DEV Community: Sebastian Balog

How to Run Multiple Cursor Accounts at Once on Mac and Windows

Sebastian Balog — Fri, 30 Oct 2026 07:28:14 +0000

Disclosure up front: I make Sessions Pro for Cursor, a paid app that does this for you. Everything until the last section is free and needs nothing but Cursor. The Mac commands were tested on macOS 26 and the Windows options on Windows 11, both with Cursor 3.27.

If you have a Cursor account for work and another for your own projects, or one per client, you know the routine: Cursor holds one account at a time, so switching means signing out, signing back in through the browser, and finding your place again. Do that a few times a day and it gets old fast.

The good news is that you can run multiple Cursor accounts at once, side by side, with no logging out. Here is how it works, the free way to do it on Mac and Windows, and the catches nobody mentions until they bite.

Can you have two Cursor accounts?

Yes. A Cursor team member put it plainly on the forum: "Having multiple accounts is totally fine. The only restriction is sharing a single account." So a work account paid for by your employer and a personal Pro account are fine. Two people sharing one login is not.

What decides which account Cursor uses

Cursor is built on VS Code, which is built on Electron. Your login lives in Cursor's data folder, not in some system setting:

	Mac	Windows
Data folder (login, chats, settings, window state)	`~/Library/Application Support/Cursor`	`%APPDATA%\Cursor`
Extensions	`~/.cursor/extensions`	`%USERPROFILE%\.cursor\extensions`

The sign-in token sits in User/globalStorage/state.vscdb inside the data folder. One data folder, one account. Give Cursor a second data folder and you get a second, completely separate sign-in.

Free method on a Mac: run two instances of Cursor with --user-data-dir

Cursor accepts VS Code's --user-data-dir and --extensions-dir options. Point them at new folders and open -n starts a second copy of Cursor next to the one you already have:

mkdir -p ~/CursorWork/data ~/CursorWork/extensions

open -n -a Cursor --args \
  --user-data-dir="$HOME/CursorWork/data" \
  --extensions-dir="$HOME/CursorWork/extensions" \
  --disable-updates

The new window starts signed out. Choose Log In, finish the sign-in in your browser, and that folder stays signed in to the second account from then on. Your normal Cursor keeps its own account, and both run at the same time.

What each option does:

--user-data-dir gives the second copy its own login, chats, settings and window state.
--extensions-dir keeps its extensions apart. Without it both copies share one extensions folder.
--disable-updates stops the second copy from running Cursor's updater and nagging you about updates. Your normal Cursor still updates, and since both copies run the same installed app, the second one picks the update up too.

Keep the folder path short. This one is easy to miss. Cursor opens a socket file inside the data folder (<data>/3.27-main.sock), and macOS refuses socket paths longer than 103 characters. With a long path, say a folder nested under Library/Application Support/..., the second Cursor flashes up and quits without any error. ~/CursorWork/data is fine.

Free method on Windows: the same options in PowerShell

On Windows, Cursor installs per user. Start a second instance with its own folders:

$work = "$env:USERPROFILE\CursorWork"
New-Item -ItemType Directory -Force "$work\data", "$work\extensions" | Out-Null

& "$env:LOCALAPPDATA\Programs\cursor\Cursor.exe" `
  --user-data-dir="$work\data" `
  --extensions-dir="$work\extensions" `
  --disable-updates

Sign in to the second account in the new window. To make it a double-click, create a shortcut whose target is Cursor.exe followed by the same three options.

Keep each account's agent data apart too

There is one folder the options above don't move. Cursor's agent keeps per-account stores and per-project data outside the data folder (~/Library/Application Support/Cursor/AgentStores and ~/.cursor/projects on a Mac). Two environment variables in Cursor's agent code move them:

open -n -a Cursor \
  --env CURSOR_AGENT_STORE_DIR="$HOME/CursorWork/agent-stores" \
  --env CURSOR_DATA_DIR="$HOME/CursorWork/cursor-data" \
  --args --user-data-dir="$HOME/CursorWork/data" \
         --extensions-dir="$HOME/CursorWork/extensions" --disable-updates

On Windows, set them in PowerShell first ($env:CURSOR_AGENT_STORE_DIR = "$work\agent-stores" and $env:CURSOR_DATA_DIR = "$work\cursor-data"), then start Cursor.exe from the same window. I verified these on a Mac; Windows runs the same code.

Where the do-it-yourself way breaks

Running two instances of Cursor works. Living with it is where it gets fiddly:

They look identical. Same name, same icon, two "Cursor" entries in the Dock and ⌘-Tab, or in the Windows taskbar. Telling work from personal means checking the account in each window. On Windows, people on the Cursor forum report a pinned taskbar shortcut for the second instance opening the first one.
You start it from Terminal or a shortcut every time. Double-clicking Cursor opens your default account.
cursor:// links go to your normal Cursor, not to the copy that asked.
Some things stay shared, by design. ~/.cursor also holds your MCP servers (mcp.json), rules and skills. Every copy reads the same ones. That's often what you want, but it isn't total isolation.
Never copy your existing data folder to seed the second one. You'd copy the first account's login with it, and the two copies would end up fighting over one session. Start the new folder empty and sign in.

The ways to switch Cursor accounts, compared

Way	Both accounts open at once	Effort	Catches
Sign out, sign in	No	Every switch	Lose your place each time
An account switcher extension	No, one at a time	Low	Swaps the session in one window
`--user-data-dir` (above)	Yes	One-time setup, then a shortcut	Identical icons, shared `~/.cursor`, short paths only
An app that makes one copy per account	Yes	Click	Paid

An app that does it for you

This is the part I build. Sessions Pro for Cursor does the setup above for you and handles what comes after:

On a Mac, each account becomes its own app, like "Cursor Work" and "Cursor Personal", with its own Dock icon and a coloured letter, so ⌘-Tab tells you which is which. A menu bar switcher shows the account in front.
On Windows, each account opens in its own Cursor window titled with its name, with a tray switcher.
Each account keeps its own login, chats, settings, extensions and agent data. On a Mac you can start a new account from your current Cursor's settings and extensions (never its login).
On a Mac, the account copies are rebuilt automatically when Cursor updates, and the update nag stays out of them.
On a Mac it also shows each account's usage for the billing month, so you can see at a glance which account has room left.

It's $15 one-time for 2 computers, Mac or Windows, with a free 1-hour preview that starts once an account signs in, and a 14-day refund. It isn't affiliated with Anysphere, the maker of Cursor; it runs your installed Cursor as it is.

FAQ

Can I use two Cursor accounts on the same computer? Yes. Each one needs its own data folder: the free method above, or an app that sets that up for you.

Can I run two instances of Cursor at the same time? Yes, as long as each instance has its own --user-data-dir. Two windows of the same instance share one account.

How do I switch accounts in Cursor without logging out? Keep each account signed in to its own instance and switch between the windows, instead of switching the account inside one window.

Will my work account see my personal chats? No. Chats live in each instance's data folder. Only ~/.cursor (MCP servers, rules, skills) is shared.

Does this work with Cursor's free plan? Running several of your own accounts works on any plan. Using extra free accounts to stretch free limits is against Cursor's terms, and nothing here is meant for that.

Two ChatGPT accounts in the desktop app on a Mac (and keeping their Codex threads apart)

Sebastian Balog — Sun, 25 Oct 2026 23:17:30 +0000

Disclosure up front: I build Sessions Pro for Codex, a paid app that does this for you. Everything until the last section is free and only needs Terminal. The commands were run on macOS 26 with ChatGPT 26.1021.

If you use Codex for a client or an employer and also have your own ChatGPT account, you've probably hit this: the ChatGPT desktop app (which absorbed the Codex app in July) is signed in to one account at a time. Switching means signing out, signing back in, and losing your place.

ChatGPT now has a built-in account switcher, but it only works on the web version, which doesn't help if you build real projects in the desktop app. So here's what actually decides the account in the desktop app, and the ways around it.

What decides which account the app uses

Two folders, not one:

What	Default location	Holds
`CODEX_HOME`	`~/.codex`	`auth.json` (the Codex login), `config.toml` (settings, MCP servers), `state_5.sqlite` (threads), `.codex-global-state.json` (pins, projects, ordering)
App data	`~/Library/Application Support/Codex`	The app's own (Electron) data: the web session, preferences, caches

One pair of folders, one account. The app is still com.openai.codex under the hood, and the Codex CLI reads the same ~/.codex, so by default the app and codex in your terminal share one login. That's also why codex logout in a terminal can sign the app out.

