Changelog

Every update, improvement, and bug fix — in one place.

v1.6.35October 17, 2026Latest

What's New

  • NordVPN SOCKS5: the server list now shows only the locations NordVPN actually offers over SOCKS5 — the United States, the Netherlands and Sweden — with a "recommended" option for each country that auto-balances and stays up. Individual cities can be temporarily offline on NordVPN's side, so a new "Find a working NordVPN server" button tests your service credentials against the servers and picks one that is live, instead of leaving you on a server that will not connect.
  • You can now save your NordVPN service credentials once, on your own device, and the desktop app fills them in automatically every time you pick a NordVPN server — no more typing them for each profile. They are stored encrypted on your computer only, never uploaded.
  • Reminder: NordVPN SOCKS5 needs your 24-character service username and password from Nord Account → "Set up NordVPN manually" — not your NordVPN account email and password.
v1.6.33October 17, 2026

What's New

  • Fixed: "Restart & Install" now updates silently — it no longer asks you to close MeetLogin, and it no longer shows an uninstaller prompt about removing profile data during an update. Your profiles are always kept. (This takes full effect from this version onward.)
  • Fixed: the Fingerprint Check no longer flips between pass and mismatch while you browse. It now always measures a real website tab (never the New Tab page), shows "not ready" instead of a false red when there is no website tab to measure, and still reports a genuine mismatch.
  • Fixed: the MeetLogin fingerprint test page always finishes with a result — completed, partial, or failed with a reason — instead of showing "Analyzing fingerprint…" forever. Measurements a page cannot read are shown as "unavailable" and are never counted as a pass.
  • New profiles now default to Windows 11 and a recent (last-24-months) device from the Modern Device Library. Your existing profiles keep their saved operating system and settings.
  • New profiles use native audio by default for better website compatibility; the audio-privacy noise (which some scanners flag as "modified") can be turned back on per profile in the editor. Existing profiles keep their current setting.
  • Fixed: the website and in-app Download buttons link to the current installer again.
v1.6.6October 2, 2026

What's New

  • Fixed: the Fingerprint Check no longer reports a false screen mismatch. A new desktop profile now takes your computer's real screen size and scaling, so the profile editor, the Fingerprint Check and the launched browser all show the same screen. (Desktop profiles have always rendered on your real monitor — an invented screen that disagrees with the window is itself detectable — but the stored value did not reflect that.)
v1.6.5October 2, 2026

What's New

  • Fixed: saving a profile could fail with "Failed". Profiles without a colour could not be saved from the desktop app.
  • Fixed: changes made in the profile editor now always reach the browser. Some edits (CPU threads, memory, screen) were saved but the profile kept launching with its original values.
  • Fixed: profiles no longer open zoomed in or in a window larger than your screen. Desktop profiles use your monitor's real screen and scaling; you can give a profile a fixed window size instead.
  • Phone and tablet profiles now use Chrome's device emulation: pages lay out at phone width, with touch, and the screen, pixel ratio and page width all match the device.
  • Fixed: a proxy set on a profile is now applied every time the profile launches from the desktop app. A proxy that does not respond stops the launch with a clear message instead of opening without it.
  • Location, Do Not Track and font settings now take effect. Location can follow the proxy, use fixed coordinates, or be blocked.
  • Cookies imported on the website, or into a closed profile, are added the next time the profile launches.
  • Each open profile now shows its own name and icon on the Windows taskbar, instead of the browser engine's name.
  • New profile editor in the desktop app and on the website: clearer sections, an unsaved-changes indicator, and errors shown next to the setting that needs fixing.
v1.6.4September 29, 2026

What's New

  • New lower prices: Professional $35/month ($17/month billed yearly), Business $89/month ($44), Enterprise $169/month ($84). For 100, 300 and 1,000 profiles that is below GoLogin, and at 100 profiles below AdsPower, on each vendor’s published monthly prices.
  • The free plan now includes 5 profiles (was 3).
  • Stronger encryption for synced profiles: each account now has its own random encryption secret. Previously the key was derived from your account ID, which appears in places like links and API responses. Profiles uploaded by earlier versions still open, and are re-encrypted with the new key the next time they sync.
  • Affiliate program page now says what it is: coming soon, with a waitlist that actually reaches our team (the old form did not send anything).
v1.6.3 · payments updateSeptember 28, 2026

