The engine & CAPTCHA

Engine mode, the anti-detect layer, and the captcha harvester.

What it's for

Two things live under Fingerprint, CAPTCHA & engine, and they sit at opposite ends of the isolation story. The hardened engine gives each Account a real Chrome network identity below the JavaScript layer. The CAPTCHA harvester is the one place Umbra deliberately steps outside per-Account isolation — so it's the one place on this screen you need to read carefully before a drop.

The Advanced settings pane showing the engine-mode selector, the always-on facts group, and the CAPTCHA solver-key row.
Engine, alignment facts, and CAPTCHA all share the Advanced pane. The two facts at the top are not settings.shot-settings · Advanced pane: engine mode Hardened, CAPTCHA solver key saved, token pool row

Standard vs hardened engine

The engine sets what a site reads on the wire, before any script runs.

Standard
Plain Electron networking. Fine for most work; the network layer looks like Electron, not Chrome.
Hardened
A real Chrome TLS (JA3/JA4) and HTTP-2 fingerprint, pinned to the nearest Chrome build the engine ships — the layer sites read below JavaScript, the one an ordinary browser can't change. Each Account keeps its own exit.

Turning on the hardened engine

Switch the mode to Hardened

It's a licensed feature — activate a licence (under Plan & licence) if the selector is locked. An environment override, UMBRA_ENGINE=1, forces it on.

Restart Umbra

The engine starts and stops on restart, so the pane reads "enabled, restart to start it" until you do. If it doesn't come up after a restart, the engine binary is missing or blocked.

Check a scorecard

Open any Session's fingerprint scorecard and read the TLS / HTTP-2 section — that's the before/after against raw Chromium.

Solving CAPTCHAs

Umbra doesn't solve CAPTCHAs for you; it hands them to a solver you pay for. Save a 2Captcha or CapSolver key and scripts can call umbra.solveCaptcha() against your own balance. The key is encrypted on this device and only ever sent to the solver you chose.

The token pool pre-solves tokens ahead of a drop so checkout gets a fresh one instantly. It spends solver balance, so it's off until you arm it and is hard-capped; reCAPTCHA v3 is never pooled, because a v3 token is score-bound and worthless once it's a few seconds old. Solving by hand in the harvester is free and drops tokens into the same pool.

The harvester runs in one shared Session

When a site throws a CAPTCHA — or a Google sign-in — the solve happens in a dedicated harvester window, not in the Account that triggered it. That window is one Session shared by every Account (persist:umbra-harvester), which is what lets a Google login stick and a reCAPTCHA become one-click. It's also why it can't sit behind any single Account's exit: pointing the shared Session at Account A's exit would put Account B's solves on A's IP, manufacturing the exact link the product exists to prevent.

It says where it's coming out

Because this is the one spot where "every Session behind its own exit" isn't literally true, the harvester discloses its exit in the open — in the window title and in a banner on the page — for the whole time you're typing.