How to Bypass Incognito Detection Using Storage Quota Settings in CloakBrowser

To bypass incognito detection in CloakBrowser, launch a persistent context with the --fingerprint-storage-quota flag set to a higher value (e.g., 5000 for 5 GB) to make navigator.storage.estimate() report a quota typical of standard (non-incognito) Chrome profiles.

CloakBrowser generates an incognito-style browsing context by default, which anti-bot services like BrowserScan flag via notPrivate checks and similar incognito detection heuristics. You can bypass incognito detection using storage quota settings by overriding the reported storage limit, convincing detection scripts that the session originates from a regular browsing profile rather than a private window.

Why Incognito Detection Triggers in CloakBrowser

By default, CloakBrowser initializes contexts that mimic private browsing mode. This causes navigator.storage.estimate() and legacy storage APIs to return a low quota value—approximately 500 MB—that matches Chrome’s incognito profile signature. Detection services scan for this low quota threshold to identify and block automated or private sessions.

The binary normalizes the reported storage quota to match incognito expectations, which successfully evades FingerprintJS but triggers penalties on services specifically hunting for non-incognito quotas. As documented in the repository’s README.md around line 380, this default behavior creates a trade-off between FingerprintJS compatibility and incognito masking.

How Storage Quota Overrides Mask Incognito Mode

The --fingerprint-storage-quota Flag

The CloakBrowser binary accepts the --fingerprint-storage-quota=<MB> command-line argument to artificially inflate the reported storage capacity. Setting this to a larger value (such as 5000 MB) causes navigator.storage.estimate() to return a quota size characteristic of persistent user profiles, effectively masking the incognito nature of the underlying session.

The Detection Trade-off

Adjusting this setting involves a strategic compromise. The default low quota (~500 MB) passes FingerprintJS verification but fails checks that penalize incognito mode. Conversely, a higher quota (5 GB or more) satisfies detectors looking for standard browsing profiles but may trigger FingerprintJS flags. According to the CloakHQ/CloakBrowser source, you should tailor the quota size to the specific detection logic of your target site.

Implementing the Storage Quota Bypass

You must use a persistent context for this override to function correctly. The launch_persistent_context function creates a real user-data directory that stores cookies, localStorage, and cache across sessions while forwarding your custom arguments to the Chromium engine.

Python Implementation

In cloakbrowser/browser.py, the launch_persistent_context wrapper forwards the args list directly to the browser binary. Pass the storage quota flag to mask incognito detection:

from cloakbrowser import launch_persistent_context

# Create or reuse a profile with a high storage quota to appear as non-incognito.

ctx = launch_persistent_context(
    "./my-profile",
    args=["--fingerprint-storage-quota=5000"],  # Reports ~5 GB quota

)

page = ctx.new_page()
page.goto("https://target-site.com")

# ... perform automated actions ...

ctx.close()  # Profile persists for subsequent runs

This configuration reports a 5 GB storage limit to JavaScript APIs, matching the signature of a standard Chrome installation rather than an incognito window.

JavaScript (Playwright) Implementation

The JavaScript wrapper exposes the same functionality through an asynchronous API:

import { launchPersistentContext } from "cloakbrowser";

const ctx = await launchPersistentContext({
  userDataDir: "./my-profile",
  args: ["--fingerprint-storage-quota=5000"], // Masks incognito status
});

const page = await ctx.newPage();
await page.goto("https://target-site.com");
// ... interaction logic ...
await ctx.close(); // User data persists

As noted in the repository documentation at line 530 of README.md, persistent profiles maintain the overridden quota settings across browser restarts, ensuring consistent detection evasion.

Summary

• CloakBrowser defaults to incognito-like storage quotas (~500 MB) that trigger anti-bot detection.
• Override this behavior by passing --fingerprint-storage-quota=<MB> with a high value (e.g., 5000) to simulate standard browser profiles.
• You must use launch_persistent_context (implemented in cloakbrowser/browser.py) for the flag to take effect, as temporary contexts cannot simulate persistent storage quotas.
• Balance the quota setting against your target: lower values for FingerprintJS compatibility, higher values for sites that block incognito mode.

Frequently Asked Questions

What is the default storage quota value in CloakBrowser?

The default storage quota is approximately 500 MB, which matches the incognito profile signature in Chrome. This value is documented in the repository’s README.md around line 380 as part of the storage quota and detection trade-off explanation.

Why must I use launch_persistent_context instead of launch_context?

The storage quota flag requires a persistent user-data directory to function because it simulates the storage characteristics of a real browser profile. Temporary contexts cannot maintain the state necessary to report a fake quota consistently, whereas launch_persistent_context creates a real directory that stores cookies and cache while applying the quota override.

Will a higher storage quota guarantee no detection?

No. A higher quota masks incognito detection logic that checks for low storage limits (like BrowserScan’s notPrivate check), but it may trigger FingerprintJS detection which expects the default low quota. You must choose the quota value based on the specific detection mechanisms employed by your target site.

Where is the flag implemented in the source code?

The --fingerprint-storage-quota flag is processed by the CloakBrowser binary wrapper located in cloakbrowser/browser.py. This file implements the launch_persistent_context helper that forwards your custom arguments to the underlying Chromium instance, as referenced in the repository’s documentation.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}