What's New

  • Pay with cryptocurrency: plans can now be paid in USDT, BTC, ETH and other coins through Cryptomus. Your plan activates automatically once the payment confirms on the blockchain.
  • Plans are prepaid for a month or a year and never charge you automatically. We email you 3 days before a plan ends, and renewing early adds the new period after your current one.
  • Switching plans credits the unused value of your current plan as extra days on the new one.
  • Terms of Service and Privacy Policy updated for cryptocurrency payments.
v1.6.3September 27, 2026

What's New

  • Payment history on the Billing page now shows every charge, renewal and refund.
  • Fixed: the plan list could come back empty, which would have shown every paid plan as "Unavailable" on the Billing page.
  • Plan listings corrected: included proxy traffic and cloud launch sessions have been removed from all plans because they are not provided yet. Cloud launch is coming soon; use your own proxies with the built-in proxy manager.
v1.6.2September 21, 2026

What's New

  • Timezone now follows the proxy/IP instead of being hardcoded. Every profile was generated with America/New_York regardless of where it actually ran, so a profile on a Pakistani IP announced a New York clock — PixelScan reported this directly as "Timezone spoofed". New profiles store "based on ip" and the browser resolves the real zone at launch.
  • User-Agent now sends the reduced version string real Chrome sends (153.0.0.0). Chrome has reported MAJOR.0.0.0 since v100, with the true build number available only through high-entropy client hints; sending a full build number was itself the anomaly.
  • Canvas protection no longer corrupts the PNG. The old noise spliced bytes into the base64 output, producing an image no decoder could read — which is why fingerprint scans hung on "Collecting Data" forever. Noise is now applied to pixel data before encoding, so the image stays valid and still differs per profile.
  • The browser is no longer left instrumented for the whole session. The CDP Network domain was enabled to apply the User-Agent override and then never turned off; the override persists on its own, so the domain is now disabled immediately afterwards. This was the cause of "Automated behavior detected" on PixelScan’s bot check. Fetch interception stays on only for profiles that use an authenticated proxy.
  • Verify panel no longer reports failures for fields a profile never overrode. Fields with no configured value are now shown as informational rather than counted as mismatches — the cause of the "3 of 28 fields don’t match" report on screen size and pixel ratio.
  • A profile now looks identical on every launch. Canvas and audio noise used Math.random(), so the same profile produced a different fingerprint each run — iphey showed "Trustworthy" on first launch and "Unreliable" after a restart. Both are now derived deterministically from the profile seed.
  • The running version is displayed in the title bar.
v1.6.0September 18, 2026

What's New

  • Device library expanded to 5,297 configurations across 135 device families — Windows, macOS, Android, iOS, Linux and ChromeOS, weighted so mainstream hardware appears most often. CPU, memory, GPU and OS version vary within each family while chassis properties stay internally consistent.
  • Profile launch no longer blocks on cloud sync. Sync is now given a time budget and the browser starts regardless, instead of waiting on a download that could take minutes.
  • Audio noise reworked to affect the whole channel. The previous implementation modified a single sample that no real fingerprint reads, so audio protection had no measurable effect.
  • Profile sync works without AWS credentials — profile data can be stored on the server disk instead of S3.
  • Fixed profile creation failing with "Validation failed" after the engine moved to Chromium 153: the new-profile form still offered browser versions the engine no longer accepted.
v1.5.3September 18, 2026

What's New

  • Browser engine updated from Chromium 147 to 153.
  • Closed the Web Worker font leak. Font masking applied only to the main page, so a page reading fonts from inside a Web Worker saw the real host font list — measured at 3 masked fonts on the page against 16 host fonts in the worker. Workers now receive the same masking.
  • Font masking implemented. The interface offered the setting but no font code existed, so two different profiles on the same machine enumerated an identical font list — a reliable way to link them to one device. Each profile now reports only its own declared fonts.
  • Workspace authorization enforced on profile and team endpoints.
  • Deployment now verifies migrations, dependencies and a health check before restarting, and rolls back automatically on failure.
v1.4.4May 2, 2026