Free method 1: a second copy of the app from Terminal

The app reads CODEX_HOME for Codex's state, CODEX_ELECTRON_USER_DATA_PATH for its app data, and also takes Chromium's --user-data-dir. Point all three at new folders and open -n starts a second, independent copy next to the first:

mkdir -p "$HOME/.codex-work" "$HOME/Library/Application Support/Codex-Work"

open -n -a ChatGPT \
  --env CODEX_HOME="$HOME/.codex-work" \
  --env CODEX_ELECTRON_USER_DATA_PATH="$HOME/Library/Application Support/Codex-Work" \
  --args --user-data-dir="$HOME/Library/Application Support/Codex-Work"

The new window starts signed out (there's no auth.json in the new folder yet). Sign in to the second account there, and from then on that pair of folders stays signed in to it.

Two details I found while testing:

Both copies can run together. The app only takes its single-instance lock per data folder when CODEX_ELECTRON_USER_DATA_PATH is set, so separate folders never block each other.
Create the folders first. open won't, and Codex expects CODEX_HOME to exist.

The catches:

Both copies look identical. Same name, same Dock icon, two "ChatGPT" entries in ⌘-Tab. Telling work from personal means checking the account in each window.
codex:// links go to whichever copy started last. Every copy registers itself for codex:// when it launches. Thread links and connector sign-in callbacks (OAuth) can land in the wrong account.
You start it from Terminal every time. Double-clicking ChatGPT opens your default account. A shell alias or an Automator app helps.
Don't seed it with a copy of ~/.codex. Some files inside hold absolute paths to the original folder, so continuing a copied thread can write into your original account's history. Start the second folder empty and sign in.

Free method 2: just the Codex CLI, with `CODEX_HOME`

If you only need the second account in the terminal, it's simpler: one folder per account.

mkdir -p ~/.codex-work
CODEX_HOME=~/.codex-work codex login     # sign in with the other account once
CODEX_HOME=~/.codex-work codex login status
# Not logged in   -> before signing in
# Logged in using ChatGPT

Plain codex keeps using ~/.codex and your first account. Add an alias so you don't have to type the variable:

alias codex-work='CODEX_HOME="$HOME/.codex-work" codex'

Each folder has its own config.toml, so MCP servers and settings are per account. Copy config.toml across if you want the same setup, never auth.json. And logout is per folder too: codex-work logout signs out only the work account.

Other options, briefly

Sign out and back in: fine once a week, painful several times a day, and your threads view changes with every switch.
A browser profile per account: works with ChatGPT on the web, but not with the desktop app's local Codex threads, projects and terminal.
A second macOS user: complete separation, but only one account in front of you at a time, and fast user switching between them.

What I ended up building

Method 1 works, but its catches add up if you switch accounts every day: two identical Dock icons, thread links opening in the wrong account, and re-running the command after every reboot. That's what I built Sessions Pro for Codex (Mac and Windows) to fix:

Each account becomes its own app, with its own name, colored Dock icon and place in ⌘-Tab.
codex:// links go to the account you were last using, not to whichever copy started last.
Each profile has its own Codex CLI (CODEX_HOME), opened from the app with one click.
A menu bar switcher, and a meter showing each account's Codex session and weekly usage.
It keeps ChatGPT itself up to date (checking OpenAI's signature first) and rebuilds every profile from the new version, since copies don't update themselves.

It's $24.99 one-time for two computers, with a 1-hour free preview. If the free methods above are enough for you, use them: they're genuinely fine for occasional switching.

A note on the rules: these methods run the official ChatGPT app with accounts you already have, like a work and a personal account. OpenAI's terms still apply to each account, and none of this is meant for getting around usage limits.

The full guide, with a comparison table of every method, is on multiplecodex.com.

Run two Claude Code accounts side by side without logging out (Mac, Windows, VS Code)

Sebastian Balog — Sat, 24 Oct 2026 20:06:22 +0000

Disclosure: I make Claude Sessions Pro, a paid Mac and Windows app for running several Claude accounts at once. Everything below works without it. The app gets one section near the end, clearly marked.

You have a work Claude account and a personal one. Maybe one per client. Claude Code signs in to one of them, and switching means /logout, /login, a browser tab, and losing your place. An hour later you do it again in the other direction.

You don't need to. Claude Code keeps everything about an account (the login, settings, history, MCP servers) in one folder, and you can point it at a different folder whenever you start it. Two folders, two accounts, both open at the same time in two terminals.

This guide covers the setup on macOS, Linux and Windows (PowerShell, cmd and Windows Terminal), how to run both side by side, how to let each project folder pick its own account, VS Code, CI, and the handful of things that quietly put both terminals on the same login. I checked the core of it (the alias, the PowerShell functions, the Windows Terminal profile, the tmux split, auth status and where MCP servers end up) on macOS and Windows 11.

TL;DR

You want	Do this
A second account in the terminal	`alias claude-work='CLAUDE_CONFIG_DIR=~/.claude-work claude'`, then run `claude-work` and sign in once
The same on Windows	A small PowerShell function that sets `$env:CLAUDE_CONFIG_DIR` for one call (below)
Both accounts on screen at once	tmux, an iTerm2 or Terminal split, or a Windows Terminal split pane
Each project to use the right account	direnv, or a shell function keyed on the folder
To check which account you're on	`claude auth status`
To never confuse them	A status line or terminal badge that says WORK
No terminal setup at all	Claude Sessions Pro, one app or window per account

How Claude Code decides which account you're on

When Claude Code starts, it looks at one environment variable, CLAUDE_CONFIG_DIR. If it isn't set, it uses ~/.claude. That folder is the account, for practical purposes:

The login. On macOS the token goes in the Keychain, in an entry tied to the config folder, so a second folder gets its own entry. On Linux and Windows it's a .credentials.json file inside the folder.
Settings, including the status line, permissions and model, in settings.json.
User-scope MCP servers. For the default folder these live in ~/.claude.json, which sits next to ~/.claude, not inside it. When CLAUDE_CONFIG_DIR is set, Claude Code writes them to .claude.json inside that folder instead. Easy to miss, and it matters later.
Your personal instructions, skills and agents: CLAUDE.md, skills/, agents/, commands/.
Session history under projects/, which is what --resume and --continue read.

So "a second account" is just "a second folder". Nothing is copied or patched, and your default setup isn't touched.

Step 1 on macOS and Linux: a folder and an alias

Pick a name. I'll use ~/.claude-work throughout; one folder per extra account works the same way (~/.claude-clientA, ~/.claude-personal).

Add this to ~/.zshrc (or ~/.bashrc):

# Default account: plain `claude`, ~/.claude
# Work account: `claude-work`, ~/.claude-work
alias claude-work='CLAUDE_CONFIG_DIR="$HOME/.claude-work" claude'

Open a new terminal and run it:

claude-work

Claude Code doesn't find a login in the new folder, so it walks you through first-run setup and opens the browser. Sign in with the other account. That's the only time you'll do it. From now on claude is one account and claude-work is the other, and you can have both running at once.

Check that it worked:

claude auth status
claude-work auth status

Each prints a small JSON block. Look at email and configDirectory: the first should show your default account and ~/.claude, the second your work account and ~/.claude-work. (auth status needs a recent Claude Code; run claude update if it isn't recognised.)

Don't point the variable at the default folder

It's tempting to make things symmetrical with a second alias, claude-personal='CLAUDE_CONFIG_DIR=~/.claude claude'. Don't. On macOS, setting the variable at all, even to the default path, makes Claude Code look for a different Keychain entry, so your personal account suddenly appears signed out. It's tracked as issue #92252. Leave your main account on plain claude with the variable unset, and give every extra account its own new folder.

Step 1 on Windows: PowerShell, cmd and Windows Terminal

The idea is the same, but PowerShell has no VAR=value command shorthand. If you just run $env:CLAUDE_CONFIG_DIR = ... and then claude, the variable stays set for every later command in that window, and the next plain claude is your work account too.

