A proxy per profile

A profile is a whole browser session: its own cookies, its own storage, its own fingerprint. You set its proxy on that same profile.

No global switch puts every window behind one address. You pick one of four connection kinds, and a profile with an unknown kind does not launch.

• HTTP

  The ordinary form most sellers deliver. The hop to the proxy is plain, the rest is whatever the site uses.

• HTTPS

  The same thing, with TLS on the hop between the browser and the proxy.

• SOCKS5

  Carries any TCP connection. The site name goes to the proxy inside that connection rather than to your own resolver.

• SSH

  Not a proxy at all. A tunnel to a server you already have, turned into a real SOCKS5 on loopback before the browser sees it.

Fifty lines from a seller become fifty entries in one paste. You keep an address once, and fifty profiles point at it.

A profile keeps its own copy of the connection, so deleting a library row never silently changes where a working profile goes out.

Search and filters find a proxy, Copy puts lines on the clipboard, and Export writes a file. The Proxy cell of a profile opens a picker with search and New proxy as a line…

Traffic saver stops images and video in a profile. For eight providers the knowledge base shows host, port and login with a finished line.

Every process under your account can read a command line, and residential traffic is sold by the gigabyte. So your password goes to a small bridge on loopback.

It also does not work the other way. Measured on the shipping build:

A rule that names only plain http leaves https going out direct, and today https is everything. Your profile has one address, and every scheme goes through it.

WebRTC is the other way out, and the profile's WebRTC mode decides it. In the default mode it is closed the same way; Real shows your address on purpose, and an extension with the privacy permission can override the mode.

A clock that disagrees with the address is among the first things a fraud check looks at. The exit country decides the profile timezone and languages.

Your profile asks the country through the proxy itself, over TLS, from up to four providers.

The proxy is checked before every launch. A proxy that does not answer does not open the profile, and the profile row says why.

Mobile addresses are bought because they change. The app walks the rotation link directly, not through the channel being restarted.

1. 1

   By hand

   Change IP on a library row. You see the address before and after, so you know what happened, not what was asked.

2. 2

   Before a launch

   With Get a fresh IP before each launch ticked, a profile asks for a fresh address every time it opens. If the change fails the profile does not open.

3. 3

   While the profile is open

   With Change the IP while the profile is open set, an address changes on its own while the profile works, and only while it works: a closed profile has no reason to spend a change. The clock starts within the first minute after you open the profile, not when the app starts.

4. 4

   Spread across the library

   Fifty profiles take fifty different addresses from one list instead of crowding onto the first.

A server you already have is an exit that costs nothing extra. An ordinary ssh with dynamic forwarding runs next to the profile, and the browser sees a real SOCKS5 on loopback.

The password never touches the command line here either.