What's New

  • WebGL spoof now overrides 4 parameters instead of 2: UNMASKED_VENDOR_WEBGL (37445), UNMASKED_RENDERER_WEBGL (37446), VENDOR (7936) → "WebKit", RENDERER (7937) → "WebKit WebGL". Detection scripts that probe the un-prefixed VENDOR/RENDERER no longer see the real underlying GPU strings.
  • WebGL spoof also patches getExtension('WEBGL_debug_renderer_info') so the extension is always reported as available with the correct constants (37445, 37446). Real Chrome browsers always expose this extension; hiding it would itself be a detection signal.
  • IndexedDB block — when enableIndexedDB is OFF, window.indexedDB is now replaced with a stub whose open() and deleteDatabase() throw SecurityError. This matches what Chrome does with content_settings.databases=2 and makes the verify panel report "off" correctly. Previously the JS API was still exposed even when storage was disabled in Preferences.
  • webglMetaMode live probe rewritten — was using a wrong heuristic (checks for parentheses in vendor string). Now compares the un-prefixed VENDOR (7936) to the stock Chrome value "WebKit". When the value is "WebKit" or empty, the patch is active = "mask"; when it returns a real GPU vendor name = "real".
v1.4.3May 2, 2026

What's New

  • Browser Version dropdown — now lists Chrome 132–147 (was 133–142). Default for new profiles is now Chrome 147 to match the bundled Orbita binary. Both the "Add New Profile" wizard and the Profile Editor were updated.
  • "Add New Profile" wizard now bakes v1.4.0 defaults into every new profile: Language = Based on IP, autoFromIp = true, default bookmark tree (Facebook / Dropshipping / Crypto folders + quick links), and the full DEFAULT_BROWSER_OPTIONS payload (font masking ON, media devices mask ON, audio noise ON, WebGL image OFF, WebGL meta MASK, local storage ON, IndexedDB OFF, vulnerable plugins ON, save bookmarks/history/passwords ON, system extensions OFF). The Advanced tab toggles are honored on top.
  • devicePixelRatio fix on Windows — added --force-device-scale-factor=<dpr> + --high-dpi-support=1 launch flags. Without these, Windows applied its own scaling (1.25 on 125% displays, 1.5 on 150%) and the page read the OS scale before our JS override could run. Now the configured DPR is enforced at Chromium level.
  • IndexedDB and localStorage toggles now actually take effect — Chrome Preferences default_content_setting_values.databases / .cookies are written based on browserOptions (1 = allow, 2 = block, the same enum Chrome uses for cookies). The verify panel will now report the actual state instead of always seeing "on".
  • Verify panel — fontMaskingEnabled is now marked info-only because there is no reliable JS-only signal for whether Chromium's font enumeration was filtered (FontFaceSet only exposes loaded @font-face entries, not system fonts). The font masking IS being applied via the fingerprint-engine fonts list, but the live probe can't prove it from the page.
  • Verify panel — IndexedDB live probe now tries indexedDB.open() in a try/catch instead of just checking if the function exists. Some Chrome storage policies make open() throw QuotaExceededError or SecurityError; this catches that.
v1.4.2May 2, 2026

What's New

  • CRITICAL fix — internet connectivity. Removed --disable-automation, --disable-features=IsolateOrigins,site-per-process,SitePerProcess, the duplicated --no-background-networking, and --app-user-model-id=com.meetlogin.app from the launched browser flags. The first three caused page-load failures and disconnects; the AUMID was being read by detection sites as the "Squirrel / anti-detect environment" tell. Profile browsers now launch with a minimal flag set that no longer trips fingerprinting heuristics.
  • Chrome version bumped to 147 across the entire UA pool (was 142). New profiles get a 147 User-Agent that matches the Orbita binary. CHROME_VERSIONS in fingerprint-engine and api/FingerprintService now lead with 147 / 146 / 145 / 144 / 143.
  • Fingerprint injection rewrite — direct Navigator.prototype and Screen.prototype getter redefinition. The Window.prototype.navigator Proxy approach was failing silently on Chromium 147 because that getter is no longer configurable on the new build. Direct prototype patching IS reliable because the per-property getters on Navigator.prototype and Screen.prototype remain configurable. This fixes the "8 vs 32 deviceMemory", "1440x900 vs 1536x864 screen", "Intel vs NVIDIA WebGL", "fontMaskingEnabled off", "audioContextNoise off", "webglMetaMode real", and "enableIndexedDB on" mismatches you saw in the verify panel.
  • Verify panel — failed tabs now sort to the FRONT. If Hardware has 1 mismatch and Identity has 0, the Hardware tab opens first instead of Identity. Same logic for Screen, Graphics, Browser Options.
  • navigator.language follows the egress IP — autoFromIp default applies to every profile (new + existing + 3 starters), and the launcher overrides stored language with geo.language at run time. Language is no longer randomly picked from a global pool.
v1.4.1May 2, 2026