This function sets the variable for one call and puts it back afterwards, even if Claude Code exits with an error:

function claude-work {
  $prev = $env:CLAUDE_CONFIG_DIR
  $env:CLAUDE_CONFIG_DIR = Join-Path $HOME '.claude-work'
  try { claude @args } finally { $env:CLAUDE_CONFIG_DIR = $prev }
}

Put it in your profile so it's always there. notepad $PROFILE opens the file (create it if Notepad asks). Open a new PowerShell window, run claude-work, sign in with the second account, and check both with claude auth status and claude-work auth status as above. @args passes everything through, so claude-work --resume and claude-work mcp list work as you'd expect.

cmd.exe: quote the whole assignment, or cmd keeps the space before && as part of the folder name:

set "CLAUDE_CONFIG_DIR=%USERPROFILE%\.claude-work" && claude

This one does stay set for the rest of that cmd window, so use a dedicated window for it.

Windows Terminal profile. If you'd rather have a "Claude (work)" entry in the new-tab menu, open Settings, then Open JSON file, and add a profile to profiles.list:

{
  "name": "Claude (work)",
  "commandline": "powershell.exe -NoExit -Command \"$env:CLAUDE_CONFIG_DIR = Join-Path $HOME '.claude-work'; claude\"",
  "startingDirectory": "%USERPROFILE%",
  "tabTitle": "WORK"
}

The variable only exists inside that tab, so every other tab is untouched. -NoExit keeps the window open when you quit Claude Code, so you can start it again with the same account by typing claude.

Step 2: both accounts on screen at once

Once the folders exist, "side by side" is just two terminals.

tmux (macOS and Linux). One command, two panes, one account each:

tmux new-session -s claude 'claude' \; split-window -h 'CLAUDE_CONFIG_DIR="$HOME/.claude-work" claude'

Left pane: default account. Right pane: work. Each pane closes when you quit Claude Code in it.

iTerm2. Settings, Profiles, duplicate your profile and name it "Claude work". Under General, set Send text at start to export CLAUDE_CONFIG_DIR="$HOME/.claude-work", and put WORK in Badge, which draws a large faint label behind the text. Now split a pane with that profile (right-click a pane, Split Pane with Profile).

macOS Terminal. Settings, Profiles, duplicate a profile and name it "Claude work". On the Shell tab, tick Run command and Run inside shell, and enter CLAUDE_CONFIG_DIR="$HOME/.claude-work" claude. A new window with that profile opens straight into Claude Code on the work account. Give the profile a different background colour while you're there.

Windows Terminal. Hold Alt and click "Claude (work)" in the new-tab dropdown: it opens as a split pane next to the current one instead of a new tab. Alt+Shift+- and Alt+Shift+Plus split the current pane if you'd rather start from a plain shell.

Step 3: let the project folder pick the account

The alias works, but you still have to remember which one to type. If your work repos all live under one folder, let the folder decide.

direnv (macOS, Linux, WSL). Install it (direnv.net), hook it into your shell, then in the root of your work folder:

# ~/work/.envrc
export CLAUDE_CONFIG_DIR="$HOME/.claude-work"

Run direnv allow once. Now cd ~/work/anything sets the variable and leaving unsets it, so plain claude uses the right account in every repo below that folder. Add .envrc to your global gitignore if your repos are shared.

No direnv? A shell function does the same check every time you start Claude Code:

# ~/.zshrc or ~/.bashrc
claude() {
  case "$PWD/" in
    "$HOME/work/"*) CLAUDE_CONFIG_DIR="$HOME/.claude-work" command claude "$@" ;;
    *)              command claude "$@" ;;
  esac
}

command claude calls the real binary rather than the function again. Add one line per client folder if you have more than two accounts.

PowerShell can do the same inside the function from earlier:

function claude {
  $prev = $env:CLAUDE_CONFIG_DIR
  if ($PWD.Path -like (Join-Path $HOME 'work\*')) {
    $env:CLAUDE_CONFIG_DIR = Join-Path $HOME '.claude-work'
  }
  try { claude.exe @args } finally { $env:CLAUDE_CONFIG_DIR = $prev }
}

If claude.exe isn't found, check what Get-Command claude -All lists and call that name instead (npm installs a claude.cmd, so it's claude.cmd @args in that case).

VS Code and other editors

The Claude Code extension has a setting for environment variables, claudeCode.environmentVariables, and it would be the obvious place for CLAUDE_CONFIG_DIR. The catch: it's a machine-scoped setting. VS Code ignores it in a workspace's .vscode/settings.json, so you can't give one project the work account and another the personal one this way. Set it in your user settings and it applies to every window. If you do set it there, use an absolute path; ~ isn't expanded.

What does work per project is the integrated terminal. In the work project's .vscode/settings.json:

{
  "terminal.integrated.env.osx": { "CLAUDE_CONFIG_DIR": "/Users/you/.claude-work" },
  "terminal.integrated.env.linux": { "CLAUDE_CONFIG_DIR": "/home/you/.claude-work" },
  "terminal.integrated.env.windows": { "CLAUDE_CONFIG_DIR": "C:\\Users\\you\\.claude-work" }
}

New terminals in that window get the variable, and claude run there uses the work account. VS Code asks you to trust the workspace before it applies terminal environment settings. Cursor and Windsurf read the same keys. JetBrains IDEs have the same idea under Settings, Tools, Terminal, Environment variables.

Make the two accounts impossible to mix up

Two identical terminals with different accounts is a recipe for running the client job on your personal plan. Give the work folder a status line that says so. Create ~/.claude-work/statusline.sh:

#!/bin/sh
# Claude Code pipes session info as JSON on stdin; we only need a label.
cat > /dev/null
printf '\033[44;97m WORK \033[0m %s' "$(basename "$PWD")"

Make it executable (chmod +x ~/.claude-work/statusline.sh) and point the work folder's ~/.claude-work/settings.json at it:

{
  "statusLine": {
    "type": "command",
    "command": "~/.claude-work/statusline.sh"
  }
}

The default account keeps its own settings.json, so only the work sessions show the blue WORK tag. Combined with a coloured terminal profile or an iTerm2 badge, you can tell them apart from across the room. And when in doubt, /status inside a session shows the account it's signed in to.

What to share between accounts, and what never to share

A new folder starts empty: no CLAUDE.md, no skills, no agents. You probably want those to be the same everywhere. Symlink them:

ln -s ~/.claude/CLAUDE.md ~/.claude-work/CLAUDE.md
ln -s ~/.claude/skills    ~/.claude-work/skills
ln -s ~/.claude/agents    ~/.claude-work/agents
ln -s ~/.claude/commands  ~/.claude-work/commands

(On Windows, New-Item -ItemType SymbolicLink does the same, but needs Developer Mode or an admin prompt. Copying the files is fine too.)

Never share or symlink .credentials.json, .claude.json or the whole folder. Those hold the login and per-account state. Sharing them is how you end up with one account in both terminals, or each terminal signing the other one out.

MCP servers don't come along. User-scope servers live in the account's own .claude.json (see the diagram), so the work account starts with none. Add them again through the work alias:

claude-work mcp add --scope user --transport http notion https://mcp.notion.com/mcp
claude-work mcp list

Project-scope servers (a .mcp.json checked into the repo) are read from the repo, so they work for both accounts without doing anything.

Settings can be shared by symlinking settings.json, but most people want the work one to differ, at least for the status line above.

The gotchas that put both terminals on the same account

If both auth status calls show the same email, one of these is almost always why.

An API key in your shell profile. If ANTHROPIC_API_KEY is exported in ~/.zshrc or your Windows user environment, and you've approved it in Claude Code, it's used ahead of the subscription login in every folder. Both "accounts" are then billing the same API key. Unset it, or only set it in the one place you need it.
A long-lived token in the environment. claude setup-token prints an OAuth token for CI. If you export it as CLAUDE_CODE_OAUTH_TOKEN globally, it also wins over /login in every folder. Same fix.
The variable set to the default path. The macOS Keychain issue from Step 1.
Settings files can't set it. CLAUDE_CONFIG_DIR in a project's .claude/settings.json or settings.local.json is ignored, because Claude Code has already chosen the folder by the time it reads them. It has to come from the environment: the alias, direnv, the terminal profile.
Your company may force one organisation. Managed settings on a work laptop can include forceLoginOrgUUID, which only allows sign-ins to the company's organisation, in any folder. If your personal login is refused on the work machine, that's policy, not a bug. Ask IT rather than working around it.
/logout only signs out the folder you're in. That's the point, but it surprises people who expect it to sign out "Claude".

