Anti-detect browsers are surrounded by two myths. The first: “it’s a magic button after which you won’t get banned.” The second: “it’s exclusively a tool for fraudsters.” Both are wrong. In reality, it’s a rather boring engineering thing — isolated browser environments with controlled fingerprints — and it works exactly as carefully as you configure it.
This guide is assembled from the official Octo Browser documentation and analyses of fingerprinting mechanics. It’s long and systematic: first theory (without it you’ll click checkboxes aimlessly), then step-by-step practice, then automation, pricing, common mistakes, and an honest discussion about boundaries. If you already understand what a Canvas hash is — you can skip the first two parts.
Registration: ** 🔥 Best Multiaccount Browser. Secure and Fast.**
Who really needs this: agencies managing multiple client ad accounts; sellers on marketplaces with several legal entities; QA engineers who need to test a site from ten different devices; OSINT specialists working with investigative accounts; traffic arbitrageurs.
Who doesn’t need it: if you just want privacy while surfing — take a regular browser with tightened settings and a VPN; anti-detect is excessive and expensive here.
Part 1. How they identify you even before login
The main misconception of a newcomer is “switched IP, cleared cookies, therefore I’m a new user.” No. IP is one indicator among several dozen, and not the most informative.
Modern systems like CreepJS collect about 52 separate parameters. We’ll go over the most important mechanics, because that’s what you’ll control in your profile settings.
Canvas. The script draws text with overlaid shapes in an invisible element, then converts the result to Base64 and takes a hash. The point is that different OSs, drivers, and graphics chips smooth fonts differently and perform subpixel rendering. The image looks the same, but the bytes are different. You get a stable identifier for your hardware+driver+OS combo.
WebGL. Here it’s even more interesting: via the parameters UNMASKED_VENDOR_WEBGL and UNMASKED_RENDERER_WEBGL, the site directly asks for the GPU model, and then additionally renders a test 3D scene and takes a hash — driver differences (AMD, NVIDIA, Apple) yield different results.
AudioContext. The same principle, but with sound: the browser computes the audio signal, and microdifferences in implementation yield another hash.
Others — a set of system fonts, screen resolution and depth, hardwareConcurrency (number of cores), deviceMemory, time zone, languages, media devices, WebRTC (which can reveal your real IP bypassing proxies), Client Hints headers and even the order of fields in TLS handshakes.
Noise paradox
Here’s the moment to understand before you start turning dials. Naive protection — injecting random noise into Canvas so the hash changes every time. The problem is that lack of data and instability is also a fingerprint. A typical user on ten page reloads yields the same Canvas hash. If yours is different every time, you’re not “blending in” — you’ve raised the flag for anti-detect.
Hence the second principle of modern anti-fraud systems: consistency analysis. The system isn’t so much looking for uniqueness as checking whether such a combination occurs in nature. iPhone with 1920×1080 resolution and Windows fonts, German proxy with timezone America/New_York, eight-core processor with a mobile User-Agent — all easily detectable.
The main principle, from which everything follows: the goal is not to become unique, but to become indistinguishable from a normal user. Uniqueness is what gets you detected.
Part 2. Two approaches to spoofing — and which Octo uses
Anti-detect browsers solve the problem in two ways.
Noise. Subtle distortions are added to Canvas/WebGL/Audio output so the hash changes. Cheap to implement, but hits the same paradox above.
Spoofing real fingerprints (substitution). Profile parameters are taken from real devices — they’re internally consistent and look natural. This approach is what Octo proclaims: in marketing terms, these are “high-quality fingerprints based on real devices,” and spoofing happens at the browser engine level, not as a JavaScript wrapper over the page (wrapper is easy to detect by checking if native functions are overridden).
In practice Octo combines both: basic parameters (renderer, screen, fonts, cores, memory) are taken from real sets, and optionally hardware noise is added on top for Canvas, WebGL, Audio and ClientRects.
