Per-tab session isolation

Every account,
its own tab.

Signed into two Google accounts, the browser quietly picks one as the default, and work links start opening as your personal address. Give each account a session where it is the only account, and there is no default left to get wrong.

Add to Chrome See how it compares

FreeUnlimited sessionsAbout 0 MB per sessionChrome, Edge, Brave, Opera GX

Web Store listing in review

How it compares

What you get free here, and what it costs elsewhere.

Five alternatives, checked against published plans and their own documentation. Every capability below is included free, and the marks show which of them the others charge for, do partially, or do not do at all.

YesPartialPaid extraNoNot applicable

Capability	NVX Session	Firefox Containers	SessionBox	Ghost Browser	Anti-detect suites	Chrome profiles

Mechanism	Yes. Rewrites the outgoing Cookie header per tab. The browser jar is bypassed, never swapped	Yes. Origin attributes inside the storage engine	Partial. Swaps the one real cookie jar per tab	Yes. A separate Chromium profile per identity	Yes. A patched browser instance per profile	Yes. An OS-level browser profile
Many tabs loading at once	Yes. Rules are matched in C++ per request, so every tab is correct simultaneously	Yes. Engine level	No. A swap can only be right for one tab at a time; background tabs desync	Yes. Separate profiles	Yes. Separate instances	Yes. Separate profiles
Leaves your real cookie jar untouched	Yes. Cookies are copied into a private vault, never moved or deleted	Yes. Separate storage	No. Writes into the real profile jar	Yes. Separate profile	Yes. Separate profile	Yes. Separate profile
localStorage and sessionStorage	Yes. Virtualised per session by a content-script shim	Yes. Partitioned by origin attributes	No. Shared across sessions	Yes. Profile level	Yes. Profile level	Yes. Profile level
Service worker traffic	Yes. A tabIds -1 rule matches it, and the debugger can attach to the worker target directly	Yes. Engine level	No. Not addressed	Yes. Profile level	Yes. Profile level	Yes. Profile level
Half-finished sign-in protection	Yes. A loop detector releases the site, because a partial cookie set reads as a hijack	Not applicable. No swap to go wrong	No. None	Not applicable.	Not applicable.	Not applicable.

Fingerprint control at all	Yes. Three postures, free, no account, no limit	No. None. Containers separate storage, not identity	Paid extra. Professional plan, $21.99 a month	Partial. Minimal	Paid extra. Subscription only, the deepest available	No. None
Checks the disguise is coherent	Yes. A consistency validator. Incoherence is what flags you, not similarity	Not applicable.	No. Lets you build a machine that contradicts itself	No.	Partial. Vendor managed, not shown to you	Not applicable.
A default that fabricates nothing	Yes. Mirror ships as the default: real fingerprint, only storage partitioned	Not applicable.	No.	No.	No. Fabrication is the product	Not applicable.
Canvas, WebGL and audio, per session	Yes. Seeded per origin, so two sites cannot match one session between them	No.	Paid extra. Paid plan	No.	Paid extra. Yes, below the JS layer, which is deeper than this	No.
Tells you what each setting costs your detectability	Yes. A generated manual inside the extension	No. Docs only	No. Docs only	No. Docs only	Partial. Partly	Not applicable.

Memory per identity	Yes. About 0 MB. It is a rule, not a process	Yes. About 0 MB	Yes. Low	Partial. Moderate	No. 300 to 800 MB, per profile	No. About 250 MB, per profile
Cost of adding one more identity	Yes. A tab	Yes. A tab	Yes. A tab	Partial. A profile	No. A whole browser instance	No. A window and a profile
How many at once	Yes. Hundreds. Measured, bounded by a 5,000 rule budget	Yes. High	Partial. Moderate	Partial. Bounded by memory	No. Bounded by memory, expensively	No. Bounded by memory
Stays in the browser you already use	Yes. Chrome, Edge, Brave, Vivaldi, Arc, Opera GX	Partial. Only if you already live in Firefox	Yes. Chromium	No. A different browser	No. A different browser	Partial. Separate windows
Opera GX	Yes. A first-class target with its own MV2 backend. Nobody else does this	No.	No.	No.	No.	Not applicable.

