The Mosaic blog

News from the product, the engineering behind it, and the reasons we made the calls we made.

RSS feed

A fingerprint, a proxy and a cookie jar that agree
Story

Why the parts of a profile have to agree

Fingerprint, proxy and cookies consistency: sites compare the three, and each can look fine alone while together they describe nobody.

Every profile's files in its own folder, beside a screenshot: mosaic storage settings: each profile downloads into its own folder
Story

A downloaded file is evidence of its profile

With several browser profiles, one shared Downloads folder mixes every profile's files and outlives them. Mosaic gives each profile its own folder instead.

Background tab versus Foreground tab, each name in its own tile: Never ready in 140s, then ready in 8.2s
Story

A detector that never answered because its tab was in the background

Background tab throttling stops requestAnimationFrame. Our test tab was in the background, two detectors never answered, and Page.bringToFront fixed both.

What cloud sync costs, and what local costs, beside a screenshot: mosaic projects: one library split into Client work, Etsy shops and Social team
Story

What cloud sync costs an anti-detect browser

Cloud sync puts every logged-in session you run in one vendor's database. Mosaic keeps profiles on your disk instead, and pays for it in three ways.

One plan, one number, no tiers, beside a screenshot: what the Mosaic plan includes: unlimited profiles and projects, the REST API and the MCP server
Story

Why Mosaic Pro is one price

Anti-detect browser pricing per profile sells a count. Mosaic Pro is $49 a month for any count, because a profile on your own disk costs us nothing.

Chrome versus Chromium, each name in its own tile: Same version, one name missing
Story

When the FingerprintJS demo can't name your browser

FingerprintJS read 'Chromium-Based Browser Not Available' for our engine. We blamed the version; the real variable was Google's branding.

3: Three requests, three countries, one endpoint
Story

Peru, Brazil and Bahrain in three requests

A rotating proxy with no country pin can exit in a different country on every request. Fine for a stateless scrape, fatal to a profile that keeps one timezone.

Exit in Russia, Accept-Language: es-MX, beside a screenshot: a profile fingerprint in Mosaic: GPU, screen, fonts, timezone and language matched to the exit
Story

A Russian exit and a profile speaking Mexican Spanish

A profile matched to a Russian exit kept sending es-MX in Accept-Language. Leaving the language alone was right. Saying nothing about it was the bug.

Tesseract versus Chrome, each name in its own tile: Following “(whale)” to the end
Story

IPHey's "(whale)" signal, and what it was really about

IPHey's inconsistent browser fingerprint (whale) looked like a version problem. We followed it through branding and JavaScript to a Widevine certificate.

70: Branded Chrome, one Mac, one afternoon: 100, 100, 70, 0
Story

IPHey's score moved with the address, not the browser

IPHey score changes even on an untouched Chrome: 100, 100, 70 and 0 in one afternoon. The score follows the exit and the moment; the browser card does not.

3 of 3: Unreachable through the exit, answering direct
Story

The residential IP several detectors already knew

A residential proxy can be detected as a proxy because it is one. On one Wichita exit, FingerprintJS and incolumitas never loaded in three rounds.

Europe/Vienna versus America/New_York, each name in its own tile: Masking detected landed on the right timezone
Story

We broke the timezone on purpose and Pixelscan liked it better

We changed only the timezone on one profile behind a Slovak exit. Pixelscan flagged masking on the Vienna row, the correct one, and the controls disagreed.

640px: The profile's name, drawn left of the address bar
Story

Posting to the wrong client's account, and how it happens

A post lands on the wrong client's account because two clients share one browser and every window looks the same. Delete it, tell both, then label windows.

4 of 4: The bot card was never the bug, beside a screenshot: creating a profile in Mosaic: a checked proxy, and the hardware and locale drawn to match its exit
Story

Pixelscan's automated behavior card, reproduced and not

Pixelscan's automated behavior detected card never came back on our own platform beside stock Chrome. The foreign platform claim failed four times in four.

1 of 6: One surface off, and the masking verdict went
Story

Pixelscan's masking verdict, bisected to one surface

We bisected Pixelscan's masking detected verdict on one profile. Canvas, WebGL, audio and client rects were fine. Hiding about 2% of font families caused it.

60 min: Hawaii to Arkansas, and nobody said expired
Story

What an expiring sticky session looks like from inside a browser

A sticky session expired on our proxy: the browser showed tunnel errors, the check a healthy proxy in another state. Neither said expired.

Client, platform, role. Then tags., beside a screenshot: filtering Mosaic profiles by tag: only the profiles tagged "shop" are listed
Story

Naming 300 browser profiles so you can still find one

Name each profile client code, platform, role, in that order, so one search finds a client and one sort groups them. Status goes in a tag, not the name.

The owner is a project. The state is a tag., beside a screenshot: mosaic projects: one library split into Client work, Etsy shops and Social team
Story

Projects say who owns it, tags say what state it's in

How to organize client accounts with tags: the client goes in a project, the state in a tag. Owners rarely change; states change weekly.

1 exit: Saved, reported, and ignored three times
Story

The setting was saved, and three launches ignored it

Our rotation setting was stored, reported back by the API, and ignored by three launches. A mapper had copied every field of the proxy except the new one.

159: Same Mac, two claims: 159 fonts against 1
Story

Why OS spoofing fails on fonts: a Mac makes Mac profiles

Why OS spoofing fails on fonts: they come from the computer, not the claim. A Linux profile made on our Mac showed 1 font where macOS showed 159.

400: A session token on a rotating port, beside a screenshot: a proxy check result in Mosaic: latency, exit address, ISP, HTTPS tunnelling and reputation
Story

A session token on a rotating port is a 400, not a no-op

"Can not use -session- on rotating ports" means the port, not the username, decides stickiness. We had written the opposite, until we asked the gateway.

2 of 4: Two of four canvas routes were never noised, beside a screenshot: mosaic settings showing the installed Tesseract Chrome engine and its version
Story

The canvas method nobody noised: what a worker test found

Our canvas noise reached toDataURL and missed toBlob, so a page calling toBlob got a PNG byte-identical to stock Chrome's. A worker test caught it.

Every account its own browser. One price for all of them.

Free holds 3 profiles and 10 profile creations, with no card. Pro is $49 a month for any number, or $490 a year with 2 months free. Try it for 14 days; cancel before day 14 and you pay nothing.