Part 3. What exactly can you tweak
This is what you pay for. Below is the actual profile parameter set from the API documentation; in the UI they’re also laid out across tabs.
| Group | Parameter | Values |
|---|---|---|
| System | os |
win, mac, lin, android |
| System | os_arch / os_version |
x86/arm; Windows 10/11, Android 13–15 |
| Hardware | cpu |
2, 4, 6, 8, 10, 11, 12, 14, 16, 20, 24 cores |
| Hardware | ram |
2, 4, 8, 12, 16, 24, 32, 64 GB |
| Hardware | screen |
e.g. 1920x1080, list from /fingerprint/screens |
| Hardware | renderer |
GPU model from /fingerprint/renderers |
| Browser | user_agent |
string up to 255 chars |
| System | fonts |
array of system fonts |
| Locale | languages |
type ip / real / manual + BCP-47 tags |
| Locale | timezone |
type ip / real / manual + IANA zone |
| Locale | geolocation |
type ip / real / manual + lat, lon, accuracy (1–999 m) |
| Network | webrtc |
ip, real, disable_non_proxied_udp |
| Network | dns |
custom DNS server |
| Anti-detect | noise |
flags for webgl, canvas, audio, client_rects |
| Media | media_devices |
video_in, audio_in, audio_out — 0–5 each |
| Mobile | device_type / device_model |
phone/tablet; model from the directory |
Note the types ip / real / manual for languages, time zones and geolocation. The ip mode is automatic proxy-aware tuning, and in 95% of cases you want that: it automatically resolves the most common source of contradictions.
Separately about webrtc: the real mode will reveal your actual IP bypassing the proxy — that’s a hole the size of a gate, undermining all the other work. Viable options are ip (substitute a proxy address) or disable_non_proxied_udp.
Screenshot: official Octo Browser documentation
Part 4. The first profile: step by step
Screenshot: official Octo Browser documentation
Step 1. Choose the creation method. There’s a “Quick profile” — you click the OS icon (Windows, macOS Intel, macOS ARM, Android), and the system generates coherent random parameters and a name. And there’s “Create profile” — full manual setup. Honestly, beginners are recommended the first one: less chance to break consistency by hand.
The OS for an already created and saved profile cannot be changed. Decide before creating — otherwise you’ll have to create a new profile.
Step 2. Fill in general settings. Name (required), icon, description, filtering tags, startup pages (up to 20), bookmarks (up to 100).
Step 3. Configure storage. Separate toggles determine what the profile remembers between sessions: cookies, passwords, extensions, localStorage, history, bookmarks, service workers. For long-lived accounts turn everything on — the accumulated session history looks natural on its own.
Step 4. Check the fingerprint.
Screenshot: official Octo Browser documentation
Пользовательский агент генерируется под выбранную ОС автоматически — менять его вручную не надо. Документация прямо предупреждает: ручная правка ломает целостность отпечатка, и вы своими руками создаёте то самое противоречие, которое ищет антифрод.
Языки, таймзону и геолокацию оставьте в режиме привязки к IP. Кнопка «New fingerprint» перегенерирует версию ОС, разрешение, шрифты, ядра, память и рендерер разом.
Шаг 5. Проверьте результат до работы. Запустите профиль и зайдите на любой чекер отпечатков (browserleaks, whoer, creepjs). Смотрите не на «уникальность», а на непротиворечивость.
Чек-лист перед началом работы: гео прокси совпадает с таймзоной профиля · реальный IP не течёт через WebRTC · платформа в отпечатке соответствует заявленной ОС · Canvas-хеш стабилен между перезагрузками страницы.
Полезные мелочи: пароль на профиль (4–255 символов, сквозное шифрование), защита от сканирования портов включена всегда и не отключается, есть лимит на размер подгружаемых изображений (по умолчанию 10 КБ) для экономии трафика на прокси.
Часть 5. Прокси — то, на чём всё держится
Хороший антидетект с плохим прокси бесполезен. Это самая частая причина провала.
Скриншот: официальная документация Octo Browser
Поддерживаются http, https, socks, socks5 и ssh. Добавлять можно строкой формата ip:port:login:password. Прокси либо сохраняется в общий менеджер и переиспользуется по UUID, либо задаётся инлайном только для одного профиля. У сохранённого прокси есть поле change_ip_url — ссылка для ротации адреса.
Три правила, которые определяют результат:
Одно окружение — один прокси. Никогда не запускайте два профиля через один адрес, если они не должны быть связаны. Совпадение IP связывает аккаунты мгновенно и намертво — это самая дорогая ошибка из всех возможных.
Тип прокси под задачу. Дата-центровые адреса дёшевы и быстры, но их принадлежность к хостингу видна по ASN, и на чувствительных площадках они горят. Резидентские и мобильные выглядят как обычные пользователи и стоят дороже. У Octo есть встроенный магазин резидентских прокси, но никто не обязывает им пользоваться — свои подключаются свободно.
