Antidetect browser: what it is and how it works
The word "antidetect" names a tool that makes several accounts on one computer look like several different people. The name overpromises: it suggests an invisibility that does not exist. Let us go through it honestly — what is actually inside, what it buys you, and where the limit of the possible sits.
What actually gets detected
When you open a site, the browser reports dozens of characteristics about itself, without asking you: version and system, time zone, language, screen resolution, core count, memory size, graphics card model, the set of installed fonts, small quirks in how it draws images and processes audio. Any single value means nothing on its own — millions of browsers share it. But the combination narrows the field down to a handful of machines, sometimes to one.
That combination is the browser fingerprint. A site does not need to set a cookie to recognize you again: it is enough to compute the fingerprint and compare it with what it saw yesterday.
The fingerprint is only one of three links. Together they tie accounts to each other:
- cookies and site storage — direct traces of past visits;
- the browser fingerprint — who you are to the site, even without cookies;
- the IP address — where you connected from.
A detailed breakdown of all three is in how to run several accounts from one computer.
What an antidetect browser actually does
Three things, and all three are required — on its own, none of them works.
Separates storage. Every account lives in its own profile: its own cookies, its own storage, its own extensions. This is the foundation, and also the easiest part — plain Chrome can already do separate profiles.
Gives every profile its own proxy. Not one address for the whole program, but a separate one for every window.
Spoofs the fingerprint so that it does not contradict the proxy. This is where the real difference between tools begins.
The key word is consistency, not "spoofing". A German proxy with a Moscow time zone and a Russian browser language is more suspicious than no spoofing at all: ordinary users never look like that. The approach that works is to take the time zone, language, geolocation and headers from the country the proxy actually exits through, and keep them the same from launch to launch.
What not to spoof
Tools in this space like to promise "we spoof everything." In practice, spoofing that is visible does more harm than none at all, and a sensible set looks like this:
| Worth spoofing | Better left alone |
|---|---|
| time zone, language, geolocation | screen resolution |
| core count, memory, graphics card | the set of fonts |
| canvas, WebGL, audio | the TLS handshake |
One rule covers it: spoof what actually sets you apart; leave alone what makes you look like everyone else.
Fonts on an ordinary Windows machine are the same across millions of computers — they do not set you apart, and giving every profile its own random set would do exactly the opposite: each profile would become rare, and therefore noticeable. The screen is not spoofed because the window gets resized by hand, and a spoof on a resizable window sooner or later drifts away from the real size. The TLS handshake is how the browser says hello to the server; a real Chrome's handshake matches millions of live browsers, and there is no better hiding place than that, while a custom build's handshake is its own and therefore stands out.
One caveat, without which the point about fonts would be a half-truth: it holds for an ordinary system. If a computer has exotic font sets installed — designer fonts, rare handwriting fonts — the set becomes rare on its own, and profiles on that machine really do end up looking alike. Better not to install such fonts on a working machine.
Two designs: a cloud build and a program on top of Chrome
Tools split into two kinds, and this is the most important difference between them.
A cloud service with its own Chromium build. Profiles and cookies live with the service, the browser is their own build. Pros: works on any system, a profile opens on a different computer, team work is possible. Cons: your data does not live with you, the build always lags a bit behind current Chrome, and you pay by the number of profiles, every month.
A program on your own computer, on top of real Chrome. Profiles sit on your disk, and the browser that launches is the actual Chrome you installed from Google's site. Pros: data goes nowhere, the browser updates itself, and it looks like ordinary Chrome from the outside because it is ordinary Chrome. Cons: one workstation, your own operating system, moving to another machine takes manual work.
Neither option is simply better: they solve different problems. A team of five people on different systems needs the first kind. One person who does not want to hand their cookies to someone else's cloud needs the second.
The debugging channel and signing in to Google
There is a technical detail almost nobody writes about, and it decides whether you can sign in to a Google account at all.
Fingerprint spoofing is usually installed through the browser's debugging channel — the same one Playwright and Puppeteer use. Google detects the mere presence of that channel and answers with "This browser or app may not be secure." We tested this directly: it is not about the commands sent over the channel, and not about the quality of the spoof — having the channel open at all is enough.
No amount of fingerprint tuning gets around this, and if signing in to Google matters to you, ask a tool not "what antidetect do you have" but exactly how it installs the spoof. There is a way to do it without a debugging channel: an extension inside the profile itself has the same capabilities from within, while the browser looks ordinary from the outside.
How to check that the spoof actually works
Checking sites — iphey, browserleaks, creepjs — show you what a page sees. Worth using, with two caveats.
Look for contradictions, not the overall score. A green "you look normal" message does not say much; what matters are mismatches between values — the IP's country against the time zone, the browser language against the region, values on the page itself against values from background processes.
One check is not enough. Some data a page reads in the very first instant of loading, some comes from background processes, and a spoof that lands late or never reaches the background will give two different answers on the same tab. That shift tells a checking service more than any single value ever could.
The main disappointment
Better to face it in advance: most of the time it is the proxy, not the fingerprint.
We saw this against live Cloudflare protection. A profile with an impeccable setup kept looping through a captcha for the simple reason that its address came from a known server subnet. Neither changing the fingerprint nor switching between HTTP and SOCKS changed anything — only moving to a residential proxy helped. A breakdown of proxy types and their prices is in a separate article.
And the other half of the same truth: no tool cancels a platform's rules or makes you invisible. Isolating profiles solves exactly one problem — different accounts look like different visitors, not like one person with ten tabs open. An account that breaks the rules gets banned no matter what it was opened with.
How this is built in Morfiade
Morfiade is a Chrome profile manager for Windows: a program on your computer, not a cloud.
- profiles are created in batches, each with its own proxy from a shared library;
- spoofing is a checkbox on the profile, and it pulls the country, time zone and language from the proxy by itself;
- the fingerprint is in place before the page's first line of code runs, and it applies inside background processes too;
- when checking a proxy, the program asks two independent databases for its country and colors a traffic light: if the databases name different countries, no setting fixes that;
- the spoof is installed by an extension inside the profile, there are no debugging flags on the command line — signing in to Google works on such a profile;
- a separate button shows what the page actually sees: what was intended, what the tab sees, what the background process sees.