Running both accounts in CI

Same idea in a pipeline: one token per account. On your machine, run setup-token with each account's folder:

claude setup-token          # default account
claude-work setup-token     # work account

Store each token as a separate secret (CLAUDE_CODE_OAUTH_TOKEN_PERSONAL, CLAUDE_CODE_OAUTH_TOKEN_WORK) and map the right one to CLAUDE_CODE_OAUTH_TOKEN in each job. The runner never needs a config folder or a browser login.

What about Claude Desktop?

None of this applies to the Claude Desktop app. It ignores CLAUDE_CONFIG_DIR and signs in to one account at a time, including in its Code tab. To use two accounts there, you're back to signing out and in, or running a second copy of the app with its own profile, which is fiddly to set up by hand. That's the gap the next section is about.

The no-setup way: Claude Sessions Pro

This is the product section mentioned at the top.

I built Claude Sessions Pro because I wanted my accounts side by side in the desktop app as well as the terminal, without maintaining aliases and profiles on two operating systems.

One app per account on Mac, one window per account on Windows. Each is a full Claude Desktop session with its own login, chats and Code tab, open at the same time.
Claude Code in the terminal, per profile. Each profile has Open in Terminal, which starts claude with that profile's own config folder, and Copy Export Command if you'd rather paste the line into your own shell or script. It's the same CLAUDE_CONFIG_DIR approach from this post, just managed for you.

A usage meter for every account in the menu bar (Mac) or system tray (Windows), with an alert at 80% and 95% so a long session doesn't hit the limit by surprise.

It's for accounts you already have, not a way to get more usage: each account keeps its own limits, and Anthropic's terms apply to each one. It runs on macOS 14 or later and Windows 10 and 11, costs $15 once for two computers, and has a free one-hour preview and a 14-day refund. It's an independent app, not made by or affiliated with Anthropic.

Try Claude Sessions Pro free for an hour →

Troubleshooting

Symptom	Likely cause	Fix
`command not found: claude-work`	The alias or function isn't in the profile this shell reads	Check you added it to the right file (`~/.zshrc` vs `~/.bashrc`, or `$PROFILE`), then open a new terminal
`claude-work` asks you to sign in again	The folder path changed (a typo, or a relative path that depends on where you are)	Use `$HOME/...` or a full path, and compare `configDirectory` in `claude-work auth status`
Your main account looks signed out after setup	`CLAUDE_CONFIG_DIR` set to `~/.claude` (macOS)	Unset it; keep the main account on plain `claude`
Both terminals show the same email	`ANTHROPIC_API_KEY` or `CLAUDE_CODE_OAUTH_TOKEN` exported	Remove it from your shell profile or user environment
MCP tools missing in the work account	User-scope servers are per folder	Re-add with `claude-work mcp add --scope user ...`
Work account has no `CLAUDE.md` or skills	New folder starts empty	Symlink or copy them from `~/.claude`
PowerShell: every later `claude` is the work account	Variable set directly, not inside the function	Use the function with `try/finally`, or open a fresh window
VS Code workspace setting has no effect	`claudeCode.environmentVariables` is machine-scoped	Use `terminal.integrated.env.*` per workspace, or user settings
`--resume` doesn't show yesterday's session	It was started under the other account	Resume from the account (folder) you started it in

FAQ

Is running two accounts like this allowed?
You're signing in to two accounts you already have, one per folder, instead of signing out and back in. Each account is still bound by Anthropic's terms and its own plan limits. Don't use extra accounts to get around a limit.

Do the usage limits combine?
No. Each account has its own limits and its own usage, exactly as if you'd switched with /logout.

Can I run three or more?
Yes. One folder and one alias (or one direnv folder) per account.

Does it work in WSL?
Yes, the Linux instructions apply inside WSL. Note that WSL and Windows keep separate folders, so an account signed in on the Windows side isn't signed in inside WSL, and vice versa.

Will a Claude Code update break it?
CLAUDE_CONFIG_DIR is a documented setting, so it's been stable across updates. If something changes, claude auth status is the quickest way to see which folder a session is really using.

Can I move my existing history to the new account?
Session history is per folder. You can copy a project's folder from ~/.claude/projects/ to ~/.claude-work/projects/ to make it resumable there. Only do it when the conversation belongs with that account, for example work code moving to the work account.

Wrapping up

The whole trick is one environment variable: a folder per account, and a way to start Claude Code with the right one. An alias on macOS and Linux, a small function on Windows, direnv if you want it automatic, a status line so you never guess. The rest of this post is the edge cases that bite after the first day.

If you'd rather have it done for you, in the terminal and in Claude Desktop, Claude Sessions Pro is $15 once, with a free hour to try it. There are longer write-ups on running two Claude Code accounts in the terminal and switching Claude Code accounts on the site.

If you've hit a gotcha that isn't here, tell me in the comments and I'll add it.

Catching Android adware by behaviour instead of signatures

Sebastian Balog — Fri, 23 Oct 2026 22:40:30 +0000

Signature-based detection has an obvious weakness against adware: the families rebuild constantly. A new package name, a new signing key, a slightly different payload, and the app is "unknown" again. Meanwhile the user is still getting a full-screen ad every few minutes.

While building Impossible Adware Remover we ended up leaning on a much simpler signal: which app is putting windows on top of the screen, and how often.

The signal

An adware pop-up has to become the foreground window to be seen. On Android, an accessibility service receives window state changes along with the package name of the app that owns the new window. Most of those events are boring: the launcher, the app the user just tapped, the keyboard. Adware stands out because it takes the foreground when the user didn't ask for it, repeatedly, often right after unlock or on top of another app.

So the core logic isn't a database lookup. It's bookkeeping:

Track which package takes the foreground, and in what context (user launched it, or it appeared over something else).
Ignore the expected ones: launchers, the current foreground app's own windows, system UI, the keyboard.
When the same package keeps appearing over other apps without being launched, flag it. In practice about two pop-ups is enough.

Things that complicate it

Wrapper apps. Adware often lives inside an app that also does something useful, so the package name looks legitimate. Behaviour doesn't care what the app is called.
Delays. Many families wait days before the first ad, which defeats "uninstall what you installed today" advice but not a watcher that's always on.
Fighting back. Some adware throws windows over the uninstall dialog itself. We added a short-lived shield that keeps the system uninstall confirmation on top while the user decides.
Notification ads. Ads delivered as notifications are a different channel; there you can see which app posted, but not (and you shouldn't read) the content.

Privacy constraints we kept

The service only needs package names and timestamps. It never reads screen content, takes screenshots or performs taps, and it never uninstalls anything itself: it opens Android's own uninstall dialog and the user confirms.

Signatures still help

Behaviour catches the unknown; a signed list catches the known before they show a single ad. We publish ours openly: the Android adware list covers 470 apps from published campaigns plus 98 confirmed adware builds, with a JSON download for anyone who wants to use it.

Converting HEIC, WebP and AVIF to JPG without losing EXIF: where the metadata lives

Sebastian Balog — Fri, 23 Oct 2026 16:25:52 +0000

Most "convert this image to JPG" code looks like decode, then encode, and it works until someone notices that every converted photo now says it was taken today, has no location, and the portrait shots are lying on their side.

The reason is simple: image encoders encode pixels. SkiaSharp, System.Drawing, most Python one-liners: you hand them a bitmap, you get a JPG back, and the EXIF block, the XMP packet and the file's own timestamps are gone. If you want them in the output, you have to dig them out of the source container yourself and write them back.

I had to do exactly this for PlainJPG, a small Windows converter for WebP, HEIC and AVIF. Here's where the metadata actually sits in each format, and the three gotchas that cost me the most time.

WebP: RIFF chunks

A WebP file is a RIFF container: RIFF, a little-endian size, WEBP, then a flat list of chunks, each a FourCC plus a 4-byte little-endian length (padded to an even size).

EXIF holds a raw TIFF structure (starting II*\0 or MM\0*).
XMP (note the trailing space) holds the XMP packet.
VP8X is the extended header. Bit 0x10 of its first byte says the image has alpha, bit 0x02 says it's animated.