What's New

  • CRITICAL fix — internet broken with no proxy: --force-webrtc-ip-handling-policy=disable_non_proxied_udp was being applied unconditionally. Without a proxy this blocks normal QUIC/HTTP3/UDP traffic, which is why pages stopped loading and kept disconnecting. The flag is now only applied when a proxy is actually configured.
  • CRITICAL fix — sites breaking with --disable-databases: removed the IndexedDB launch flag. It was disabling site storage that Gmail, Discord, and most modern web apps need to load. IndexedDB toggle is now Preferences-only and defaults to ON.
  • Time format mismatch fix — REMOVED all JS-level Date overrides (Date.toString, toTimeString, toDateString, getTimezoneOffset, Intl.DateTimeFormat proxy). CDP Emulation.setTimezoneOverride patches Date at the V8 level natively, which means every API uses the SAME native format string. Doing it twice (CDP + JS) was producing two different format strings — "GMT+0500 (PKT)" from CDP vs "GMT+05:00 (Pakistan Standard Time)" from our JS — and whoer.net was reading both and flagging the mismatch as a spoofing tell.
  • Defaults apply universally — every profile (new, existing, the 3 starter profiles) gets autoFromIp + DEFAULT_BOOKMARKS + DEFAULT_BROWSER_OPTIONS merged in at launch time if missing. Same rule for new and old, no more "applies to new profiles only".
  • Verify panel is now tabbed — one tab per section (Identity / Locale / Hardware / Screen / Graphics / Privacy / Network / Browser Options). Each tab shows a mismatch counter badge. The new Browser Options tab compares every v1.4.0 toggle (font masking, media devices, client rects, audio, WebGL, storage, plugins, save bookmarks/history/passwords, system extensions) against the live browser state.
v1.4.0May 2, 2026

What's New

  • New profiles auto-follow the egress IP for timezone, language, and geolocation. Whatever IP your proxy (or system VPN, or direct connection) reaches the internet on becomes the source of truth — never random pool values, never your local PC clock.
  • Default bookmark tree on every new profile: Facebook folder (Facebook / Notifications / Account Quality / Ads Manager / Billing / Business Manager), Dropshipping folder (Amazon / eBay / Walmart / Shopify / Taobao / AliExpress / PayPal / Payoneer), Crypto folder (Coinlist / Huobi / Discord / Premint), plus quick-link bar (Facebook / Amazon / TikTok / Google Ads / Browser check). Existing user-added bookmarks are never overwritten on relaunch.
  • Default browser options applied to every new profile: fonts list masking ON, media devices mask ON, client rects noise OFF, audio context noise ON, WebGL image OFF, WebGL metadata MASK, local storage ON, IndexedDB OFF, extension storage ON, vulnerable plugins emulation ON, active session lock OFF, Google services ON, save bookmarks ON, save history ON, save passwords ON, system extensions OFF, WebRTC = real (proxy IP only — local IP never leaks because of --force-webrtc-ip-handling-policy=disable_non_proxied_udp).
  • Three starter profiles created on signup now inherit all v1.4.0 defaults — bookmark tree, browser options, autoFromIp.
  • Chrome Preferences honor browserOptions: savePasswords toggles credentials_enable_service, saveHistory toggles history.disabled, saveBookmarks shows the bookmarks bar, enableGoogleServices toggles signin.allowed.
  • Backwards compatible: existing profiles created before v1.4.0 keep their stored fingerprint exactly as-is. autoFromIp / bookmarks / browserOptions are only applied to new profiles or profiles regenerated by the user.
v1.3.9May 1, 2026

