from one prefix are one.
What a proxy costs per profile per month
Proxy cost per account depends on how the seller bills. Worked sums for per-GB, per-IP and per-port plans at one, ten and a hundred profiles.
Keeping twenty QA test accounts straight
Managing test accounts for QA goes wrong when the state lives in people's heads. Give each persona a profile with its login, role and state beside it.
Amazon's 'legitimate business need' clause, read closely
Amazon allows a second seller account only for a legitimate business need, with every account in good standing. Two businesses qualify; a backup never does.
Chrome kept third-party cookies. What that means for cookie jars
Chrome is not removing third-party cookies: Google dropped the phase-out and then the prompt. A jar per account matters as much as it did before.
Checking your cookie banner from the countries that require it
Consent tools pick the banner by the visitor's IP location, so your office sees one version. Test each region from a fresh profile with an exit there.
Privacy Sandbox is retired, and its APIs are a version tell
Chrome is removing Topics and Protected Audience release by release, so whether runAdAuction exists tells a page which Chrome you really are.
Residential proxy prices, turned into a cost per profile
Residential proxy prices are quoted per GB and move with plan size and the market. What an operator budgets is gigabytes per profile, times the rate.
Cloud phones by the minute, and what the meter adds up to
A cloud phone priced per minute and left open eight hours a day runs 14,400 minutes a month. Multiply by the rate before you compare it with a flat plan.
AmIUnique compares you with people who visit AmIUnique
AmIUnique measures its own visitors accurately, and they are not the web. Read which attribute sits at 0.01%, not the headline that says you are unique.
The same home IP, sold by several providers
Residential pools overlap: one home device can sit in several sellers' networks at once, so switching seller does not promise switching neighbours.
Testing date and deadline features in another timezone
Midnight cut-offs and "ends today" banners break in zones you don't live in. Test a website in a different timezone without touching your computer's clock.
TikTok Shop Partner Center: managing shops you do not own
TikTok Shop Partner Center lets a seller authorise an agency into their shop and cancel it later. Signing in with the seller's own password skips all of that.
WebRTC and IPv6: the candidate your proxy never carried
A WebRTC IPv6 leak is a candidate gathered over UDP that an IPv4 proxy never sees. Blocking non-proxied UDP closes it for both address families at once.
Why residential proxies cost what they cost per GB
Residential proxies are expensive because every gigabyte crosses somebody's home connection. For a browser profile, count working sessions, not gigabytes.
Accept-CH and Critical-CH: how a server asks for more
Accept-CH asks Chrome for more client hints on the next request; Critical-CH makes it retry the first. A server sees both requests and can compare them.
Testing a site in another language means more than one header
Set Accept-Language alone and the page still formats dates for your own machine. A real language test moves the header, navigator.languages and Intl.
Donut and ShardBrowser: open apps, closed engines
Donut Browser's app is AGPL-3.0 and ShardBrowser's launcher is MIT, but both run a closed Chromium binary. The part a site reads is the part you cannot audit.
What "replace WebRTC IP with proxy IP" can actually mean
A WebRTC public address is what a STUN server saw a packet come from, so it cannot be swapped for the proxy's. What works is gathering no address outside it.
When the residential exit is somebody's infected router
Research has traced residential proxy pools to hijacked servers, paid SDKs and TV boxes sold with proxy code. Residential describes an address, not its source.
TikTok One for agencies: creator access without logins
TikTok One, the old Creator Marketplace, lets an agency run a creator's post as a Spark Ad from its own ad account. The creator approves; no password.
What TikTok's guidelines say about running several accounts
TikTok's guidelines allow more than one account. They rule out accounts that deceive, inflate engagement or return after a ban, and that decides a brand's case.
Following an affiliate link's redirects from three countries
An affiliate tracker picks the landing page from the visitor's IP country. To see a German visitor's page, click from a German exit on German time.
The household behind the exit you are renting
A residential exit is someone's home connection, still in use while you rent it. Whether that is fair depends on how they agreed, and you can ask.
Anti-detect inside your own browser: the extension model
SessionBox keeps a cookie jar per session inside your own browser. Logins stay apart; the GPU, fonts and canvas a page reads are the same in all of them.
getHighEntropyValues: what a page can ask for and what it gets
getHighEntropyValues hands a page architecture, bitness, model and full versions on request, and each answer must match the headers Chrome sends.