Walking the chunk list takes about twenty lines. The alpha flag is useful too: it's how you decide whether a WebP should become a PNG instead of a JPG.

HEIC and AVIF: items inside the `meta` box

HEIC and AVIF are both HEIF, which is ISO base media (the MP4 box format). Metadata isn't a chunk you stumble over; it's an item:

Find the top-level meta box (a FullBox, so skip 4 bytes of version and flags).
In iinf, list the items. EXIF is an item of type Exif. XMP is an item of type mime whose content type is application/rdf+xml.
In iloc, look up where each item's bytes are: one or more extents, either as absolute file offsets (construction method 0) or relative to the idat box (method 1).
Concatenate the extents.

Gotcha 1: the HEIF Exif item isn't bare TIFF. It starts with a 4-byte big-endian offset to the TIFF header, and some writers put Exif\0\0 in front of the TIFF as well. Skip the offset, skip the optional prefix, and only then do you have something you can drop into a JPEG.

Writing it back

JPEG. EXIF goes in an APP1 segment (FF E1, a 2-byte big-endian length, Exif\0\0, then the TIFF bytes). XMP goes in a second APP1 whose payload starts with http://ns.adobe.com/xap/1.0/\0. Insert them right after SOI, or after the JFIF APP0 if your encoder wrote one.

Gotcha 2: APP1 has a 64 KB ceiling. The length field is 16 bits and counts itself, so the payload can't exceed 65,533 bytes. Some phones embed large maker notes or thumbnails; if the block doesn't fit, you need a plan (skip it, or strip the thumbnail) rather than writing a corrupt file.

PNG. EXIF has its own chunk, eXIf, containing the TIFF bytes. XMP goes in an iTXt chunk with the keyword XML:com.adobe.xmp. Put both right after IHDR and compute each chunk's CRC over the type and data.

Gotcha 3: orientation, twice

Phones rarely rotate pixels. They store the sensor's orientation and set EXIF Orientation (1 to 8) so viewers rotate on display.

If your converter bakes the rotation into the pixels (sensible, because plenty of software ignores the tag), you must then set Orientation to 1 in the EXIF you copy across. Otherwise a viewer that honours the tag rotates the already-upright image again.

HEIF adds a twist: rotation and mirroring are container properties (irot and imir), and a decoder that follows the spec applies them, so the pixels it hands you are already display-oriented. iPhone HEICs usually also carry an EXIF Orientation value. Apply that one as well and every portrait photo ends up sideways. For HEIF, trust irot/imir and treat the EXIF tag as informational.

Don't forget the file's own dates

EXIF DateTimeOriginal is what photo apps sort by, but File Explorer sorts by the file system's created and modified times, and a new file gets "now". After writing the output, copy them over:

File.SetLastWriteTimeUtc(target, File.GetLastWriteTimeUtc(source));
File.SetCreationTimeUtc(target, File.GetCreationTimeUtc(source));

A quick check

After converting, open the JPG's Properties, then Details in Windows. If "Date taken" is filled in and portrait photos stand upright in both Photos and a browser, the EXIF made it across and the orientation was handled once, not twice.

If you'd rather not write any of this, PlainJPG does it for whole folders of WebP, HEIC and AVIF on Windows, offline. There's also a plain-English guide to batch converting HEIC to JPG on Windows for the non-developers in your life who keep sending you .heic files.

Two Codex accounts on Windows: CODEX_HOME in PowerShell, cmd and Windows Terminal

Sebastian Balog — Wed, 21 Oct 2026 18:48:31 +0000

Disclosure up front: I build Sessions Pro for Codex, a paid app that does this for the desktop app too. Everything up to the last section is free and needs nothing but the commands below.

Most guides for running two Codex accounts are written for macOS and Linux: export CODEX_HOME=..., an alias in ~/.zshrc, done. On Windows the idea is the same, but the syntax isn't, and there are a few Windows-only details worth knowing. All the commands here were run on Windows 11.

How Codex decides which account you're signed in to

The Codex CLI doesn't keep a login per terminal window. It keeps one login per folder: CODEX_HOME. On Windows that's %USERPROFILE%\.codex unless you set the variable. The folder holds:

auth.json: the login
config.toml: your settings, including MCP servers
your session history and threads

One folder, one account. Point CODEX_HOME at a second folder, sign in there once, and that folder stays signed in to the second account.

The ChatGPT desktop app from the Microsoft Store (its package is called OpenAI.Codex) uses the same %USERPROFILE%\.codex for its Codex data. So by default, codex in your terminal and Codex in the app share one login. Keep that in mind for codex logout, below. ChatGPT's built-in account switcher doesn't change this either: it only works on the web version, which doesn't help if you build real projects in the desktop app, and it doesn't touch the CLI's login.

Which codex are you running?

If you installed the CLI yourself (for example with npm install -g @openai/codex), codex is on your PATH. The Store app also ships its own codex.exe inside its package folder, and you can find it from PowerShell:

Join-Path (Get-AppxPackage OpenAI.Codex).InstallLocation 'app\resources\codex.exe'

Either one reads CODEX_HOME the same way.

PowerShell

Create the folder first. Codex won't create it for you:

New-Item -ItemType Directory -Force "$HOME\.codex-work" | Out-Null

Then start Codex pointed at it:

$env:CODEX_HOME = "$HOME\.codex-work"
codex

Sign in with your second account. From now on, any codex started from this PowerShell window uses .codex-work. Open a new window and plain codex is back on your first account.

To check where you stand before doing anything:

$env:CODEX_HOME        # empty means the default %USERPROFILE%\.codex
codex login status     # "Logged in using ChatGPT" or "Not logged in"

If you forget to create the folder, Codex stops with:

Error loading configuration: CODEX_HOME points to "C:\\Users\\you\\.codex-work", but that path does not exist

Make it one word

Add a function to your PowerShell profile (notepad $PROFILE, create the file if it doesn't exist):

function codex-work {
    $previous = $env:CODEX_HOME
    $env:CODEX_HOME = "$HOME\.codex-work"
    try { codex @args } finally { $env:CODEX_HOME = $previous }
}

codex-work now runs Codex in the work account and puts the window back the way it was afterwards, so a later plain codex in the same window still uses your first account. Add one function per account.

cmd

In Command Prompt, set the variable for the session, then run Codex:

mkdir "%USERPROFILE%\.codex-work"
set "CODEX_HOME=%USERPROFILE%\.codex-work"
codex

Use the quoted form of set. Without quotes, set CODEX_HOME=... && codex stores the space before && as part of the value. Codex happened to cope with that in my tests, but a variable with an invisible trailing space is the kind of thing that breaks something else later.

A Windows Terminal profile per account

Windows Terminal makes this tidy: one profile per account, each opening already pointed at the right folder. In Settings, add a new profile and set its Command line to:

powershell.exe -NoExit -Command "$env:CODEX_HOME = Join-Path $HOME '.codex-work'; codex"

Name it something like "Codex (work)" and give it its own tab color, so you can tell at a glance which account a tab is using.

Don't set it permanently

It's tempting to run setx CODEX_HOME ... and be done. Don't: a user-level variable is inherited by every program you start afterwards, so every codex would use that folder and you'd be back to one account, just a different one. Set CODEX_HOME per window, per function or per Terminal profile instead.

What about WSL?

Inside WSL, ~ is your Linux home, not your Windows one. So codex running in WSL uses ~/.codex on the Linux side, a different folder from the Windows %USERPROFILE%\.codex. That makes WSL a second, separate login by accident. It's fine if you want it, confusing if you don't. The same CODEX_HOME trick works there with the usual export syntax.

`codex logout` and the shared folder

codex logout removes the login from the current CODEX_HOME. If that's the default folder, every codex reading it is signed out at once, and by default that includes Codex in the desktop app. With one folder per account, logging out of one leaves the others alone.

What to copy between folders

Copy config.toml if you want the same settings and MCP servers in both accounts: Copy-Item "$HOME\.codex\config.toml" "$HOME\.codex-work\"
Don't copy auth.json. That's the login. Copying it puts your first account into the second folder.
Leave history alone. Each folder keeps its own sessions, which is the point.