Can talk to the internet on its own	Yes. No. Zero external network permissions	Yes. No	No. Cloud sync, so yes	Partial. Local	No. Cloud connected by design	Yes. No
Analytics you can read in full	Yes. Opt in, anonymous, a closed allowlist with no free-form field, erasable	Yes. None collected	No. Vendor defined	No. Vendor defined	No. Vendor defined	Partial. Browser vendor
States its own limits in public	Yes. This table, and the ones it loses are on it	Not applicable.	No.	No.	No.	Not applicable.

Tabs coloured by identity	Yes. Per session, at a glance	Yes. Container colours	Partial.	Partial.	Not applicable. One identity per window	No.
Move several tabs at once, and undo it	Yes. One guarded operation, so nothing leaks mid-move	No.	No.	No.	Not applicable.	No.
Keyboard shortcut to move a tab	Yes. Alt and 1 to 3	No.	No.	No.	Not applicable.	No.
Right-click a link into an identity	Yes.	Yes. Open in container	Partial.	No.	Not applicable.	No.
Tells you which account a site thinks is default	Yes. The whole reason the product exists	No.	No.	No.	Not applicable.	No.
Turn it off without uninstalling	Yes. One switch, behaves exactly as if it were not installed	Not applicable.	No.	Not applicable.	Not applicable.	Not applicable.

Cost to use it properly	Yes. Free. Unlimited sessions, all three fingerprint postures included	Yes. Free	Paid extra. Free tier is local profiles only. $4.99 to $44.99 a month	Paid extra. Limited free, then subscription	Paid extra. Subscription only, the most expensive category	Yes. Free
Metered on how many identities you have	Yes. No, and it never will be	Yes. No	No. Yes, cloud profiles are capped by plan	No. Yes	No. Yes, this is the pricing model	Yes. No

Competitor capabilities from their own documentation, pricing from published plans, August 2026. NVX Session has real limits too, and they are named on this page rather than hidden: see the questions below.

The default account trap

Why the wrong account opens

A browser keeps one cookie jar per profile, and a site can only treat one account in it as the default. Every link you open resolves against that choice, which is how a work document ends up opening as your personal address without anything warning you.

One shared jarAny browser, no extension

Work doc

Personal mail

Client admin

One jarojas@personal

Every tab resolves to whichever account is default. The work doc opens as personal.

A jar per tabWith NVX Session

Work doc

Personal mail

Client admin

ojas@work

ojas@personal

ops@client

Each tab resolves to its own account. There is no default left to get wrong.

How it works

Three steps, nothing deleted

One

Each tab gets its own cookie jar.

Identity is substituted request-side, through declarative rule bands, rather than by swapping the browser's cookie jar in and out. A swap has a window in which some requests are already in flight under the old identity. Rules do not: every request is resolved against the rule that is live when it leaves.

Two

Put an account in a session by signing in fresh there, so it is the only account and therefore the default.

The tab is bound and its rules are live before the first request leaves. That ordering is the point: a federated provider never sees a half-finished login, which is the state they punish hardest.

Three

Switch accounts by switching sessions.

Identity is per tab and resolved per request, so there is no account menu to fight and no global default to lose track of.

Throughout: cookies are copied, never moved. Nothing is deleted. The browser's own jar is left exactly as it was, so the worst case is that you turn the extension off and everything is where you left it.

Engineering

What it does underneath

Each one states the plain version first. Open any of them for the architecture.

Request-side substitution

Identity is rewritten at the network layer, not by swapping cookies.

Sessions are expressed as declarative rule bands: a posture band, a guard band, and a per-session id band. Because the rules are evaluated per request rather than applied as a state change, there is no window in which a request can leave under the wrong identity. The measured ceiling is hundreds of concurrent sessions, bound by the rule budget rather than by memory.

Moves that cannot leak

Every move is one guarded operation.

Before any rebind, a declarative block naming every moving tab is installed. It is lifted only once the new rules are live. Bulk moves, keyboard moves, right-click moves and undo all run through the same guard, so there is no path where a request escapes mid-change.

