How this differs

A platform that wants to know whether two accounts belong to one person does not need a confession. It has three independent channels, and one of them is often enough.

The first is storage: cookies, localStorage, IndexedDB, service workers, cached files. The second is the device: what the browser answers when a script asks about the platform, screen, cores, memory, GPU, fonts, clock and languages, plus what canvas, WebGL and audio return. The third is the network: the exit IP, and the country, city and provider read from it.

There is a quieter fourth thing, and it costs more accounts than people expect. It is agreement. A macOS GPU string next to an x86 architecture hint describes a machine that has never been built. Contradictions are cheaper to catch than any single unusual value, which is why our fingerprint test asserts relationships instead of values.

Read every category below with those channels in mind. Almost every option on this page closes exactly one of them and leaves the other two untouched.

• Storage

  Cookies, localStorage, IndexedDB, service workers and cache. Cleared by incognito, separated by a browser profile, untouched by a VPN.

• Device readings

  Platform, screen, cores, memory, GPU, fonts, timezone, languages, canvas, WebGL and audio. One set per machine, unless something changes them.

• Exit IP

  The address the site sees, plus the country, city and provider derived from it. Changed by a VPN or a proxy, never by a browser on its own.

Incognito was built for one job. It gives the session a fresh, temporary cookie jar and forgets it when the last window closes. It does that job well, and it was never meant to do more.

Everything outside that job is unchanged. The screen, cores, memory, GPU string, font list, timezone, languages and canvas output belong to your machine, so two incognito windows read as one computer. The exit IP is the same address as the ordinary window next to it.

There is a practical problem on top of that. Incognito forgets on purpose, so an account you need tomorrow has to be logged in again tomorrow, with a fresh sign-in check each time. Multi-account work needs the opposite: sessions that persist and stay apart.

In ARMANOS a profile is permanent. It gets its own Chromium data directory under fork-profiles and the profile id, so cookies, storage, cache and service workers live in separate trees on disk. Deleting a profile deletes that tree, and the test named delete-leaves-nothing exists because an early version removed the row and left the directory behind.

• What incognito changes

  A temporary cookie jar, and no history entry once the window closes.

• What it leaves alone

  Every device reading and the exit IP. Two windows on one laptop are one device.

• What ARMANOS changes instead

  A separate data directory per profile, kept between launches, with its own device and its own proxy.

• Where incognito is still right

  One throwaway login. Nothing to install, one keystroke away, gone when you close it.

A VPN moves traffic through another exit. It is genuinely useful, and it is honest about being a network tool. It never claims to change your browser.

That is exactly the limit. Thirty accounts opened behind one VPN exit share one IP, and they still share one browser: one font list, one GPU, one canvas result. The address stopped being the giveaway, and the device took over.

We are equally plain about our own side. ARMANOS does not hide your IP. The browser does not change your address, and no page on this site says otherwise. What the app does is attach a proxy to a single profile, so only that profile takes that route: HTTP, HTTPS, SOCKS5, or an exit through your own server over SSH.

Two details matter more than the list of protocols. Proxy credentials never go on the command line: measured on ARMANOS Browser 153.0.7978.0, the form carrying a password made zero requests, and the password would also sit in the machine's process list, so it travels through a loopback bridge instead. And the exit country decides the profile's clock. The app asks four geolocation providers over TLS and takes the agreed answer, because a timezone that disagrees with the IP is one of the first things a fraud system checks.

This is the one category we will not argue with on isolation. A virtual machine is a second computer in software: its own kernel, its own operating system, its own disk. An ARMANOS profile is a process tree on your kernel with its own data directory. The wall around a VM is thicker, and if your work needs that wall, use one.

The price is paid in resources and minutes. Every VM needs an operating system installed and updated, a fixed share of memory while it runs, tens of gigabytes of disk, and a boot before the first click. Fifty accounts means fifty of those, on hardware you own, and a person who keeps them patched.

