Skip to main content

How 404 Works

404 runs locally between your browser and the internet. Rewriting your fingerprint across TLS, HTTP, JavaScript, and TCP/IP from a single profile.

Get 404

Two modules, one identity

Most privacy tools protect one layer and leave everything else exposed. 404 covers the full stack with two coordinated modules that share a single profile.

Application layer

STATIC Proxy

Synthetic Traffic and TLS Identity Camouflage

A local Rust proxy that sits between your browser and the internet. It terminates TLS, rewrites the handshake, normalizes HTTP behavior, and injects the browser-side spoofing code. Everything is driven by the same active profile the rest of the stack uses.

TL;DR

When your browser connects to a website, it exposes a stack of identifying signals: how it negotiates TLS, which headers it sends, what client hints it advertises, and how the page behaves once it loads. STATIC sits in the middle and replaces those with a consistent browser identity before traffic ever leaves your machine.

  • TLS layer Cipher order, extensions, key shares, JA3/JA4 fingerprint
  • HTTP layer Header ordering, User-Agent, client hints, Accept negotiation
  • JavaScript layer Canvas, WebGL, audio context, font enumeration, WebRTC
  • Page layer CSP rewriting, script injection, DOM-facing spoofing, behavioral consistency
Kernel layer Learn more

Rose Kernel

Kernel-level packet identity control

Rose is the 404 distributed kernel that modifies packet-level values. It applies the network fingerprint for the active profile as traffic leaves the host, so low-level scanners (p0f/nmap) see the same machine identity that STATIC is presenting higher up the stack.

TL;DR

VPNs and proxies alone are not enough because the packets leaving your machine still carry operating-system fingerprinting values. Rose handles that lower layer directly, shaping the values scanners use to identify hosts so the transport-level signature matches the browser identity the proxy is enforcing.

  • IPv4 TTL, TOS, IP ID, TCP window, sequence numbers, MSS, timestamps
  • IPv6 Hop limit, flow label, TCP parameters
  • Host integration Managed by the app, profile-driven, and coordinated with STATIC so both layers present one machine identity

Profiles, not randomization

Most fingerprint tools randomize values on every request. That's detectable. 404 applies a complete, internally consistent browser profile and holds it across sessions.

Coherent across layers

Your TLS handshake says Chrome on Windows. Your HTTP headers agree. Your JavaScript APIs confirm it. Your TCP/IP packets match Windows network stack defaults. No mismatches, no red flags.

Deterministic, not random

Each profile produces the same fingerprint every time. Canvas hashes, WebGL parameters, and timing patterns are all seeded from the profile and consistent across sessions, just like a real browser.

Built from real browser behavior

Profiles aren't theoretical constructs. They're derived from actual browser telemetry: real cipher orders, real header sequences, real JavaScript API responses. The goal is to look like one of millions, not like something unusual.

How 404 compares

VPN Tor Anti-detect browsers 404
IP address masking ~
TLS fingerprint control ~ ~
HTTP header control ~
JavaScript API spoofing ~
TCP/IP packet fingerprint
Cross-layer consistency ~
Open source ~
Built for people

404 complements VPNs, it doesn't replace them. Use a VPN to hide your IP. Use 404 to hide your identity.

What happens to your traffic

Each session is launched from one active profile. The app brings up the local 404 service, routes the browser into STATIC, and keeps the kernel-side network identity aligned through the Rose kernel.

Profile starts the session

The app launches the selected browser profile, enables the local proxy path, and starts 404 with one shared identity definition.

STATIC receives the request

Browser traffic enters STATIC locally. It terminates TLS with the local CA, understands the target request, and prepares the browser-facing identity for that session.

Application-layer signals are rewritten

STATIC rewrites the TLS handshake, HTTP headers, client hints, and browser-exposed page behavior so the request matches the selected profile before going upstream.

Rose shapes the network fingerprint

As packets leave the machine, Rose applies the kernel-side network identity for the same profile, aligning transport-level characteristics with the browser identity that STATIC established.

One consistent identity reaches the site

The destination sees a coherent browser, TLS stack, and network identity. Responses flow back through STATIC, allowing for HTTP responses to be modified as well.

Ready to try it?

404 is open source and free to build yourself. The docs cover installation. If you need something specific, reach out.