The desktop app is the hard part

CODEX_HOME only separates the command line. The ChatGPT desktop app keeps using its own data and %USERPROFILE%\.codex, so it still holds one account at a time.

On a Mac you can make a second copy of the app with its own data folder. On Windows the app comes from the Microsoft Store and lives in a protected package folder, so that route isn't really open. The free option on Windows is a second Windows user account: each user gets their own app data and their own .codex, and both can stay signed in if you switch users instead of signing out. It works well when two people share a PC, and it's clumsy for one person flipping between work and personal all day.

That gap is what Sessions Pro for Codex fills. Each account gets its own profile that runs the ChatGPT app you already have in its own window, with its own login, chats, Codex threads and settings, and its own taskbar button, title and color. The "Codex CLI in Terminal" button opens a terminal with that profile's own CODEX_HOME, so the command line is signed in to the same account as the window. It's $24.99 once, for two computers (Mac or PC), with a free 1-hour preview, and needs Windows 10 or 11 with the ChatGPT app from the Microsoft Store.

For the command line alone, though, everything above is free. One folder per account, one function or Terminal profile per folder, and you'll stop signing out to switch.

How to run multiple Claude accounts at once (Desktop + Claude Code), and why the obvious hacks break

Sebastian Balog — Mon, 12 Oct 2026 23:52:50 +0000

Disclosure up front: I build Claude Sessions Pro, a paid app for Mac and Windows that does this. Most of this post is the free way to do it yourself, plus what I learned about why the DIY versions misbehave. The app gets one short section near the end.

If you have a company Claude account and a personal one, or one account per client, you've hit this: Claude Desktop is signed in to one account. To check the other one, you sign out, sign in, lose your place, and do it again an hour later.

Claude Code in the terminal has the same problem, just with a different config folder.

Here's how to fix it, from "free, two lines of shell" to "one click", and the gotchas nobody mentions until you've already set it up.

TL;DR

You want	Do this
Two Claude Code (CLI) accounts	`CLAUDE_CONFIG_DIR=~/.claude-work claude` for the second one
Two Claude Desktop windows, free	Start a second copy with `--user-data-dir` (commands below)
Separate Dock icons, ‚åò-Tab, Google sign-in that lands in the right window, survives updates	You need each account to be its own app, not just its own folder (see "Why the hacks break")

Why Claude Desktop can only hold one login

Claude Desktop is an Electron app, so it's Chromium underneath. Everything for the signed-in account (session cookies, settings, connectors, MCP config, the list of Claude Code sessions) lives in one user data directory:

macOS: ~/Library/Application Support/Claude
Windows: %APPDATA%\Claude (the Microsoft Store version redirects this into its package folder, under %LOCALAPPDATA%\Packages\Claude_‚Ä¶\LocalCache\Roaming\Claude)

One folder, one cookie jar, one login. Signing in to account B overwrites account A's session.

Your chats aren't lost when you switch; they live in your account on Anthropic's side. What you lose is time, context, and the ability to see both at once.

So every working solution comes down to the same idea: give each account its own data directory.

Claude Code (CLI): one environment variable

The CLI is the easy part. It reads its login and settings from a config directory, which you can override:

# second account, one-off
CLAUDE_CONFIG_DIR=~/.claude-work claude

Make it permanent with an alias in ~/.zshrc or ~/.bashrc:

alias claude-work='CLAUDE_CONFIG_DIR="$HOME/.claude-work" claude'
alias claude-personal='CLAUDE_CONFIG_DIR="$HOME/.claude-personal" claude'

Run claude-work once, log in with the work account, done. Each folder keeps its own login, history and settings. This works the same on macOS, Linux and Windows (in PowerShell: $env:CLAUDE_CONFIG_DIR="$HOME\.claude-work"; claude).

For the full Claude Code setup, with Windows Terminal profiles, tmux splits, VS Code, an account per project folder and the gotchas that quietly put both terminals on the same login, see Run two Claude Code accounts side by side without logging out.

Claude Desktop on macOS: a second copy, for free

Chromium apps accept --user-data-dir, and Claude Desktop honors it. This starts a second, independent Claude next to your normal one:

open -n -a Claude --args --user-data-dir="$HOME/Library/Application Support/Claude-Work"

-n opens a new instance even though Claude is already running.
Everything after --args goes to Claude itself.

# ~/.zshrc
claude-profile() {
  local name="${1:?usage: claude-profile <name>}"
  open -n -a Claude --args --user-data-dir="$HOME/Library/Application Support/Claude-$name"
}

claude-profile Work
claude-profile ClientA

Want it clickable? Open Script Editor, paste do shell script "open -n -a Claude --args --user-data-dir=$HOME/Library/Application\\ Support/Claude-Work", then File ‚Üí Export ‚Üí File Format: Application. Drop it in the Dock.

That's the whole free method, and for a lot of people it's enough. Now the part the copy-paste guides skip.

Why the hacks break (the interesting part)

All of these come from one fact: to the operating system, both windows are still the same app.

1. One Dock icon, one ‚åò-Tab entry

macOS groups windows by bundle identifier (com.anthropic.claudefordesktop). Your two instances share it, so they share a Dock icon, a name, and a single ‚åò-Tab slot. You can't tell which window is which account without looking inside it.

A Script Editor launcher doesn't fix this. The launcher is its own app, but the Claude window it opens still belongs to Claude.

2. Google sign-in comes back to the wrong window

This one costs people the most time. When you click Continue with Google, Claude opens your browser. After you log in, the browser hands the result back through a claude:// link.

The OS routes that link to the app registered for claude://, not to the specific window that started the login. With two instances of the same app, the link goes to whichever instance the OS picks, usually the first one. So you sign in to your work account and it lands in your personal window, or nowhere useful.

On Windows it's even more deterministic. Chromium's single-instance logic means a new launch first checks for a lock file in the default data folder; if that instance is running, the link gets forwarded to it. So the default Claude window always wins.

Workarounds: use email sign-in for the extra profiles, or quit every other Claude window while you sign in to the new one.

3. Claude Code sessions don't follow you

The Code tab in Claude Desktop lists sessions from the data directory it's using. A fresh Claude-Work folder starts empty, even if that account has sessions in your main Claude. They aren't gone; they're in the other folder. You'd have to copy the right ones over by hand.

4. "Just copy Claude.app and rename it" doesn't survive updates

The natural next step is duplicating Claude.app, changing its bundle ID and name in Info.plist, and re-signing it, so each account really is a separate app with its own Dock icon. That does fix #1.

But Claude updates itself, and an update can bring back the original bundle or leave you with a copy that's stuck on an old version. Then you're redoing the copy, re-signing, and re-pointing it at the right data folder after every Claude release.

Claude Desktop on Windows: the same trick

Claude for Windows installs through the Microsoft Store, with a command alias you can call directly. In PowerShell:

Start-Process "$env:LOCALAPPDATA\Microsoft\WindowsApps\claude-desktop.exe" `
  -ArgumentList "--user-data-dir=`"$env:USERPROFILE\ClaudeProfiles\Work`""

Same rules as on the Mac: each --user-data-dir is a separate login. And the same gotchas apply:

All windows share one taskbar icon and the title "Claude".
Google sign-in returns to the default Claude window (see #2), so sign in to extra profiles with email, or close the main Claude first.
If Claude's own "start with Windows" setting is on, the default instance is always running and always catches the sign-in.

The other options, briefly

A second browser profile with claude.ai. Totally fine for chatting. You lose the desktop-only features for that account: the Code tab, local MCP servers and desktop connectors.
A second OS user account. Fully isolated, including Claude Code. But you only see one user's desktop at a time, and none of your files or apps come along.
Sign out and back in. Free and built in. Fine weekly, painful hourly.
Apps that do it for you. Parall (a general launcher for many apps, $9.99 in the Mac App Store), Multi-Claude ($20) and Claude Sessions Pro ($15) all turn each account into its own app.

What I built

I got tired of doing all of the above by hand, so I built Claude Sessions Pro for macOS and Windows. On a Mac it makes each account a real, separate Mac app built from your installed Claude, which is what fixes the gotchas above:

Own app per account: "Claude Work", "Claude Personal", each with a colored letter badge on its Dock icon and its own ‚åò-Tab spot.
Google sign-in works with the other accounts still open, and returns to the profile that asked for it.
Claude Code sessions and pins come along: sessions from your main Claude move into the matching account's profile, and the CLI opens per profile with its own CLAUDE_CONFIG_DIR.
Survives Claude updates: when Claude updates, each profile app is rebuilt from the new version the next time it isn't running. Logins and data stay put.
Menu bar switcher to open or switch accounts.