Проверьте прокси до того, как заводить аккаунт. Адрес не должен числиться в чёрных списках, скорость и стабильность важнее «свежести», а гео должно совпадать с тем, что вы декларируете в профиле.
Часть 6. Кookies и «прогрев»
Свежесозданный профиль, который сразу идёт логиниться в важный сервис, выглядит подозрительно: пустая история, ноль куки, никакого прошлого.
Скриншот: официальная документация Octo Browser
Octo принимает куки в форматах JSON и Netscape — перетаскиванием файла или вставкой текста. Куки можно и выгрузить, что удобно при переносе или бэкапе.
Практика простая: дайте профилю пожить обычной жизнью. Походите по нейтральным сайтам, поищите что-нибудь, посмотрите видео. Полчаса естественной активности дают профилю историю, которая делает последующий вход органичным.
Часть 7. Работа командой
Тут Octo довольно силён, и это его основной аргумент для агентств.
Профили расшариваются между участниками команды с настраиваемыми правами: доступ можно выдавать по тегам, то есть сотрудник видит только свой пул. Есть пароли на отдельные профили, есть журнал действий (Action Log), чтобы понимать, кто что запускал и менял. API-токен при этом видит только владелец мастер-аккаунта — участникам команды он недоступен.
Пара оргвыводов из этой механики: раздавайте доступ по тегам с самого начала, иначе через месяц у вас будет каша из шестисот профилей; и помните, что при увольнении сотрудника менять придётся не только доступ в Octo, но и пароли самих аккаунтов, к которым у него были сессии.
Часть 8. Автоматизация
Здесь начинается самое интересное для тех, кто на форуме сидит не ради кнопок. Архитектура состоит из двух разных API, и путаница между ними — типичный источник вопросов.
Public API живёт в облаке и управляет сущностями: создаёт профили, теги, прокси. Базовый адрес — https://app.octobrowser.net/api/v2/automation/profiles, авторизация заголовком X-Octo-Api-Token.
Local API работает на вашей машине, слушает строго 127.0.0.1:58888 (без удалённого доступа) и отвечает за запуск и остановку браузера.
Токен берётся в настройках мастер-аккаунта на вкладке «Additional». API доступен начиная с тарифа Base.
Скриншот: официальная документация Octo Browser
Шаг 1. Создать профиль
const axios = require('axios');
const data = JSON.stringify({
"title": "Test profile",
"fingerprint": { "os": "win" }
});
axios({
method: 'post',
url: 'https://app.octobrowser.net/api/v2/automation/profiles',
headers: {
'Content-Type': 'application/json',
'X-Octo-Api-Token': '<YOUR_TOKEN>'
},
data
}).then(r => console.log(r.data));
Step 2. Run it locally
curl --location 'http://localhost:58888/api/profiles/start' \
--header 'Content-Type: application/json' \
--data '{
"uuid": "2bbfd1dbaf3349cf979787f15a9e413d",
"headless": false,
"debug_port": true,
"timeout": 120,
"only_local": true
}'
The response contains exactly what you need to connect:
{
"uuid": "2bbfd1dbaf3349cf979787f15a9e413d",
"ws_endpoint": "ws://127.0.0.1:54739/devtools/browser/4d05ab38-...",
"debug_port": "54739",
"state": "STARTED"
}
Step 3. Connect the library
ws_endpoint is fed to Puppeteer or Playwright via CDP, debug_port — Selenium.
const puppeteer = require('puppeteer-core');
const browser = await puppeteer.connect({
browserWSEndpoint: 'ws://127.0.0.1:54739/devtools/browser/4d05ab38-...',
defaultViewport: null
});
const page = await browser.newPage();
await page.goto('https://browserleaks.com/canvas');
Stop profile — POST /api/profiles/stop, view running — GET /api/profiles/active.
One-off profiles. A profile is created and started with a single request, and after closing is removed automatically — perfect for parsing and one-off checks. The limit is counted as 4 requests.
Public API limits depend on the plan: Base — 50 requests per minute and 500 per hour, Team — 100 and 1500, Advanced — from 200 and 3000. With 429 look at headers X-Ratelimit-Remaining and Retry-After.
