Built to replace your fingerprint
How 404 Works
404 runs locally between your browser and the internet. Rewriting your fingerprint across TLS, HTTP, JavaScript, and TCP/IP from a single profile.
Get 404Architecture
Two modules, one identity
Most privacy tools protect one layer and leave everything else exposed. 404 covers the full stack with two coordinated modules that share a single profile.
STATIC Proxy
Synthetic Traffic and TLS Identity Camouflage
A local Rust proxy that sits between your browser and the internet. It terminates TLS, rewrites the handshake, normalizes HTTP behavior, and injects the browser-side spoofing code. Everything is driven by the same active profile the rest of the stack uses.
TL;DR
When your browser connects to a website, it exposes a stack of identifying signals: how it negotiates TLS, which headers it sends, what client hints it advertises, and how the page behaves once it loads. STATIC sits in the middle and replaces those with a consistent browser identity before traffic ever leaves your machine.
- TLS layer Cipher order, extensions, key shares, JA3/JA4 fingerprint
- HTTP layer Header ordering, User-Agent, client hints, Accept negotiation
- JavaScript layer Canvas, WebGL, audio context, font enumeration, WebRTC
- Page layer CSP rewriting, script injection, DOM-facing spoofing, behavioral consistency
Rose is the 404 distributed kernel that modifies packet-level values. It applies the network fingerprint for the active profile as traffic leaves the host, so low-level scanners (p0f/nmap) see the same machine identity that STATIC is presenting higher up the stack.
TL;DR
VPNs and proxies alone are not enough because the packets leaving your machine still carry operating-system fingerprinting values. Rose handles that lower layer directly, shaping the values scanners use to identify hosts so the transport-level signature matches the browser identity the proxy is enforcing.
- IPv4 TTL, TOS, IP ID, TCP window, sequence numbers, MSS, timestamps
- IPv6 Hop limit, flow label, TCP parameters
- Host integration Managed by the app, profile-driven, and coordinated with STATIC so both layers present one machine identity
Approach
Profiles, not randomization
Most fingerprint tools randomize values on every request. That's detectable. 404 applies a complete, internally consistent browser profile and holds it across sessions.
Coherent across layers
Your TLS handshake says Chrome on Windows. Your HTTP headers agree. Your JavaScript APIs confirm it. Your TCP/IP packets match Windows network stack defaults. No mismatches, no red flags.
Deterministic, not random
Each profile produces the same fingerprint every time. Canvas hashes, WebGL parameters, and timing patterns are all seeded from the profile and consistent across sessions, just like a real browser.
Built from real browser behavior
Profiles aren't theoretical constructs. They're derived from actual browser telemetry: real cipher orders, real header sequences, real JavaScript API responses. The goal is to look like one of millions, not like something unusual.
How 404 compares
| VPN | Tor | Anti-detect browsers | 404 | |
|---|---|---|---|---|
| IP address masking | ✓ | ✓ | ~ | ✕ |
| TLS fingerprint control | ✕ | ~ | ~ | ✓ |
| HTTP header control | ✕ | ~ | ✓ | ✓ |
| JavaScript API spoofing | ✕ | ~ | ✓ | ✓ |
| TCP/IP packet fingerprint | ✕ | ✕ | ✕ | ✓ |
| Cross-layer consistency | ✕ | ✕ | ~ | ✓ |
| Open source | ~ | ✓ | ✕ | ✓ |
| Built for people | ✓ | ✓ | ✕ | ✓ |
404 complements VPNs, it doesn't replace them. Use a VPN to hide your IP. Use 404 to hide your identity.
Data flow
What happens to your traffic
Each session is launched from one active profile. The app brings up the local 404 service, routes the browser into STATIC, and keeps the kernel-side network identity aligned through the Rose kernel.
Profile starts the session
The app launches the selected browser profile, enables the local proxy path, and starts 404 with one shared identity definition.
STATIC receives the request
Browser traffic enters STATIC locally. It terminates TLS with the local CA, understands the target request, and prepares the browser-facing identity for that session.
Application-layer signals are rewritten
STATIC rewrites the TLS handshake, HTTP headers, client hints, and browser-exposed page behavior so the request matches the selected profile before going upstream.
Rose shapes the network fingerprint
As packets leave the machine, Rose applies the kernel-side network identity for the same profile, aligning transport-level characteristics with the browser identity that STATIC established.
One consistent identity reaches the site
The destination sees a coherent browser, TLS stack, and network identity. Responses flow back through STATIC, allowing for HTTP responses to be modified as well.
Ready to try it?
404 is open source and free to build yourself. The docs cover installation. If you need something specific, reach out.