Skip to main content

Technical architecture

One profile follows the request through every layer.

404 runs on the device, between a supported browser and the destination. STATIC coordinates supported application-layer surfaces. Rose can align supported packet-level signals on Linux. Both are directed by the same selected profile.

Follow a requestRead the documentation
Processing
On device
Modules
STATIC + Rose
Control model
One active profile
your device
Profile controllerChrome · Windows · en-USTLS · HTTP · JavaScript · network targets

No 404 relay Traffic continues through the route you selected.

The controller and supported processing modules stay inside the local device boundary. The destination remains outside it.

Profile, not a pile of toggles

The layers have to describe the same client.

Changing a user agent while leaving the TLS handshake, Client Hints, WebGL renderer, language, and network stack untouched can create a more conspicuous mismatch. 404 starts with one profile and derives supported behavior from it.

Deterministic by design: the same profile should produce stable, coordinated outputs until the user intentionally changes it. This is controlled presentation, not a promise of anonymity.

profile.json
{
  "identity": {
    "browser": "chrome",
    "platform": "windows",
    "locale": "en-US"
  },
  "layers": {
    "tls": "chrome_windows",
    "http": "chrome_windows",
    "javascript": "chrome_windows",
    "network": "windows_like"
  }
}
Simplified illustrative profile. The exact schema and supported fields vary by release.

Two modules, one local boundary

Application behavior and packet behavior are handled where they exist.

A single proxy cannot directly control every signal in a packet, and a kernel hook cannot rewrite what page JavaScript sees. The architecture separates those jobs while keeping their target identity coordinated.

01 · Rust applicationSTATIClocal TLS-terminating proxy
  1. Request

    Accepts supported browser traffic on the local listener and creates an isolated flow.

  2. Profile

    Builds supported TLS and HTTP behavior from the selected profile.

  3. Response

    Processes supported response headers and coordinates page-visible behavior.

Works at the TLS, HTTP, and supported page-response layers.

02 · Linux kernel programRosesupported tc egress handling
  1. Attach

    Loads at a supported Linux traffic-control egress hook with elevated privileges.

  2. Inspect

    Reads supported IPv4, IPv6, and TCP fields before a packet leaves the interface.

  3. Adjust

    Changes supported fields and recalculates affected checksums where required.

Platform-specific. It does not cover every packet or network fingerprinting method.

Inspect the stack

Each observer sees a different part of the session.

Select a layer to see what is exposed, what the corresponding 404 module can change, and where the boundary of that claim sits.

Observed byThe destination server

Handshake order, cipher suites, extensions, supported groups, key shares, and ALPN can describe a client family.

404 actionSTATIC

STATIC builds the supported upstream handshake from the active profile instead of forwarding the browser's handshake unchanged.

Representative view
client_hello
chrome_windows
cipher_order
profile-defined
alpn
h2, http/1.1

BoundaryA profile has to remain internally credible. A familiar JA3 or JA4-shaped result is not proof that every TLS behavior is indistinguishable.

Follow one request

The profile is chosen once. Its supported outputs are applied in sequence.

This is the conceptual path for a supported session. The implementation differs by browser, platform, protocol, and enabled feature.

  1. 01

    Select a profile

    The controller loads one identity definition for the browser family, platform, locale, and supported protocol surfaces.

  2. 02

    Start the local path

    The supported browser is routed through STATIC on the same device. The profile and local certificate authority remain local.

  3. 03

    Process the application layers

    STATIC handles supported TLS, HTTP, and response-stage changes, including coordinated page-visible behavior.

  4. 04

    Align supported packet signals

    Where Rose is available, supported egress fields are adjusted at the Linux traffic-control hook.

  5. 05

    Continue through your route

    Traffic leaves through the network path you configured. 404 is not a relay and does not provide a new exit IP.

Data boundary

404 processes the session locally. The destination still receives a request.

Local processing changes the trust model, not the basic fact that browsing communicates with another system. The distinction is what 404 infrastructure receives: the browsing path does not need to be relayed through a 404-operated exit.

Inside your device
  • Selected profile and configuration
  • Local certificate authority and keys
  • STATIC request and response processing
  • Supported Rose packet handling
Visible beyond the device
  • The public route and exit IP you configured
  • The presented application and protocol signals
  • Requests, accounts, and content sent to a destination
  • Traffic metadata available to relevant observers

Where the boundary is

A useful privacy tool should make its limits easy to find.

These constraints are part of the architecture, not footnotes. Expand any item for the practical implication.

01It is not an anonymity network

404 changes supported presentation layers. It does not create Tor's shared browser population, relay network, or anonymity guarantees.

02Coverage varies

Browsers, APIs, protocols, and operating systems evolve. A current release can support only the surfaces it explicitly handles and tests.

03TCP/IP support is platform-specific

Rose relies on Linux kernel facilities and elevated privileges. Other platforms retain native packet-level characteristics unless a supported mechanism is available.

04TLS interception changes the trust boundary

STATIC uses a local certificate authority to process HTTPS traffic. The CA key must remain private, and sensitive local logs must never be shared.

05Accounts remain durable identifiers

Signing into an account can reconnect activity regardless of browser presentation. 404 does not sever first-party account relationships.

06Behavior and content can still identify

Typing, navigation, account use, downloads, files, and unique behavior sit outside a purely technical browser profile.

Inspect the implementation

DocumentationConfiguration and operationSource codeInspect STATIC and RoseProduct overviewReturn to 404 Desktop

Choose your path

Use the managed desktop experience—or operate the components directly.

404 Desktop handles profiles, launch state, and updates through a graphical interface. The source and technical documentation remain available for people who want direct control.

See 404 DesktopView sourceTalk to us