Our arithmetic differs because the unit is smaller. The app plans one gigabyte of memory per open browser and keeps three gigabytes for the system and itself, so the default limit on an 8 GB laptop is five browsers at once. It is a calculation, not a rule: the Engine screen accepts your own number between 4 and 32. The calculation protects someone who changed nothing, and it should not argue with someone who knows their hardware.

The numbers below were measured with the real app, on our own engine, on a deliberately weak machine.

Machine

MacBook M3, 8 cores, 8 GB

Engine

ARMANOS Browser 153.0.7978.0

Profiles opened at once

9 of 9

Time to open, each

532 to 562 ms

Crashes

0, three runs in a row

Free memory, before and after

745 MB, then 207 MB

Default limit on this machine

5, raised by hand for the run

Measured on 29 August 2026 by apps/desktop/test/восемь-окон.js, which drives the real app and its real launch path, not a stand-in.

An extension is JavaScript running in the page. Even at the earliest injection point it is correcting values the browser has already produced, and it corrects them by replacing what the browser provides.

The replacement is itself readable. A native function replaced by an ordinary one answers differently to toString, reports an empty name and often the wrong argument count. We know this precisely, because our own injected scripts did it. The test injected-masking.js exists because navigator.sendBeacon printed the source of this repository when a page asked it to.

The bigger problem is the gap between declared and measured. A getter can name one GPU while WebGL pixels are still drawn by the real one. It can name a font list while the layout engine measures the real fonts. A page that asks the same question two ways and gets two answers has learned more than any unusual value would have told it.

ARMANOS closes this differently. The profile's values are generated before launch from the profile id, its template, the exit geography and the engine version, then handed to the browser on the command line. The engine assembles the device in C++ before the first script runs. Nine surfaces are closed that way in the shipped build, and each is proven by a marker found in the source tree at build time, so a build that missed a patch cannot claim the capability.

Here is the honest remainder. For a surface an older engine build does not close, the app still substitutes in the page, and it retreats surface by surface as soon as the built engine declares that surface. That decision lives in one file, so the two substitutions can never stack on top of each other and disagree.

• WebGL pixel readback

  Noise applied inside the engine when a page reads pixels back, not in a wrapper around the call.

• Timezone, locale and calendar

  Intl and the clock come from the profile's seed, so the whole formatting stack agrees with itself.

• Font list

  Fonts answer for the profile, not for the machine the browser happens to run on.

• Input and output devices

  The number of cameras, microphones and speakers is the profile's, not the laptop's.

• Speech voices

  Synthesis voices match the language the profile claims to speak.

• Network readings

  Connection speed, round trip time and connection type, taken from the profile.

• Heap limit

  The JavaScript heap limit is clamped to the memory the profile declares, in the same steps Chromium uses.

• WebGPU readback

  Noise on an image captured through WebGPU, so it matches the WebGL path instead of contradicting it.

• Three mobile connection fields

  type, downlinkMax and ontypechange, given to phone profiles only, because desktop Chrome does not have them.

A second profile in an ordinary browser gets its own cookie jar, its own history and its own extensions. Containers do the same thing inside one window. For keeping a personal login out of a work login, this is enough, and it costs nothing.

What they share is everything else. One binary, one version, one font list, one GPU, one screen, one timezone, one exit IP. The storage channel is closed and the device channel is wide open, which is the shape of the problem for anyone running more than a couple of accounts on one platform.

They also have no notion of a team. There is no shared list, no roles, and no way to hand an account to a colleague and take it back later.

An ARMANOS profile carries its own data directory, its own device derived from its id, its own proxy, a folder, tags and notes, one of five templates and one of five scenarios covering twenty platforms. On a paid plan the list is shared with named teammates, and the server holds a busy lock while a profile is open. Two people cannot open one account from two machines at the same time, and that matters: two live sessions of one account from two places is the exact behaviour that gets accounts blocked.

Nothing on this page is more honest than real hardware. A second laptop on a different line, or a phone with its own SIM, is a different device on a different network, with nothing substituted anywhere.