Fingerprint posture

Set per session, and checked for coherence.

Mirror is the default and fabricates nothing, because incoherence is what flags you, not similarity. Standardize presents one shared machine. Persona is a stable per-session machine, seeded per origin, delivered at document_start from the page world. A consistency validator checks the result, which matters because the usual failure is a persona that contradicts itself while the tool says nothing.

Survives the service worker

MV3 can stop the extension at any moment. Sessions come back correct.

Every wake reconciles the slot map, clears stale rules and rebuilds from the persisted session state rather than trusting whatever was in memory. The App-Bound Encryption work sits here too.

Per-session web storage

localStorage and sessionStorage are virtualised per session, and the rest is disclosed.

A content-script shim virtualises both per session. IndexedDB is detected and disclosed rather than silently shared, because a tool quietly leaving a hole is worse than one naming it.

Sign-in loop detection

It notices when a login is looping and stops fighting the site.

A partial cookie set is worse than none: a federated provider reads it as a hijacked session and can invalidate the account everywhere, not just in that tab. When the detector sees the loop it releases the site instead of retrying into that outcome.

Blast-radius guard

One bad session cannot spend the whole rule budget.

Each session owns its own id band, and overflow is journalled rather than silently dropped, so a runaway session is visible instead of degrading everything else.

Two backends, one kernel

MV3 for Chromium, a blocking backend for Opera GX.

The backend is chosen at runtime and both sit under the same kernel, so Opera GX is a first-class target rather than a port that lags behind.

Privacy

It cannot leak, including into our own analytics

The extension makes no external network calls at all. It holds zero network permissions, so there is no endpoint for your cookies to go to even if something went wrong.

Telemetry

Opt in, anonymous, and built so it cannot carry anything.

The format is a closed allowlist, not a blocklist. Every field is an enum or a bounded integer and there is no free-form string anywhere in it, so a URL, a domain, a cookie or an account name cannot be transmitted even in principle. Counts are buckets, never exact numbers. The install id is a random UUID tied to no identity and erased when you opt out.

Never collected

No fingerprinting vectors, even in the analytics.

No screen size or pixel ratio, no canvas or WebGL, no font list, no full user agent, no named timezone, no geolocation, no exact install date, no exact counts, no URLs, no cookies, no accounts.

Everything we collect →Privacy policy →

Features

Everyday controls

Tabs

Colour-coded by identity, so you can see which account a tab is.

Bulk

Select many tabs and move them at once, with undo.

Keyboard

Alt and 1 through 3 moves the current tab between sessions.

Context menu

Right-click a link or a page to open it in a session.

Hints

It tells you which account a site currently treats as default.

Pause

One switch makes it behave exactly as if it were not installed.

FAQ

Common questions

Is this a VPN or a proxy?

No. It separates cookies per tab. Your network connection is unchanged, your IP is the same in every session, and nothing is routed anywhere.

Will it sign me out of things?

It can, in one specific case. If a sign-in ends up half finished, a federated provider like Google can read that as a hijacked session and invalidate it everywhere. That is why signing in fresh inside a session is the recommended path, and why a loop detector releases a site rather than retrying into that outcome. Cookies are copied and never moved, so your original session stays intact.

Does it work with Google, Microsoft, Okta?

Yes. It is domain agnostic and does not special-case any provider. For federated logins, sign in fresh inside the session rather than importing an existing one.

Is it free?

Yes, with unlimited sessions. A Pro tier is planned later for deeper isolation, and it will never meter how many sessions you can have.

What do you collect?

Nothing unless you opt in, and then only anonymous, bucketed counts from a closed allowlist. The full list is on the telemetry page.

How is this different from Chrome profiles or Firefox Containers?

Profiles cost a window and about 250 MB each. Containers are deeper but Firefox only. This is per tab, in the browser you already use, at roughly no memory per session. The comparison above has the full picture including where those two win.

Stop opening the wrong account.

Free, unlimited sessions, and it stays in the browser you already use.

Add to Chrome Read what it collects

Every account,its own tab.