It's $15 one-time for up to 2 computers, with a 1-hour free preview that starts once you've signed in to a profile. I'd rather you see it working with your own accounts before paying.

It runs on Windows too. Same idea, built for Windows' quirks: each account opens in its own Claude window labeled with the account name, and Google sign-in is routed back to the window that started it. It works on Windows 10 and 11, and one license covers 2 computers, Mac or PC.

Here's the full comparison table with every method: How to run multiple Claude accounts on one Mac.

A one-page overview is also on Google Sites: Claude Sessions Pro.

Is this allowed?

Plenty of people have legitimate separate accounts: a company Team account plus a personal Pro one, or one per client. Everything above runs the official Claude app and doesn't change how Claude works.

But Anthropic's terms apply to each account. Creating extra accounts specifically to dodge usage limits is the kind of thing that gets accounts suspended. Read the Consumer Terms and Usage Policy, and only use accounts you're allowed to use.

If you've found another approach (or another gotcha), drop it in the comments. I'm especially curious how people handle this on Linux, where Claude Desktop isn't official.

Stop Instagram and TikTok labelling your Photoshop and Premiere exports as AI

Sebastian Balog — Mon, 05 Oct 2026 01:58:20 +0000

Quick fix: the label comes from Content Credentials (C2PA) that Photoshop and Premiere Pro write into your export after a generative edit, and export settings don't switch them off. Check every file as it lands in your export folder and remove those credentials before posting: below is a free script that does it, and an app that does it for you on Mac and Windows.

Why your exports get labelled

If you edit for clients or post every day, the "AI info" problem isn't one photo. It's every export. One Generative Fill in Photoshop or two seconds of Generative Extend in Premiere Pro, and the file you deliver carries Content Credentials (C2PA) that Instagram, Facebook, TikTok, YouTube and LinkedIn read and turn into a label.

Adobe's own FAQ says that when its generative tools create or modify content, C2PA metadata is attached automatically and can't be switched off for that content. Photoshop's Export As → Metadata: None controls camera and copyright info, not that record. So the dependable place to check is the exported file, right after it lands in your export folder.

Here's how to automate that check yourself, and the gotchas that make it harder than it looks.

What to look for

Two markers do almost all the labelling:

C2PA manifest: JUMBF boxes labelled c2pa (in JPEG they sit in APP11 segments; in MP4/MOV in a top-level uuid box).
IPTC digital source type: Iptc4xmpExt:DigitalSourceType set to trainedAlgorithmicMedia or compositeWithTrainedAlgorithmicMedia.

A quick check for one file:

c2patool "export.jpg" >/dev/null 2>&1 && echo "C2PA manifest present"
exiftool -q -q -if '$XMP-iptcExt:DigitalSourceType =~ /TrainedAlgorithmic/i' -p '$FileName: AI source tag' "export.jpg"

A DIY watcher (macOS, fswatch)

#!/usr/bin/env bash
# watch-exports.sh: flag new exports that carry AI metadata
# needs: brew install fswatch exiftool c2patool
DIR="${1:-$HOME/Exports}"

settled() {               # wait until the editor has finished writing
  local f="$1" a b
  while :; do
    a=$(stat -f %z "$f" 2>/dev/null) || return 1
    sleep 2
    b=$(stat -f %z "$f" 2>/dev/null) || return 1
    [[ "$a" == "$b" ]] && return 0
  done
}

check() {
  local f="$1" hits=()
  c2patool "$f" >/dev/null 2>&1 && hits+=("C2PA")
  exiftool -q -q -if '$XMP-iptcExt:DigitalSourceType =~ /TrainedAlgorithmic/i' -p x "$f" | grep -q x && hits+=("IPTC AI tag")
  if ((${#hits[@]})); then
    osascript -e "display notification \"${hits[*]}\" with title \"AI metadata: $(basename "$f")\""
  fi
}

fswatch -0 -r -e '.*' -i '\.(jpe?g|png|mp4|mov)$' --event Created --event Updated "$DIR" |
while IFS= read -r -d '' f; do
  [[ "$(basename "$f")" == clean_* ]] && continue
  settled "$f" && check "$f"
done

It works, and it's a good way to see how often your exports actually carry these markers. The parts that take the most care:

"Finished writing" is the hard part. Premiere and Media Encoder write large files over minutes; Photoshop writes a temp file and renames it. The size-stable loop above is the simplest heuristic; a render that pauses mid-write can still fool it.
Recursion and noise. Editors create sidecar and cache files; filter by extension and ignore your own clean_ outputs or you'll loop.
Cleaning without damage. The naive exiftool -all= also deletes the colour profile and orientation. Use exiftool -all= -tagsfromfile @ -icc_profile -orientation file.jpg for photos, and a stream-copy remux for video: ffmpeg -i in.mp4 -map 0 -c copy -map_metadata -1 out.mp4.
Verifying. Re-run the checks on the output (c2patool should say No claim found), and for video compare ffmpeg -f streamhash of input and output.
Windows. No fswatch; you'd rebuild this around PowerShell's FileSystemWatcher.

The app version

I got tired of maintaining scripts like this, so it became a feature in MetaClean, my Mac and Windows metadata app. Watch Folders runs in the background on your export folders, subfolders included. Every new JPG, PNG, MP4 or MOV is checked once it has finished saving, whether it came from Photoshop, Lightroom, Premiere Pro or Media Encoder, CapCut or was just copied in. Files without AI metadata never interrupt you. When one carries Content Credentials or an AI-origin tag, a compact prompt lists what was found, and Clean saves a verified clean_ copy next to the original: no re-encoding, colour profile and orientation kept, video streams copied as they are. For existing archives there's a batch mode for whole folders. Everything stays on your machine. 3-day free trial, then $5 once.

Disclosure: I'm the developer of MetaClean.

TL;DR

Generative edits in Photoshop and Premiere attach C2PA automatically; export settings don't remove it.
Check exports with c2patool and the IPTC DigitalSourceType tag.
Automate with a folder watcher, but handle "file finished", recursion, safe cleaning and verification.
Or let MetaClean's Watch Folders do it on Mac and Windows.

How to remove the "AI-generated" label from your TikTok videos (CapCut fix)

Sebastian Balog — Mon, 05 Oct 2026 01:57:49 +0000

Quick fix: TikTok reads AI metadata inside the MP4, not your footage. Delete the labelled post, strip the metadata from your original export with one ffmpeg command (below, no re-encoding) or with MetaClean, and repost the clean copy with the AI-generated content switch off.

Here's why it happens, how to see it in your own files, and how to prove the fix didn't touch quality.

Why your real video got labelled

You film something yourself, add one AI effect in CapCut, export, post, and TikTok puts "AI-generated" on it. The footage is yours. The label disagrees.

Like Instagram's "AI info", TikTok's automatic label is mostly a metadata decision. TikTok has said it reads Content Credentials (C2PA) to label AI content automatically, and editing apps write AI markers into the files they export after an AI feature is used. So the useful question isn't "what does the video look like?" but "what does the MP4 say about itself?"

Where the label comes from

TikTok adds "AI-generated" in two ways:

You switch it on in the post settings ("AI-generated content").
Automatically, when the uploaded file carries AI metadata.

The second one is the surprise. Typical sources:

App or feature	What you did	What ends up in the file
CapCut AI features	AI effects, enhancements, generated elements	AI metadata in the export
Premiere Pro Generative Extend	Stretched a clip by a few frames	C2PA Content Credentials
AI video generators	B-roll, backgrounds, intros	C2PA Content Credentials
AI upscalers / enhancers	Sharpen, stabilise, upscale	C2PA or IPTC, depending on the app

One AI touch is enough for the whole video, because the note describes the file, not the frame.

Look inside the MP4

An MP4 is a tree of boxes (atoms). Regular metadata lives in moov/udta and meta; a C2PA manifest is stored as its own JUMBF payload in a top-level uuid box, next to the audio and video data rather than inside it. That's why the usual "Properties → Details" view doesn't show it.