What's New

  • CRITICAL fix — timezone leaking real PC clock: when the geo provider (ipapi.co) failed or timed out, the launcher silently fell back to a hardcoded America/New_York. That is why whoer.net "System" sometimes showed EDT while "Local" showed Pakistan — the spoof was set to NY but the real Date methods ran before injection completed. Now uses 3 providers in sequence (ipapi.co → ipinfo.io → ip-api.com), so the egress IP timezone is always the source of truth, never a fallback hardcoded country.
  • Verify panel mismatch root-cause fix #1 — retroactive injection: the welcome.html tab opens BEFORE setupAutoAttach runs, and Target.setAutoAttach only catches future tabs. The launcher now walks every existing page target via Target.attachToTarget, registers the injection script, and reloads the tab so the script runs from the very first frame.
  • Verify panel mismatch root-cause fix #2 — proper navigator/screen replacement: window.navigator and window.screen are now replaced by redefining the getter on Window.prototype (which IS configurable on Chromium), wrapping the original in a Proxy that serves overrides for hardwareConcurrency / deviceMemory / userAgent / platform / vendor / language. This bypasses the non-configurable instance getters that Chromium previously rejected.
  • Belt-and-suspenders: also redefines each property on Navigator.prototype and Screen.prototype where configurable, so detection scripts that walk prototypes directly still see spoofed values.
  • devicePixelRatio override now applied at both window and Window.prototype level.
v1.3.8May 1, 2026

What's New

  • Critical fix: navigator.platform / hardwareConcurrency / deviceMemory / userAgent / vendor are non-configurable getters on stock Chrome 147 — Object.defineProperty silently failed and the spoof was bypassed. Injection now wraps the entire navigator object in a Proxy as a final defense, so every read goes through our override table even when defineProperty is rejected.
  • Critical fix: normalizeFp early-returned for already-nested fingerprint objects without promoting top-level overrides — top-level userAgent / platform / hardwareConcurrency / deviceMemory / webgl values are now merged into navigator.* and webgl.* before injection.
  • Added: WebGL-vs-OS mismatch detector in the launcher — if a Mac profile carries a Windows D3D11 GPU string (or vice-versa) the launcher regenerates the OS-dependent half locally before launch, so existing legacy rows self-heal on first run.
  • Expanded verify panel — now reports 28 fields across 7 grouped sections (Identity / Locale / Hardware / Screen / Graphics / Privacy / Network) including vendor, appVersion, Chrome major version, OS family, timezone offset, availWidth / availHeight, canvas hash, webdriver, cookieEnabled, doNotTrack, pdfViewerEnabled, public IP, WebRTC leak detection.
  • Verify panel: fields without a configured expected value (info-only, e.g. canvas hash, public IP, WebRTC leak) now render with a blue "i" badge instead of a misleading red X.
v1.3.7May 1, 2026

What's New

  • Critical fix: CDP injection was racing the page load — applyOverridesToSession was fire-and-forget, so Runtime.runIfWaitingForDebugger fired BEFORE addScriptToEvaluateOnNewDocument was registered. Pages saw stock Orbita Chrome 147 / Win32 every time. Now the override is fully awaited before the page is unpaused.
  • Critical fix: when the API returns an incomplete fingerprint (older profile rows, older API), the desktop launcher now regenerates the missing OS-dependent half locally using a per-OS defaults table. Existing iPhone / Mac / Android profiles now report the correct UA / platform / WebGL / hardware values instead of leaking stock Orbita values via empty fields.
  • Verify panel will now consistently show all 14 fields populated — the "Configured: —" entries you were seeing came from the API not regenerating; the local fallback fixes that.
  • CDP injection now also targets webview / service_worker / shared_worker / dedicated_worker target types where applicable.
v1.3.6May 1, 2026