Linken Sphere, the other local-first anti-detect browser
With sync off, Linken Sphere keeps a session's cookies and storage on your computer and still sends its metadata. Mosaic has no sync to turn off.
TikTok Shop's multiple-shop rules differ by country
TikTok Shop runs a Seller Center per market, each with its own Seller University. A US answer about multiple shops is a US answer, not a UK one.
How far behind Chrome stable is your anti-detect browser?
Real Chrome updates itself, so an engine a few majors old claims a browser almost nobody runs. Our move from 153 to 154 took a 93-minute rebuild.
'Randomized fingerprint' is the wrong goal on Cover Your Tracks
Cover Your Tracks praises a randomized fingerprint, but values that change on every load are a signal too. Profiles need one stable, normal browser each.
Not_A Brand: how Chrome's GREASE brand is computed
The Not A Brand entry in Chrome's user agent is computed from the major version by a fixed formula, so a label that doesn't fit the claimed major is a tell.
Testing whether your affiliate links track, with a clean jar
To test whether an affiliate link tracks, click it from a browser with an empty cookie jar and read what it set. An old click's cookie can spoil the test.
How TikTok decides your Business Center ad account limit
TikTok's Business Center ad account limit is a default set per Business Center type, raised through TikTok. Spend moves a different limit: ad groups.
What DNS over HTTPS changes when a browser uses a proxy
Does DNS over HTTPS work with a proxy? Through one, the exit resolves each hostname, so Chrome's DoH setting covers only lookups the browser makes itself.
Is Camoufox still maintained? Reading the repository
Is Camoufox still maintained? Its repository answers better than forums do: compare the latest release's date and Firefox base with today's Firefox.
queryLocalFonts and the permission that guards your font list
The Local Font Access API permission, local-fonts, guards queryLocalFonts(). Measuring text needs no permission, so the gate binds only polite pages.
Checking what Shopify Markets shows a buyer in each country
To test Shopify Markets geolocation, make the exit, timezone and language name one country: Shopify reads the IP for country and the browser for language.
A blocklist that lists home connections for being home
SORBS answered 127.0.0.10 when an IP sat in a home ISP's range, so a residential proxy got listed for being residential. Read the code first.
Several YouTube channels and one AdSense account
YouTube lets one creator run and monetise several channels, but AdSense allows one account per payee, so every monetised channel you own pays into the same one.
What a YouTube MCN is, and what it can see
What is a YouTube MCN? A network linking channels to its content owner account, collecting their revenue and reading analytics. Strikes stay with YouTube.
Junglefox and Chroma, Kameleo's two engines
Junglefox is Kameleo's Firefox-based engine, beside Chroma, its Chromium one. A Firefox profile needs an engine that really is Firefox, and keeping one is work.
Twenty supplier portals, twenty logins, one place for each
Manage supplier portal logins by keeping each one with the store it buys for: one browser profile per store, its supplier logins, codes and notes inside it.
Testing your own checkout as a customer who has never visited
To test a Shopify checkout as a customer, pay with a test method from a browser that has never seen your store: no admin login, no saved address, no cart.
A terminated YouTube channel covers the person, not the channel
When YouTube terminates a channel, the ban covers its owner: any other channel they use or create breaks the rules too. The way back is the appeal.
What AudioContext.sampleRate says about your speakers
AudioContext.sampleRate is the rate your output device runs at, usually 44100 or 48000. As a fingerprint it is one bit, and changing it is easy to catch.
Chrome sync quietly joins accounts you meant to keep apart
Chrome sync files everything a profile does under one Google account, whichever account you used in the tab. Two accounts in one profile end up in one history.
How websites list your fonts without a font API
Websites detect installed fonts by measuring a test string in each font against a fallback. A width that changes means the font is there. No permission needed.
An account health routine for sellers with more than one store
A seller account health checklist: Amazon, eBay and Etsy grade different metrics over different windows, so read each one weekly, by date, in its own profile.
Mimic, Multilogin's Chromium, and its core numbers
A Mimic core number is the Chrome major it is built on. Set the date a core shipped against the date that Chrome major reached stable, and you have the lag.
SunBrowser and FlowerBrowser, AdsPower's two engines
SunBrowser is AdsPower's Chromium engine, FlowerBrowser its Firefox one. Choosing Firefox changes the handshake, headers and extensions a profile runs.
