One prompt. The whole account portfolio.
Say what the channel is called. Chain works out the handles, checks every platform live, writes the bios to each one's real character limit, claims the accounts, holds every credential encrypted, and maps which login can reset which.
Real output for that prompt. mychannel321 really is gone on YouTube.
What is automated, and what is not
Only one of these eight can be created end to end by a machine, and it is worth being precise about which, because it decides how the whole tool is built.
Gmail is fully automatic. Because blomega.com is a Google
Workspace domain, the Directory API creates a real mailbox with no captcha and no SMS.
That mailbox is the root of the chain: every other signup verifies against it.
Everywhere else, signup is bot-walled. Chain opens the real page in a real browser, fills every field from the identity kit, and stops at the verification step for you. It does not try to defeat captchas or SMS checks. That is a design decision, not a missing feature: those checks are how platforms decide an account is real, and accounts pushed past them in bulk get removed in the next sweep, usually taking the good accounts registered from the same fingerprint with them. Chain deletes the twenty minutes of typing. You keep the ten seconds that keep the account alive.
| Platform | Account creation | Fields filled | Handle check |
|---|---|---|---|
| Gmail | Fully automatic | — | Directory API |
| Assisted | 4 of 4 | real page load | |
| Assisted | 4 of 4 | real page load | |
| Twitch | Assisted | 3 of 3 | public GraphQL |
| TikTok | Assisted | after method choice | real page load |
| X | Assisted | after account step | profile 404 |
| YouTube | Assisted | name + handle | profile 404 |
| Assisted | name, URL, site | profile 404 |
Measured against the live signup pages, not assumed. Meta properties no longer put
name attributes on their inputs at all, so Chain matches fields by label text
and position instead.
The auth chain
Eight accounts is eight passwords, eight 2FA secrets, and one quiet problem: almost all of them can be reset from a single mailbox. Chain draws that graph and tells you where the portfolio actually hangs by a thread.
Single point of failure
One mailbox that can recover everything, weighted by how many accounts it actually unlocks.
Root without 2FA
The account that resets the others, protected by one password. Flagged critical.
2FA with no backup codes
The codes are shown once at setup. Lose the device and the account is simply gone.
Password reuse
The same password on two accounts in one portfolio, which turns one leak into two.
Local, and locked
Chain holds passwords, TOTP secrets and backup codes, so it runs on your Mac rather than on a server. The vault is AES-256-GCM with a scrypt-derived key. The key exists in memory only and is gone the moment the app restarts. Nothing readable is written to disk, and there is no recovery: lose the master password and the secrets are unreadable, by design.
The server binds to loopback. When it is published through a Cloudflare Tunnel, the tunnel is not treated as an authenticator: because cloudflared connects over loopback, every tunnelled request would otherwise look local. Chain listens on a separate origin port for tunnel traffic and requires a verified Cloudflare Access identity there, every time. Forged headers, forged cookies, spoofed forwarding addresses and self-signed tokens were all tested and rejected.
Two-factor codes are generated in-app to RFC 6238, verified against all six published
test vectors. Paste the base32 secret or the whole otpauth:// URI.
Running it
# install, fetch the browser, build the UI
npm run setup
# start it, or just open Chain.app
npm start
# one-time: let it create Workspace mailboxes
npm run google-auth
# optional: reach it from anywhere, behind Cloudflare Access
cloudflared tunnel login
npm run tunnel
npm run access
npm run start:remote
# checks everything and says how to fix what is not ready
npm run doctorChain.app is a real double-clickable Mac app with no Electron in it: it boots the local server, opens the UI, and reuses a running instance instead of starting a second one.