VFLINBrowser-profile operating system · Windows alpha
Isolated Chromium profiles that look like the machine they run on. Synced through a server that holds only ciphertext. Driven from the app, the CLI, an HTTP API or an AI agent — the same calls for all four.
Free: ten profiles in the cloud and ten wallets. Fifty is $10 a month. All six rungs →
Free plan: unlimited profiles on your machine, 10 in the cloud. VFlin Antik_0.1.0_x64-setup.exe · 7.4 MB · unsigned — Windows will warn once.
Four numbers
Each was measured in this repository on a named day, and the tag says where. Nothing here is a round number someone liked the look of.
Why it is better — with the numbers
▮ measured a number read off a running build, dated · ▯ built in the code, tested · ◇ intent planned, not there yet. No awards, no user counts, no reviews — we have not measured any.
t13i1516h2_002f,0035,009c,009d,1301,1302,1303,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_…
in the clear
sealed
| signal | what a profile reports | how we know |
|---|---|---|
| TLS (JA4) | stock Chrome's, byte for byte | measuredC10, a loopback listener records the ClientHello |
| HTTP/2 SETTINGS | stock Chrome's, byte for byte | measuredC11, a TLS-terminating h2 probe |
| canvas | the host's real signature, a crowd of 233 of 258,037 | measuredbrowserleaks, dated |
| WebRTC local IP | masked behind mDNS, no raw local address | measuredC5, in-page ICE candidates |
| GPU · fonts · screen · OS | the machine's own — host-inversion, not a catalogue | builtpath B, by construction |
| UA · UA-CH · timezone · languages | one coherent claim across seven projections | measuredcharacterize |
| UDP through the proxy · HTTP/3 | not yet — a SOCKS5 relay in the daemon is planned | intentplanned, not built |
How it works
Who runs it
Web3
Arbitrage · ads
Social · SMM
E-commerce · marketplaces
Automation and AI agents
the same profile, three ways
$ vflin profile create --name ops-01
HTTP POST /v1/profiles
MCP vflin_profile_create$ vflin profile cdp attach ops-01
→ {"wsEndpoint": "ws://127.0.0.1:…", "expiresAt": …}
node playwright.chromium.connectOverCDP(wsEndpoint)
Security
Pricing
One number decides it: profiles kept in the cloud. Everything the app does is on every tier.
Questions
No product can honestly say that, and this page does not. What we can say is what we measure: the network fingerprint equals stock Chrome's, the canvas signature sits in stock Chrome's crowd, seven identity projections stay coherent, and the checks are published — the consistency suite. A large crowd is not a disguise; it is the absence of a beacon.
No. It stores ciphertext and coordinates a lock; the keys never leave your devices. We read the database of a running unit to write this page — what it can and cannot see.
Yes. A profile's debugging endpoint is handed to your tool through the daemon, per profile, to one client; the MCP server exposes the product to agents; the CLI and the HTTP API do the same as the app.
For the alpha, yes. macOS and Linux need their own build and signing; they are wanted, not built.
It is unsigned — a code-signing certificate is a purchase not yet made. Compare the SHA-256 on the download page with the file you got, then More info → Run anyway.
The free plan is real: unlimited profiles on your machine, 10 in the cloud, one seat. Paid plans exist with their ceilings; their prices are not set yet, and the page says so instead of inventing them.
Yes — under an organisation key, with roles; a removed member's access ends by rotating the key, without re-uploading anyone else's data.
Support
The domain's mail routing accepts this address (measured: it refuses one that does not exist). A Telegram channel is not set up yet. Documentation · Account · Terms · Privacy · Refunds