Why Incognito Plus a Proxy Can't Manage Multiple Accounts

What incognito mode actually does: it clears local records, not your identity

Private browsing has exactly one design goal: leave no trace on this computer. History, cookies, form entries and local storage are never written to disk, and everything is discarded when the window closes. It protects you from the family member who shares your laptop, not from the website trying to recognize you.

For multi-account work that design creates two problems. First, nothing persists: every session starts with logging in, waiting for a code and clearing two-factor again, which does not scale past a handful of accounts. Second, tabs inside one private session still share a single cookie jar, so signing into store one in tab A and store two in tab B simply evicts the first session. What looks like multi-account is really one account at a time.

Most importantly, incognito changes none of the environment values the browser reports. Resolution, timezone, language, font list, Canvas and WebGL rendering results, hardware concurrency — all identical to a normal window. From the site's point of view you wiped a notepad; the person holding it did not change.

• Private windows clear on close, so login state and local storage never persist
• Tabs in one session share a cookie jar, so account sessions overwrite each other
• No fingerprint parameter changes: Canvas, fonts, timezone and hardware are reported as-is
• Browser-level settings such as extensions and their permissions remain the same install

A proxy changes one field: the IP moves, twenty other values do not

What a proxy or VPN does is precise: it changes your exit IP so the site sees the proxy server rather than your home connection. That genuinely matters — a dozen different accounts signing in repeatedly from one residential line is suspicious on its own. But it is one layer of many.

After the IP changes, every other value the browser reports is untouched. The timezone is still Asia/Shanghai, the system language is still zh-CN, the font list still carries a full set of Chinese typefaces, and the Canvas hash is identical to the account you used half an hour ago. An IP in Los Angeles paired with a Shanghai clock is itself a contradiction, and it stands out more than the original address would have.

Then there is the leak everyone forgets: WebRTC. To set up peer-to-peer connections the browser probes local network interfaces without going through the proxy, and can hand the page your LAN address or even your real public IP. The proxy is configured, and the page still sees where you really are — this is the single most common reason people get linked despite a clean proxy. Route quality counts too: datacenter ranges, shared addresses that have been flagged before, and dozens of accounts behind one IP are all recorded separately, which is why we bind residential proxy IPs to profiles rather than to the machine.

• A proxy changes the exit IP only; timezone, language and fonts stay local
• An IP location that disagrees with timezone and language is a conspicuous contradiction
• Unhandled WebRTC bypasses the proxy and leaks your real address
• Datacenter ranges, flagged shared IPs and many accounts per IP are risk signals in themselves

The five layers of signals platforms use to decide "same person?"

Think of linking detection as five filters stacked on top of each other; an overlap in any one of them raises the odds that two accounts get tied together. Incognito addresses part of layer three, a proxy part of layer one, and the remaining three and a half layers stay exactly as they were.

Layer 1: network

Exit IP, its ownership and type (residential, datacenter, mobile), ASN and carrier, which accounts that address has been seen with before, and TLS handshake traits (JA3 / JA4). That last one is decided by the browser core and negotiated before any page script runs, so no JavaScript-level override tool can touch it.

Layer 2: device and browser

The browser fingerprint proper: Canvas, WebGL and GPU strings, Audio, font list, resolution and colour depth, hardware concurrency, device memory, user agent and platform, timezone and language. These values are read from the environment rather than stored in it, there is no clear button, and incognito mode does not touch a single one of them.

Layer 3: storage and session state

Cookies, localStorage, IndexedDB, service worker caches, and the device identifiers and risk tokens platforms write into them. Shared storage across accounts is the most direct evidence of a link there is. This is the layer incognito clears — at the cost of taking your login state with it.

Layer 4: account details

Registration email and phone number, payout account, identity documents, shipping and return addresses, linked payment methods. This layer has nothing to do with browsers: two stores paid out to the same bank card stay connected no matter what software you run. No tool fixes it; the business has to be structured for it.

Layer 5: behaviour and business data

Login timing, working rhythm and mouse movement, overlapping products and images, description templates, pricing strategy, shipping setup, even support replies. When two supposedly unrelated sellers list the same photos and answer buyers from the same template, risk systems do not need a fingerprint to draw the line.

Why virtual machines, cloud phones and multiple Chrome profiles fall short

Everyone tried the improvised options before buying anything. They are not useless; each one simply stops at a particular layer, and its cost grows with the number of accounts, sometimes faster than linearly.

When a fingerprint browser is the right tool, and when it is not

The tool is not universal, and the test is simple: is your problem that several accounts share one machine's environment traits?

Cases where it is the right tool

You maintain several stores, ad accounts or social profiles on one computer over months and want each session to survive on its own; you need to hand specific accounts to colleagues without sending credentials; you verify localized pages per country and need timezone, language and currency to render the way that market sees them; or you run automation and need every task to have a stable, logged-in environment that does not collide with the others.

Cases where it will not help

Accounts linked through overlapping details — one payout account, one ID document, one address; accounts judged to be the same operator because of duplicated products or content; a platform that has already opened manual review and is asking for verified documents; or the simple wish to open a few extra windows for a single account, where the browser's own profiles are enough. Treating the tool as ban insurance is the most common misunderstanding in this category.

Once you do use one, how should a single account's profile be set up?

The software is rarely what decides the outcome; whether each profile adds up to a plausible person is. The list below covers the mistakes we see most often, in the order you should work through them.

• One account per profile. Never rotate two logins through the same profile — once the storage layer has mixed, it cannot be unmixed
• Keep proxy, timezone and language in agreement: a US route means a US timezone and en-US at the top of the language list
• Stay put. Keep one account on one exit route instead of rotating daily; hopping between regions looks worse than never moving
• Never copy cookies between profiles or import the same session file twice — that wires layer three straight through
• Warm a new profile with ordinary browsing before signing into the main account, rather than going straight to the seller dashboard
• Keep verification separate: distinct recovery email, phone number and authenticator per account, or layer four overlaps by itself
• Share by role instead of by password; when someone leaves, revoking access completes the handover