Frequently asked questions

We don’t promise they won’t. Nobody can; read the reviews of anyone who says otherwise. What we promise is that every value a profile sets comes from one real device model, that we list what it can’t change yet, that every build is published with its hash, and that when we find a leak we say so in the changelog as soon as we know. What you do with the accounts is your responsibility, and our acceptable-use policy says what we won’t support.

Running multiple accounts is legal in general. Some platforms’ terms restrict it, and some uses — fraud, evading sanctions, anything the acceptable-use policy names — are illegal everywhere and we don’t support them. Read the policy before you buy.

Yes. Ten profiles, the full fingerprint engine, unmetered proxies, the local API and MCP. No card, no trial timer.

Profiles run on your computer instead of a rented cloud VM, and we don’t resell proxy traffic. Remove those two costs and this is what’s left.

Yes, on every plan. A local REST API and a CDP endpoint per profile, from Node, Python or bash, or from an AI agent over MCP.

A browser that runs many separate profiles on one computer, each with its own cookies, proxy and device fingerprint, so the accounts in them are harder to link to each other. Our plain-English guide covers how it works and how to choose one.

Chrome profiles and Incognito mode only separate cookies and browsing history. They do not change your fingerprint: every profile still shows the same GPU, fonts, screen and public IP address, which is how sites link accounts on one machine. An XDLogin profile takes those values from one of 25 real device models and sends its traffic through its own proxy. A few signals, such as the TLS handshake and WebGL limits, still come from your machine; the test results page lists them.

Windows and Linux builds are stable. macOS is a beta: the build is unsigned, so you clear the quarantine flag once, and it needs Chrome, Edge or Brave installed. Android is a separate native beta app built on Android’s WebView, sideloaded as an APK. Since 1.3.0-beta.1 it keeps up to four profiles open at once, each in its own process with its own proxy, timezone and cookies (Android 9 and newer; one at a time on Android 8). One leak is known: the WebView adds an X-Requested-With header naming the app to every request. The app doesn’t update itself; new versions and their checksums are on the download page.

Ideally, yes. On Windows, Linux and macOS each profile runs as a real Chrome process, and XDLogin finds your Chrome automatically. Without Chrome it uses Edge or Brave (or Chromium on Linux), but on Edge or Brave the profile still announces itself as Google Chrome while a few details give the real browser away. With none of them installed, desktop 3.5.8 doesn’t launch a profile and says why; earlier versions open it in XDLogin’s built-in engine instead. That engine, which you can still choose in Settings, is weaker: no address bar, no automation endpoint, and one language and WebRTC setting shared by every profile. The Android app brings its own engine.

Yes. Your plan follows your account, so sign in on any machine. Profiles themselves are files on each machine’s disk: carry them across with JSON backups, or turn on end-to-end-encrypted cloud sync on Pro and above.

Yes. Paid plans are billed per period and can be cancelled anytime from your account dashboard — you keep access until the end of the paid period. The Free tier (10 profiles) needs no card and never expires.

Card plans are billed immediately and renew until cancelled. If you are not happy within 7 days of your first payment, email support@xdlogin.com for a full refund. You can cancel any time from your account page and keep access until the end of the paid period.

Yes. Checkout offers card payment through Dodo Payments, our merchant of record, or cryptocurrency through NOWPayments. Both activate the plan on your account automatically.

Seat counts are part of every paid plan, and the account server enforces them. In 3.5.5 the Team panel is local to your machine. From 3.5.6 it works through the account server: create a team and invite people as admins or members. No email is sent; the app gives you an invite code to pass on. No release shares profiles between teammates yet, so we label team seats as rolling out.

No. Use any HTTP, HTTPS, SOCKS4 or SOCKS5 proxy from any provider (Bright Data, Oxylabs, Webshare, IPRoyal and so on). XDLogin sells no proxy traffic, so there is nothing to meter. Proxy passwords work with HTTP and HTTPS proxies; for SOCKS, use a proxy that allows your IP, because Chrome can’t send a SOCKS password.

WebRTC can reveal your real IP address behind a proxy, so each profile has three modes. Disabled, the default for new profiles, removes WebRTC entirely: nothing leaks, but a site can see the API is missing, and every real Chrome has it. Altered keeps WebRTC but allows only relayed connections and hides your own addresses; it closes the same leak without that tell, and it is the mode we recommend. Real leaves WebRTC untouched and can leak your IP.

Profile cookies, localStorage and cache stay on your disk, in a separate folder for each profile. XDLogin doesn’t encrypt those folders itself, so protect them like any other files in your user account. Nothing is uploaded unless you turn on end-to-end-encrypted cloud sync (Pro and above), and then the server only holds ciphertext your devices encrypted. The app does contact our server to sign you in and check your plan, including how many profiles each device holds.

Yes. The desktop app includes an MCP server, off by default, listening on 127.0.0.1:8931 with an optional API key. Any MCP-capable agent can list, create, launch and stop profiles, open pages and see what they show, test proxies and move cookies. From desktop 3.5.8 it can also read a page’s text and click, type and scroll in it. It is available on every plan; see the docs.

Cloud sync is end-to-end encrypted with a passphrase that never leaves your devices, so we cannot reset it or read your data. Your local profiles are unaffected; only the encrypted cloud copy becomes unreadable. Keep the passphrase somewhere safe and take JSON backups.