SandAgentAnother identity, without a tell.
The HTTP header and navigator.userAgent come out of the same value, so they can never contradict each other. Everything runs locally in Firefox - no account, no telemetry.
Add to Firefox — free- Version
- v2.0
- Requires
- Firefox 91+
- Data collected
- 0
SandAgentUser-Agent string only. Unblocks sites that refuse Firefox; does not fool an anti-bot system.
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
What each mode can and cannot do
Most switchers sell you one button and let you believe it makes you invisible. It doesn't. Detection happens in layers, and an add-on only reaches the top two - so here is exactly where each mode stops.
| Stealth | Compatibility | |
|---|---|---|
| Target | Another Firefox (version, OS) | Chrome, Edge, Safari, mobile |
| JavaScript layer | Indistinguishable from native | Indistinguishable from native |
| TLS fingerprint (JA3/JA4) | Genuinely Firefox - coherent | Firefox, contradicts the User-Agent |
| HTTP/2 fingerprint | Genuinely Firefox - coherent | Firefox, contradicts the User-Agent |
| Against an anti-bot | Nothing to contradict | Detected |
| What it is for | Blending into the crowd | Unblocking a site that refuses Firefox |
Compatibility mode cannot be stealthy, and we will not pretend otherwise. Cloudflare correlates the TLS handshake with the announced User-Agent, and that handshake happens before any extension can see it. Fixing that needs a patched browser, not an add-on.
One source of truth, all the way down
Coherent values
Header, client hints and navigator properties are all derived from the same profile, so nothing gives away the change.
Native-looking getters
The patched properties are indistinguishable from the browser's own, down to how they report themselves when inspected.
Per-site profiles
Keep a default identity and override it for specific sites - useful when one service needs Chrome and everything else should stay Firefox.
It finishes what the VPN starts
SandVPN hides your IP address, Geo-Spoof aligns timezone and language with the server, and SandAgent handles the identity your browser announces. Three layers, one coherent story.
See all SandVPN appsSandAgent - frequently asked questions
How far does this go?
It changes what your browser announces about itself, which is one of the two things that identify you. Your IP address is the other, and that is the VPN's job. Run both and each one covers what the other cannot.
Will it break websites?
Sometimes a site serves different code depending on the browser it thinks you use, so layouts can shift. That is exactly why per-site profiles exist: keep your real identity everywhere, and override it only where you need to.
Is it really free?
Yes. There is no account, no paid tier and no telemetry - the manifest requests no data collection at all, and everything is computed on your machine.
Why Firefox only?
The add-on relies on blocking webRequest, which Firefox still supports and Chrome removed with Manifest V3. Doing the same job on Chrome would mean giving up the header rewriting that keeps the values coherent.