Part 9. How much it costs
Prices are current at the time of writing (August 2026), monthly billing. Before purchasing, check the official pricing page — vendors revise them.
| Plan | Price | Profiles | Team | API |
|---|---|---|---|---|
| Lite | €10 | 3 | — | no |
| Starter | €29 | 30 (+20) | — | no |
| Base | €79 | 200 (+100) | — | 50 RPM / 500 RPH |
| Team | €169 | 600 (+250) | 6 (+3) | 100 RPM / 1500 RPH |
| Advanced | €329 | 100 000 | 8 and more | 200+ RPM / 3000+ RPH |
Prepay discounts: 10% for 3 months, 20% for 6, 30% for a year. No free tier or trial — minimum entry is Lite at €10.
Practical recommendation: if you need API — that immediately means Base, there is no lower. If you work solo with a dozen accounts, Starter suffices. Team makes sense for team roles, not for the number of profiles.
Registration: 🔥 Best Multiaccount Browser. Secure and Fast. (forum referral link)
Part 10. Mistakes that burn profiles
Collected from practice and analyses — almost all failures boil down to this list.
Working without proxies or from someone else’s IP. The bluntest: you claim an American user, but come from a home address in another country.
Logical contradictions in fingerprint. Mobile User-Agent with desktop resolution, Android with Windows fonts, 24 cores on a phone. That’s why you shouldn’t tweak parameters by hand without understanding.
Geo desynchronization. German proxy, American time zone, Russian UI language. Keep languages/timezone/geo tied to IP — and the problem disappears.
One proxy for several profiles. Connects accounts more reliably than anything else.
Profile mixing. Opened a link from one account in a normal browser where another is logged in — and linked them via cookies and referrer.
WebRTC leak. Real mode with active proxy ruins everything.
Lack of warm-up. An empty profile that goes straight to an important action.
Sudden movements. Twenty registrations per hour from one subnet look exactly as they do.
Part 11. Boundaries: law, platform rules, and common sense
Here we should speak plainly, without marketing haze.
By itself, anti-detect browser is legal commercial software, and its use is not illegal. Isolation of environments, testing, research accounts, managing several client accounts by proxy — normal scenarios.
Platform rules are separate from the law. Many services explicitly prohibit multiple accounts per user, and circumventing this restriction violates their ToS: consequences — account blocks, frozen funds, loss of ad accounts. Legally it is not a crime, but commercially it can be costly, and responsibility is entirely on you.
Using anti-detect for fraud — fake accounts to deceive people, carding, boosting, and abusing bonuses, evading bans for violations — is illegal activity, and no technology makes it legal. This is not the topic of our forum and not what this guide was written for.
No guarantees. This is an arms race: platforms improve detection, anti-detects catch up. A fingerprint that worked yesterday may burn tomorrow — and the good news is that vendors must release updates. Anyone promising 100% unbreakability sells a fairy tale.
Part 12. Alternatives and how to read comparisons
Besides Octo there are Multilogin, Dolphin Anty, GoLogin, AdsPower and a dozen smaller solutions.
Useful skill: almost all articles like “top-10 anti-detect browsers” are written by vendors or their partners — and, amusingly, each ranks first in its own rating. When reading a comparison, first check whose domain hosts it.
A reasonable way to choose is not by ratings but by your requirements: do you need API (and which plan includes it), do you need team roles, is Linux supported, which proxy types are accepted, are there mobile fingerprints. And test on your tasks in the first paid month.
FAQ
Does anti-detect replace VPN? No. These are different layers: VPN/proxy changes the network path and IP, anti-detect is about what the browser itself reveals. Without a proxy anti-detect is almost useless.
Is incognito mode or separate Chrome profiles enough? No. Incognito isolates cookies, but fingerprinting of hardware and graphics remains the same.
Can free solutions work? There are open projects and Firefox profiles with tightened settings, but they give noise instead of consistent fingerprints and do not solve the problem of scale and team collaboration.
Does it work on Linux? Yes, Windows, macOS (Intel and ARM) and Linux are supported; there are Android mobile fingerprints.
What to do if an account is still banned? Analyze the reason, not the tool: in 90% of cases it’s proxies, geo mismatch, or behavioral factor, not a bad anti-detect.
Sources
- Official Octo Browser site and pricing page
- Documentation: browser profile settings
- Documentation: API start and Local Client API
- Documentation: fingerprint parameters and proxies
- Official guide for automating via API
- Habra: browser fingerprints how the technology works
- vc.ru: how anti-detect browsers are built
Who already works with anti-detect — what did you settle on and why? And the main question to practitioners: what was the most common ban reason — proxies, fingerprint, or behavior?