What's New

  • CRITICAL FIX: fingerprint injection was never running — setupAutoAttach handled only proxy auth and forgot to call addScriptToEvaluateOnNewDocument / Network.setUserAgentOverride / Emulation.setTimezoneOverride. Browser version, OS, and timezone fields all leaked the stock Orbita Chrome 147 values regardless of profile config. Now ALL injection vectors are wired up on every new tab
  • Fixed: ERR_CERT_AUTHORITY_INVALID on every site after a crashed launch — the launcher now repairs corrupted Chrome state files (TransportSecurity / Network Persistent State / NEL) before each launch so SSL works again
  • Added: live fingerprint verification panel — click "Verify" on any running profile to see a side-by-side check of what was configured vs what the browser actually reports (UA, platform, timezone, screen, WebGL, hardware concurrency, etc.) — green check or red X per field
  • Added: launch flag dump in the log so we can prove what --user-agent / --proxy-server / --timezone Chrome was actually started with
v1.3.5May 1, 2026

What's New

  • Fixed: existing iPhone / iPad / Mac / Android / Chrome OS profiles still rendered as Windows because their stored fingerprint had a Windows User-Agent baked in — API now detects UA-vs-os mismatch and regenerates the OS-dependent half of the fingerprint (UA, platform, screen, GPU, fonts), persists the result to Postgres, and forces both fp.platform and nav.platform on every response
  • Fixed: normalizeFp early-returned for already-nested fingerprints without reconciling the inner navigator.userAgent — old profiles always reported as Windows in --user-agent flag, JS-level navigator.userAgent override, AND CDP setUserAgentOverride. All three vectors now use the same correct UA
  • Fixed: profile name plumbing — renderer now passes profile.name through IPC → preload → ipcMain → ProfileLauncher so the welcome page title and Chrome avatar always show the real profile name. Three fallback layers (renderer hint → /fingerprint API → /:id direct lookup) and no literal "MeetLogin Profile" string
  • Verified end-to-end consistency for all 9 supported OSes (win, win11, mac, mac-m1, lin, chromeos, android, ios, ipad)
v1.3.4May 1, 2026

What's New

  • Fixed: Avast / Defender flagged MeetLogin.exe and Orbita.exe as suspicious after the 1.3.3 install — removed the rcedit-based binary patching that triggered antivirus heuristics
  • Fixed: profile launch hung on "Launching..." for ~2 minutes while antivirus held a file lock on the modified Orbita.exe
  • Branding now uses the real Chromium --app-user-model-id flag (set on every launched profile to com.meetlogin.app) so the Windows taskbar groups Orbita windows under the parent MeetLogin app icon — no binary modification, no AV friction
v1.3.3May 1, 2026

What's New

  • Fixed: profiles always rendered as Windows even when iOS/Mac/Android was selected — API now returns os + derived platform per profile, launcher uses both
  • Fixed: system clock leaked the real PC timezone (whoer.net "System" field showed local time, not proxy time) — Date.toString / Date.toTimeString / getTimezoneOffset are now overridden on every launch, not only when a profile-level proxy is set
  • Fixed: timezone spoof was skipped entirely when no proxy was configured — system-level VPNs now get correct egress-IP timezone detection and full Date/Intl injection
  • Fixed: Orbita browser windows showed the Chromium icon in the Windows taskbar — Orbita.exe is now icon-patched at desktop build time AND on first launch via rcedit
  • Restored: fingerprint test link — welcome page now includes "Test fingerprint" button that opens the API verification page in a new tab, plus quick links to whoer.net and BrowserLeaks
  • Geo lookup in the desktop app now uses HTTPS (ipapi.co) instead of HTTP (ip-api.com)
v1.3.2May 1, 2026