Selling on Amazon and eBay at once without crossing the wires
Selling on Amazon and eBay simultaneously is allowed. The wires that cross are your buyer logins, your downloads and the stock count, not the marketplaces.
Separating client work with Google Workspace accounts
Give each person a Google Workspace account and let clients invite that address. Your agency never holds a client's Google password, and leaving ends access.
What Orbita is, from GoLogin's own pages
Orbita is the Chromium-based browser a GoLogin profile opens in. GoLogin says it tracks Chrome releases, and each profile is updated on its own.
Google Business Profile organization accounts, for agencies
A Google Business Profile organization account lets an agency manage client listings under its own login. The client grants access and keeps ownership.
Why Google says 'verify it's you' on a new device
Google asks you to verify it's you when a sign-in comes without the cookie its last sign-in left, or from an address in a place you have not been.
Customer messages across several stores, without missing one
Marketplaces count reply times per seller account, so one unread store inbox costs that store. Keep every store signed in and read all inboxes in one pass.
How the OfflineAudioContext fingerprint is computed
An oscillator through a compressor, rendered silently and summed: the OfflineAudioContext fingerprint reads your machine's floating-point audio path.
Why Seller Central keeps logging you out
Seller Central signs you out when its cookies go: a cleaned browser, a second store in the same window, a private tab. Keep one store per cookie jar.
Multilogin froze Stealthfox, and what a legacy engine means
Multilogin lists Stealthfox as a legacy core and points users to Mimic. A browser core that stops updating turns its own version into a signal.
Grandfathered plans and why review prices disagree
On an old GoLogin pricing plan, your renewal price comes from your own subscription, not the public page. Reviews often quote plans a new account can't buy.
Merchant Center multi-client accounts for agencies and marketplaces
A Merchant Center multi-client account puts many stores under one operator. Each sub-account is still one store, with a website it can show is its own.
Anti-detect browser promo codes and the price at month thirteen
An anti-detect browser promo code usually discounts one payment. Compare what you pay in month thirteen, at the profile count you will have by then.
Elite, anonymous, transparent: proxy levels mean little on HTTPS
Elite vs anonymous proxy is about X-Forwarded-For and Via on plain HTTP. Inside a CONNECT tunnel to an HTTPS site, a proxy cannot add a header at all.
A seller's morning across six stores, one profile each
An ecommerce seller's daily checklist: messages, orders, account health. With six stores, open all six signed in at once instead of signing in and out.
What your proxy provider can and cannot see
Over HTTPS a proxy provider sees each hostname, port, time and byte count, never the pages or passwords. Over plain HTTP it sees everything you send.
How many Google Ads accounts one person can make
Google caps Google Ads accounts per login, counts manager accounts in that cap, and sends anyone advertising for several businesses to a manager account.
Unlimited local profiles, metered cloud ones
A local profile is a folder on your disk and costs the vendor nothing; a cloud one is storage and transfer on every open. That is why only cloud gets counted.
Pin the country, not the address
A residential pool moves your exit whatever you do. The checks that matter compare countries, so pin the country and let the address move inside it.
Giving a virtual assistant access without handing over the password
Seller Central, Meta and Google each let you add a virtual assistant under their own login, with chosen permissions. A shared password is the fallback.
What navigator.gpu.requestAdapter tells a page without asking
WebGPU's adapter info gives any page the GPU vendor and architecture with no prompt. A WebGL renderer that says otherwise is a contradiction, not a disguise.
What ANGLE means in your WebGL renderer string
ANGLE is the layer Chrome uses to turn WebGL into Direct3D, Metal or OpenGL. The backend it names in the renderer string tells a site your operating system.
Profile creation caps, the meter missing from the headline
A profile creation limit counts every profile you make, deleted ones included. It exists because delete-and-recreate gets round a profile cap.
What Google Ads advertiser verification asks, and what it joins
Google Ads advertiser verification requirements: a legal name, a country and documents for who pays and who advertises. Every account under that name is one.
Partnership ads let a brand run a creator's post without the password
Instagram partnership ads access is a permission the creator grants from their own account. The brand runs the ad; nobody sends anybody a password.
What breaks in the browser between three clients and thirty
Scaling social media agency operations breaks the browser first: Chrome profiles hold three clients, but thirty needs an exit, 2FA and bulk edits per client.
