Incognito, Separate Chrome Profiles, or a Multi-Account Browser: What Each One Separates

Picture five Chrome profiles with colour-coded avatars, one per client account an agency manages. A sixth task done in incognito because it "doesn't leave traces". A separate login on each, and a log-out before every switch. No multi-account browser anywhere in the stack, because incognito plus separate Chrome profiles looks like it covers it.

It covers the cookies. That's all it covers.

Chrome does exactly what Chrome promises: it keeps five cookie jars apart, cleanly. But a site can also read what the machine reports, and all five profiles answer fingerprinting scripts with the same canvas hash, the same GPU renderer string, the same font list and the same screen geometry. Five tidily separated sessions. One machine. The machine is what gets read.

For client accounts an agency is allowed to manage, that's fine: platforms expect an agency to work from one office. Whether one person may hold several accounts on a given platform is the platform's call, set out in its rules, and changing browsers doesn't change the answer. What the scenario is useful for is the mechanism: what a site reads once cookies are out of the picture, which matters for privacy and for any testing that needs different devices, locales or locations.

So here's the comparison, with the limit of each one named.

The one-line version of each

Incognito throws away session state when you close it. That's the feature. Nothing else.

Separate Chrome profiles keep state permanently apart — cookies, logins, extensions, history — in separate folders on one computer.

A multi-account browser gives each profile its own identity: different canvas, WebGL, audio and font answers, different screen geometry, different timezone, its own proxy and its own resolver. Then it keeps that state apart too.

Notice the shape. The first two work on what the browser remembers. The third works on what the browser is. If you want the ground-up definition of that third category, what a multi-account browser actually is covers it from scratch. This post is about the boundaries between them.

Incognito: an honest feature with a dishonest reputation

Incognito gets more grief than it deserves, mostly because people expect it to be something it never claimed to be. Google's own splash screen is pretty blunt: your activity might still be visible to the sites you visit, your employer and your ISP.

Incognito isn't lying to you — it's answering a question you didn't ask.

What it genuinely does: fresh, temporary cookie jar. No history entries. Everything binned when the last incognito window closes — and that last bit trips people constantly, because all your incognito windows share one session. Open three, log into three different accounts, and the accounts share one session.

What it doesn't do — anything at all about identity. Same binary, same GPU, same fonts, same screen, same IP. Run any fingerprint checker in a normal window, then in incognito, and compare the hashes. They match. Do this once; it takes thirty seconds.

The one legitimate use in multi-account work: a clean-state window for checking how a page looks to a logged-out visitor. Good for that. Useless for holding an account.

Separate Chrome profiles: real isolation, exactly one layer deep

This is the one that deserves more credit than it usually gets — and it's also the one that can give people false confidence about what is separated.

A Chrome profile is a genuinely separate user directory. Its own cookies, its own localStorage and IndexedDB, its own saved logins, its own extensions, its own bookmarks. Log into account A in one and account B in another and there's no shared storage handing over the link. Chrome even shipped partitioned cookies (CHIPS) back in version 114, so third-party cookie state is scoped to the top-level site that set it — worth understanding if you care about how state actually gets keyed, and we wrote that up in the partitioned storage and CookieStore breakdown.

Here's what no amount of profile separation touches.

Every profile on that install renders the same canvas. Reports the same WebGL vendor and renderer. Produces the same audio output. Lists the same installed fonts — the OS owns those, not the profile. Same screen width, height, colour depth and device pixel ratio. Same core count, same platform string, same language list. And unless you've gone out of your way, the same public IP.

Which means five Chrome profiles look like five sessions on one clearly identifiable computer. That is the most obvious pattern a fingerprinting script sees.

There's a second layer worth knowing about. Your TLS handshake has a stable shape per browser build, offered before any JavaScript runs, and it's identical across every profile. ClickzProtect, our sibling product, works the detection side of this and its comparison of browser and TLS fingerprinting explains why the two are independent identifiers.

What actually gets compared

Separate Chrome profiles handle two rows and leave eight alone. That ratio is the case for a multi-account browser when you need separate identities.

Where the multi-account browser layer picks up

JustBrowser is a custom Chromium engine with native C++ integration, patched with every upstream Chromium release. Not an extension, not a JavaScript shim layered on top.

That distinction matters. A script injected into the page sits on top of the browser's real answer, so different APIs can end up disagreeing with each other. A change inside the engine leaves no second answer to disagree with. Identity parameters are set at the canvas / WebGL / audio / font / screen layer, across 40+ parameters, so each profile is internally consistent.

One specific that gets guessed at constantly: the font list is restricted to the profile's platform set at the engine level, covering CSS enumeration, the Font Access API and @font-face local() together, rather than a filtered array.

On top of the identity work: per-profile proxy routing (HTTP, HTTPS, SOCKS5), per-profile DNS-over-HTTPS in secure or automatic mode pointed at Cloudflare, Google, Quad9 or a resolver you choose, WebRTC protection, and real-time profile health scoring. The DNS half is its own failure mode and we covered it separately in the DNS leak and proxy resolution guide.

You can open any public fingerprint test page inside a profile to see what a site would read.