What's New

  • Profile injection accuracy — auto-generated default profiles now match your local OS, language, and timezone instead of random global values
  • Default profiles — 3 unique fingerprint signatures sharing your local locale, no proxy by default (you add yours)
  • Session persistence hardened — every profile now boots with --restore-last-session and Chrome session.restore_on_startup=1
  • Browser branding — MeetLogin icon now ships in extraResources so the taskbar/title bar always show our icon, not Chrome
  • Download page — links and version updated to point at the latest installer
  • Google sign-in fix — /google now also accepts the legacy access_token (with audience verification), restoring web Google sign-up
  • New device coverage — added iOS (iPhone 13–16 Pro Max), iPadOS (iPad Pro M4, iPad Air, iPad mini), and Chrome OS (Chromebook)
  • Expanded Windows profiles — 1366×768, 1280×720, ultrawide 3440×1440, 4K native, Surface Pro/Laptop, ROG Ally / Steam Deck, gaming laptops
  • Expanded Android — Galaxy A35/A25/A15, Redmi Note 13 Pro/12, Redmi 13C, OnePlus Nord 4, Realme GT, Oppo Reno, Vivo X100, Motorola g54, Pixel 9a, Z Fold
  • Expanded Mac — Mac Mini (Intel + M-series), MBP 13" M1/M2, MBP 15" Intel, iMac 21", MacBook Air M4
  • Profile list now shows the correct per-OS icon (Windows / Apple / Linux / ChromeOS / Android / iOS / iPad)
  • Browser tab now shows the actual profile name (e.g. "Facebook") instead of the literal string "MeetLogin Profile"
  • Browser startup tab is now a clean local welcome page instead of leaking the API URL on every launch
v1.3.1May 1, 2026

What's New

  • Onboarding emails — every new account now gets a welcome email and a 7-day drip sequence (quick start, use cases, mid-trial check-in, power features, trial-ending reminder)
  • Fixed: password reset and verification emails contained "http://localhost:3000" links — now use the correct WEB_URL
  • Email queue worker — scheduled emails are sent reliably with retry-on-failure (up to 5 attempts) and per-row idempotency
v1.3.0May 1, 2026

What's New

  • Major security release — full production audit closing 30+ findings across auth, API, and cloud-browser stack
  • Cloud Browser viewer is now end-to-end secured — per-session VNC password, single-use ticket auth, localhost-only binding
  • Auth hardening — Google OAuth replay protection (ID-token verification), per-account brute-force lockout, JWT plan refresh on every request
  • API hardening — strict CORS, scoped CSP, 1MB body limit, full Zod validation on all endpoints
  • SSRF protection across proxy ingress — IPv4/IPv6 private ranges, IPv4-mapped IPv6, and CGNAT all blocked
  • IDOR fixes — every profile endpoint now verifies workspace membership atomically
  • Plan-limit race fixed — concurrent profile creation now enforced via serializable Postgres transactions with retry
  • Email enumeration removed from /register — symmetric responses regardless of whether the email exists
  • Performance — added 5 missing Postgres indexes; bulk endpoints capped and event-loop yields added
  • Removed dead API token feature; rotate via /auth/regenerate-api-key (now rate limited)
v1.2.0April 18, 2026

What's New

  • Two-factor authentication (TOTP) — protect your account with an authenticator app
  • Google OAuth — sign in with your Google account in one click
  • Improved billing page — new invoice history, plan comparison, and usage meters
  • Password reset flow — email-based reset with secure time-limited tokens
  • Profile launch notifications — desktop notifications when a profile starts or stops
  • API token management UI — create, name, and revoke tokens from Settings
v1.1.0April 1, 2026

What's New

  • Marketing website launch — new homepage, features page, and pricing page
  • Full documentation system — 30+ articles across 12 sections
  • 7-day free trial — new users get Professional plan access, no credit card required
  • Blog and changelog pages — stay up to date with product updates
  • Status page — real-time service health and 30-day uptime history
  • Affiliate program — earn 30% recurring commission for referrals
v1.0.5March 20, 2026

What's New

  • Profile sync improvements — 40% faster upload/download for large profiles
  • Proxy checker speed 3x faster — parallel checking with connection pooling
  • Fixed: Profile table not refreshing after bulk delete
  • Fixed: Timezone picker not saving in Advanced tab
  • Fixed: WebRTC "Fake" mode occasionally leaking real IP on macOS
  • Fixed: Incorrect profile count shown on Free plan
v1.0.0March 1, 2026

What's New

  • Initial release — MeetLogin is live!
  • Profile management — create, edit, launch, and stop browser profiles
  • 53-parameter fingerprint engine — canvas, WebGL, audio, fonts, navigator, and more
  • Stripe billing — Professional, Business, and Enterprise subscription plans
  • Team workspaces — invite members, assign roles, share profiles
  • Proxy manager — HTTP, SOCKS5, with integrated checker
  • S3-backed encrypted sync — profiles stored with AES-256-GCM encryption
  • Electron desktop app — Windows, macOS (Intel + Apple Silicon), Linux