Anti-detect plans that bundle proxy traffic
When an anti-detect browser plan includes proxy traffic, it is usually a few gigabytes: a sample. What keeps profiles apart is one session per profile.
A quarterly check of who can reach each client account
A social media account access audit is two lists per client: who the platform says has access, and which of your profiles hold a login. Each gap is a finding.
Share the dataset, not the login: Meta's partner model
To share a Facebook pixel with an agency, the client adds the agency's business portfolio as a partner on the dataset. No password moves hands.
Name the browser profile the way you name the ad account
Our naming convention for client ad accounts: ACME-DE-EUR, code first, since a cut-off name keeps its start. The browser profile is ACME-FB-Ads.
The Akamai HTTP/2 fingerprint, read field by field
The Akamai HTTP/2 fingerprint is four fields: the SETTINGS values, the window update, any priority frames and pseudo-header order, all read before content.
Why free anti-detect plans are often cloud-only
A free anti-detect browser with cloud profiles only keeps your first sign-ins as cookies on the vendor's servers. A cookie jar is a credential.
What Meta business verification connects to your business
Meta business verification documents tie a business portfolio to one legal name, address, phone and domain. Two portfolios verified that way are one business.
What happens to your profiles when the subscription ends
When an anti-detect browser subscription expires, where profiles live decides the cost: a cloud vendor holds your cookie jars; a local app leaves them on disk.
What a second seat costs across anti-detect browsers
Anti-detect browsers meter people as well as profiles. A seat is a login to the vendor's shared library; Mosaic has no teams, so it has no seats.
The shared password spreadsheet, and what replaces it
A spreadsheet of client logins breaks two-factor sign-in and leaves nothing to revoke. Partner access first, then one vault per login with its code.
Who owns a Facebook Page an agency built for a client
The business portfolio that created or claimed a Facebook Page owns it, whoever paid for the work. The client creates; the agency is added as a partner.
Yearly discounts on anti-detect browsers, read in full
At 40% off, a prepaid year costs what 7.2 months of monthly billing would. It is also a bet that the engine keeps up with Chrome for twelve months.
Facebook's additional profiles: a second profile Meta built itself
Facebook additional profiles rules, as Meta designed them: one account, one login, and a violation on any profile counts against the whole account.
Facebook's real name policy, and what it allows instead
Facebook's real name policy asks for one personal account per person, under the name you go by. Pages and business portfolios are how you run more.
Why canvas blocker extensions can make you easier to spot
A canvas blocker extension hides your canvas fingerprint by rewriting methods in page JavaScript, and a fresh iframe reads the rewrite: 33 leaked on one probe.
The first hour in the browser with a new client
A social media client onboarding checklist for the browser: ask for partner access, not passwords, then a project, a proxy in their market and their 2FA.
Paying per open browser instead of per profile
Concurrent-browser pricing charges for how many profiles are open at once, not how many exist. Cheap for a big quiet library, costly when many run together.
Accounts Center is a link Meta asks you to make yourself
Accounts Center joins your Instagram, Facebook and Messenger accounts: one login, shared contact details, payments and ad settings. Meta reads it as one person.
Anti-detect browser daily launch limits and per-launch fees
An anti-detect browser daily launch limit meters use, not size: at 500 profiles and 30 launches a day, each profile opens once every 17 days.
Business Manager is now a business portfolio. What changed
Meta renamed Business Manager to business portfolio and moved nothing. An ad account still belongs to the portfolio it was made in, so check whose that is.
What to do with a client's browser profile when the contract ends
Agency client offboarding goes wrong when access is revoked before the client can sign in. Confirm the handover, export, then trash the profile by id.
What a canvas hash actually tells a site about your machine
A canvas fingerprint reveals your rendering stack: GPU, driver, fonts, the OS's text rasteriser and antialiasing. It names a kind of machine, not a person.
Why anti-detect browsers cost what they cost
Anti-detect browsers are expensive per profile when the vendor stores and syncs each one. A profile on your own disk costs the vendor nothing.
Nothing here yet. The first one is coming soon.
Every account its own browser. One price for all of them.
Free holds 3 profiles and 10 profile creations, with no card. Pro is $49 a month for any number, or $490 a year with 2 months free. Try it for 14 days; cancel before day 14 and you pay nothing.