NoobClaw

I was running social media for a small business across five accounts — TikTok, Instagram, and a few Chinese platforms. It ate 4-6 hours a day: writing scripts, cutting video, replying to comments. Hiring wasn't an option at our size.

So we built the tool we needed. Sharing the parts that were harder than expected, because they're not the parts you'd guess.

1. The cloud model doesn't work for this.

Every competitor we looked at runs automation on their servers and asks you to hand over account credentials or an OAuth token. We didn't want to hold anyone's passwords — that's a breach waiting to happen — and platforms flag datacenter IPs anyway.

So it's a desktop app. It drives a Chromium instance on your machine, inside your already-logged-in sessions. We never see a password, never store a token. Downside: we ship a browser engine and deal with every OS quirk ourselves. Worth it.

2. Multi-account is a fingerprinting problem, not a scheduling problem.

Naively, "run 10 accounts" sounds like a queue. It isn't. Platforms link accounts through browser fingerprints — canvas, WebGL, fonts, UA — and those survive logout, incognito, and cookie clearing. Log into account A, log out, log into B, and the platform now has a high-confidence link. One strike on one account, and its siblings inherit the suspicion.

So every account gets its own fingerprint-isolated profile with an optional dedicated proxy. The subtle part: a spoofed fingerprint has to be internally coherent. A Mac UA reporting Windows fonts, or a timezone contradicting the IP, is more suspicious than no disguise at all. Detection systems hunt contradictions, not disguises.

3. Session cookies almost cost us a week.

Recent bug I still think about: users would scan a QR code, see "connected", then run a task and get "not logged in" — with the account flipping back to expired.

The login cookies platforms set are session cookies — no expiry, memory-only. Our relogin flow read them live over CDP and correctly saw a valid session. But when the login window got force-killed (manual close, or our own cleanup SIGKILL'ing a lingering process), Chromium never flushed them to disk. The next task launched a fresh browser, read the on-disk cookie store, found no session, and marked the account dead.

Small fix once we saw it: after a confirmed login, rewrite the session cookies with a far-future expiry so Chromium persists them.

4. Human-like pacing is a product decision, not a feature.

We deliberately don't do what most tools in this space sell: bought followers, mass DMs, comment spam. Not out of virtue — those get accounts banned, which destroys the actual asset. What we automate is what a diligent person would do: randomized intervals, daily caps, rest days, comments generated from the actual content rather than a template.

The hard part is that "slow and boring" is a terrible pitch next to "1,000 followers a day." We've had to explain that trade-off constantly.

What I'd like input on: We just listed on G2, Capterra and a few directories. For those who've done it — what actually moved the needle: reviews, category placement, or paid placement?