And for the developers who arrive here: there's a local REST API on 127.0.0.1:36542, Bearer-authenticated from the app's AI page, with CDP for Playwright, Puppeteer and Selenium. Local only — nothing hosted to call. Starting a profile through it gives you a headless session unless you send {"headless": false}. It's an easy one to miss: the script runs invisibly while you check everything except the request body.

Picking between them, without overbuying

One account per platform, want work and personal separate? Second Chrome profile. Free, fine, nothing to tie together. Stop reading.

Checking how a page renders logged-out? Incognito. That's the job it's actually good at.

Two accounts on a platform that allows two accounts? Chrome profiles are fine. Since the platform allows them, the shared machine is not a problem.

Multiple accounts the platform permits you to hold (client accounts you manage with permission, say), ad verification across geographies, QA across device and locale combinations, or automating your own workflows? That's the line. Where a platform forbids more than one account, a multi-account browser doesn't change that. Everything below the line is hygiene; everything above it is identity, and identity is a different tool.

If you're running a multi-account browser to keep two personal Gmail accounts apart, you've hired a forklift to carry the shopping. Nothing wrong with the forklift. Wrong job.

The common mistake isn't buying a multi-account browser too early. It's months of bolting extras onto Chrome profiles — single-signal extensions, a VPN, a second laptop — to get per-profile locations and device settings, and ending up with a stack nobody can reason about.

Multi-account browser setup order, if you're past that line

1. Sort the proxy address first and test it alone. An address already on threat feeds gets challenged in ways ordinary visitors don't, which skews every test you run through it. The detection signals glossary names what sites check.
2. Create the profile and assign that address to it, so the profile always exits from the same place.
3. Match timezone and language to the exit geography before the first page load. This step feels like paperwork, but it's what makes pages localise the way they would for a visitor there.
4. Turn on WebRTC protection and per-profile DNS-over-HTTPS.
5. Open a test page to confirm the settings took, then leave the profile's identity alone. A stable identity is easier to reason about than one that keeps changing.

The honest limits

Windows x64 and macOS on Apple Silicon only. There's no Linux build, which means "run it on a VPS" isn't a path — and no iOS or Android app either, though a mobile profile can present Chrome on Android's client hints, memory range and touch screen.

Pricing is one plan: $9.99/month or $99.99/year, unlimited profiles, unlimited cloud sync, free team seats. No free tier. The 7-day trial is the only free path and it wants a card up front — which some people will find disqualifying, so it is better said here than discovered at checkout. Free seats carry a real constraint too: a seat runs profiles the owner shares with it and nothing else — no cloud sync of its own, no API, no AI tab. Anyone needing their own profiles subscribes.

If you stop paying, your profiles stay on your machine and keep launching. You can keep up to five local profiles; cloud sync, team sharing and the API pause until you resubscribe. Take an encrypted export anyway before a long break.

And plainly: none of this changes what a platform's rules allow. It makes each profile its own browser with consistent settings. JustAnalytics — our analytics product — has a readable write-up on how cookieless tracking works that's worth reading precisely because it's from the other side of the fence.

Frequently Asked Questions

Does incognito mode hide my browser fingerprint?

No. Incognito is a storage feature, not an identity feature. It gives the session a temporary cookie jar and throws it away when every incognito window closes, so nothing lands in your history. While the session is open, the site reads exactly the same canvas hash, the same WebGL renderer string, the same font list, the same screen geometry and the same navigator properties it would read from your normal window — because it's the same browser on the same machine. Private from the person using your laptop, not from the site.

Do separate Chrome profiles stop a site seeing that two accounts share a machine?

They separate stored state and leave the rest. Each Chrome profile gets its own cookies, localStorage, IndexedDB and logins, which is real isolation and genuinely worth using. What every profile shares is the machine: identical canvas and audio output, the same GPU renderer string, the same installed fonts, the same screen resolution and colour depth, and one outbound IP unless you've done something about it. That is a strong match, and it shows that the sessions come from one machine.

Is a Chrome profile the same thing as a multi-account browser profile?

Only the word is the same. A Chrome profile is a separate folder of state — bookmarks, cookies, extensions, logins. A multi-account profile is a separate identity: its own canvas, WebGL, audio and font answers, its own screen geometry and timezone, its own proxy and its own DNS resolver, all generated as a set that holds together. One separates what the browser remembers. The other changes what the browser is.

When is a multi-account browser overkill?

When you have one account per platform and you're mainly trying to keep work and personal life apart. A second Chrome profile does that for free and nothing needs separating further. The line is roughly the point where you hold several accounts the platform permits (client accounts managed with permission, storefronts you operate), or need isolated identities for ad verification across geographies, QA across locales or automating your own workflows. Check what the platform allows first. Below that line, save the money.

---

Try JustBrowser

A multi-account browser for teams, on a custom Chromium engine with native C++ integration, always current with upstream — not extension-based. Each profile keeps its own cookies, storage, proxy and 40+ identity parameters, and teammates can share profiles. Local REST API with CDP for Playwright, Puppeteer, Selenium. One plan: $9.99/month or $99.99/year — unlimited profiles, free team seats, 7-day free trial, card required.

Get started → · How it differs from Multilogin / GoLogin / AdsPower