It stops working as a plan at about the third device. Fifty accounts means fifty machines to buy, power, update and store, plus a person walking between them. Handing an account to a colleague means handing over hardware. Working from another city means carrying it.

Our unit is a profile, and the price list is short. The tier that covers fifty accounts is $14 a month, about 28 cents per account. Profiles above a tier cost $2 a month each, a team seat is $3 a month, a quarter takes 10 percent off and a year takes 20 percent. Two profiles are free forever, on the same engine the paid plans use.

Devices are counted separately from profiles: one on Free, two on Professional, five on Business, twenty on Enterprise. A session travels between them in an encrypted transfer file or through a folder you already sync. The file uses scrypt with AES-256-GCM, leaves the cache behind because sites refill it anyway, and carries the profile id, so the account arrives on the same device rather than on a new one.

• 50 profiles

  The Professional tier that covers fifty accounts. About 28 cents per account per month.

  $14 / month

• One extra profile

  Added one at a time above your tier, instead of jumping to the next plan.

  $2 / month

• One team seat

  A colleague with a role, their own login and their own device count.

  $3 / month

• A year up front

  A quarter takes 10 percent off. Both apply to the same table of prices.

  20% off

• Free plan

  Forever, no card, and the same engine that the paid plans run.

  2 profiles

Read the dashes as facts about scope, not as insults. Incognito is not trying to give you a device per account, and a VPN is not trying to give you separate cookies. A tool is not worse for declining a job it never advertised.

Three cells here belong to the other side, and they are marked as such. Incognito opens instantly, a virtual machine isolates more deeply, and a real second device substitutes nothing at all. Everything in the ARMANOS column is either measured or taken from the code, and the files are listed at the bottom of this page.

We would rather you picked the cheap tool when the cheap tool is right. Every line below is advice we would give in person, and none of it is a concession we were forced into.

The rule is simple. Use ARMANOS when you need many lasting accounts that must not be linked to each other. Use one of these when you need what only it does.

• Incognito, for a single throwaway login

  One keystroke, nothing installed, nothing left behind. If you will never return to the account, that is the whole job.

• A VPN, for the whole machine

  It covers apps that are not browsers and protects traffic on a network you do not trust. A proxy inside a profile does nothing for your mail client.

• A virtual machine, for depth

  Its own kernel and its own operating system. Our profiles are processes on your kernel, and they share it with each other and with you.

• An extension, for a browser you already use

  Nothing new to install, no separate app, no cost. If one account is all you have, the trade may be worth it.

• A real second device, for one account worth more than the rest

  No substitution anywhere. If losing that account would cost more than a laptop, give it a laptop.

The six lines below are the ones printed next to our price list, and they have not been rewritten for this page. They describe capabilities, not outcomes, and we would rather repeat them than invent a seventh.

What we sell is isolation and a consistent device. We do not promise that no account will ever be blocked, and we do not promise that a site cannot tell. Behaviour, payment details, phone numbers and the content you publish all link accounts, and no browser reaches any of that.

We also publish no numbers about other products. We cannot measure them honestly, and a comparison table filled with someone else's marketing is worth nothing to you. Every number on this page comes from our own code or our own measurement, and the promise registry lists each claim next to the file that keeps it.

• Isolated profiles

  Separate cookies, storage and cache per profile, so accounts never cross over.

• Fingerprint parameters per profile

  A stable set of User-Agent, language, resolution and hardware hints, applied inside the engine itself.

• Proxy per profile

  Attach an HTTP or SOCKS5 proxy to each profile so its traffic follows its own route.

• Link and tracker cleaning

  Tracking parameters are stripped on every navigation and known trackers are blocked by lists.

• Pay for what you add

  Start free, then add extra profiles one at a time instead of jumping to a bigger plan.

• Own engine, included

  The fingerprint is substituted inside the engine, before the first script, on every plan including the free one.