Dump everything ExifTool can see, grouped by where it lives:

exiftool -a -G1 -s clip.mp4

Look for the encoder and creation tool (Encoder, Software, HandlerVendorID), any XMP block, and anything mentioning AI, AIGC or C2PA:

exiftool -a -G1 -s clip.mp4 | grep -iE 'c2pa|jumd|aigc|digitalsource|encoder|software'

For the signed manifest itself, the official c2patool reads MP4 and MOV directly:

c2patool clip.mp4
# prints the manifest: claim generator, actions, digitalSourceType...
# or "No claim found" if there is none

And while you're in there, check the stuff you probably didn't mean to share: phones write a recording location and the device model into the udta atoms.

exiftool -GPSCoordinates -Model -Make -CreationDate clip.mp4

Removing it without re-encoding

Re-exporting the video to "shake off" metadata costs quality and often writes the same markers again. The clean way is a remux: copy the existing video and audio streams into a new container and leave the metadata boxes behind.

ffmpeg -i clip.mp4 -map 0 -c copy -map_metadata -1 -movflags +faststart clean.mp4

-c copy means no decoding and no re-encoding: same frames, same bitrate.
-map_metadata -1 drops the global metadata (including the location and device atoms).
The C2PA uuid box isn't carried over by the remux.
+faststart moves the index to the front, which upload pipelines like.

Then prove it, because a clean-looking command isn't proof:

c2patool clean.mp4                    # should say: No claim found
exiftool -a -G1 -s clean.mp4 | grep -iE 'c2pa|jumd|aigc|gps'   # should print nothing

# and the streams are bit-for-bit identical:
ffmpeg -loglevel error -i clip.mp4  -map 0 -c copy -f streamhash -hash sha256 -
ffmpeg -loglevel error -i clean.mp4 -map 0 -c copy -f streamhash -hash sha256 -

If the two streamhash outputs match, the picture and sound are exactly what you exported.

Then repost: delete the labelled post (copy the caption and note the sound first), upload clean.mp4, and leave the AI-generated content switch off.

If you export from CapCut every day

Doing this per clip gets old fast. I built MetaClean for that: a Mac and Windows app that shows every piece of metadata in a video (or photo) in plain words, removes the AI markers, or location and device details too, and saves a verified clean_ copy next to the original, using the same stream-copy approach as above. Its Watch Folders mode sits on your CapCut export folder (subfolders included) and only pops up when a new export actually carries AI metadata: one click and the clean copy is ready to post. Everything runs locally; nothing is uploaded. 3-day free trial, then $5 once.

Disclosure: I'm the developer of MetaClean.

TL;DR

TikTok's automatic "AI-generated" label is read from the file's metadata, including C2PA Content Credentials.
See it: c2patool clip.mp4 and exiftool -a -G1 -s clip.mp4.
Remove it without touching quality: ffmpeg -i clip.mp4 -map 0 -c copy -map_metadata -1 clean.mp4, then verify with c2patool and streamhash.
Full TikTok walkthrough: How to remove the AI-generated label on TikTok.

Why Instagram labels your real photo "AI info" (and how to see the metadata behind it)

Sebastian Balog — Sat, 26 Sep 2026 20:46:48 +0000

You take a real photo, remove a stray object with a generative fill tool, post it, and Instagram adds "AI info" under your name. The picture is 99% camera, but the label says otherwise.

The label usually isn't about the pixels. It's about metadata the editing tool wrote into the file. Once you know where it lives, you can see it in seconds, and remove it without touching the image.

What the platforms read

Meta has said it labels images using industry-standard signals in the file. Two of them do most of the work:

1. C2PA Content Credentials. A signed manifest embedded in the file (in a JPEG it sits in APP11 segments as JUMBF boxes). It records which app made or edited the image and what it did: c2pa.opened, c2pa.edited, and, for AI tools, a digitalSourceType saying generative AI was involved. Photoshop, Firefly, ChatGPT's image generation and a growing list of phones and cameras write it.

2. The IPTC digital source type. A single XMP field, Iptc4xmpExt:DigitalSourceType, whose value is a URL from the IPTC vocabulary. The two that matter:

trainedAlgorithmicMedia: made with generative AI
compositeWithTrainedAlgorithmicMedia: edited with generative AI (your generative-fill case)

Either one is enough to earn the label.

See it in your own files

With ExifTool installed:

# The IPTC AI tag
exiftool -XMP-iptcExt:DigitalSourceType photo.jpg
# Digital Source Type : http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMedia

# Is there a C2PA manifest? (JUMBF boxes labelled c2pa)
exiftool -a -JUMDLabel photo.jpg
# JUMD Label : c2pa
# JUMD Label : urn:c2pa:060ce687-...
# JUMD Label : c2pa.assertions

For the full, human-readable manifest (signer, actions, validation state), use the official c2patool:

c2patool photo.jpg

While you're in there, check what else the file carries. Most phones add GPS once the camera has location access:

exiftool -GPSPosition -Model -SerialNumber photo.jpg

No command line handy? I built a free in-browser EXIF and C2PA viewer that reads all of this, including the prompts Stable Diffusion and ComfyUI hide in PNGs. The file is read locally and never uploaded; switch off your Wi-Fi after the page loads and it still works.

Removing it (and the gotcha that bites everyone)

The classic one-liner does remove the C2PA manifest, the IPTC tag and your GPS:

exiftool -all= photo.jpg

But run it on a photo from a phone and look closely:

Warning: ICC_Profile deleted. Image colors may be affected - photo.jpg

-all= also deletes the colour profile and the orientation flag. iPhone photos are usually Display P3, so they come out duller, and portrait shots can come out sideways. The fix is to copy those two back from the original in the same command:

exiftool -all= -tagsfromfile @ -icc_profile -orientation photo.jpg

I tested both on a C2PA-signed, Display P3, rotated JPEG: the second command removed the manifest (c2patool reports No claim found), the IPTC tag and the GPS, kept the profile and rotation, and left the decoded pixels identical.

Then check your result, because a clean-looking command isn't proof:

exiftool -a -JUMDLabel -XMP-iptcExt:DigitalSourceType -GPSPosition photo.jpg   # should print nothing
c2patool photo.jpg                                                             # should say No claim found

If the label is already on a post, removing the metadata from your file isn't enough on its own: Instagram keeps the label on what it already published. I wrote up the full repost routine for feed posts, Reels, Stories and Facebook (including saving your caption first) in How to remove AI info from Instagram posts.

Doing this for a whole camera roll

For one JPEG, the ExifTool commands above are all you need. For folders full of photos and videos (where metadata lives in QuickTime atoms and its own C2PA box), I made MetaClean, a Mac and Windows app that does the whole thing offline. It bundles pinned versions of ExifTool, c2patool and FFmpeg, never re-encodes (video is remuxed with stream copy), keeps colour profiles and orientation, and re-inspects every output before saving it as clean_<name>, leaving the original untouched. There's a 3-day free trial, then it's $5 once.

Disclosure: I'm the developer of MetaClean and the viewer linked above.

TL;DR

"AI info" on a real photo usually comes from C2PA Content Credentials or the IPTC DigitalSourceType tag, not from the pixels.
See them: exiftool -XMP-iptcExt:DigitalSourceType -a -JUMDLabel photo.jpg, or c2patool photo.jpg.
Remove them without breaking the photo: exiftool -all= -tagsfromfile @ -icc_profile -orientation photo.jpg, then verify.
Already labelled? See how to remove AI info from Instagram.

DEV Community: Sebastian Balog

How to Run Multiple Cursor Accounts at Once on Mac and Windows

Can you have two Cursor accounts?

What decides which account Cursor uses

Free method on a Mac: run two instances of Cursor with --user-data-dir

Free method on Windows: the same options in PowerShell

Keep each account's agent data apart too

Where the do-it-yourself way breaks

The ways to switch Cursor accounts, compared

An app that does it for you

FAQ

Two ChatGPT accounts in the desktop app on a Mac (and keeping their Codex threads apart)

What decides which account the app uses

Free method 1: a second copy of the app from Terminal

Free method 2: just the Codex CLI, with CODEX_HOME

Other options, briefly

What I ended up building

Run two Claude Code accounts side by side without logging out (Mac, Windows, VS Code)

TL;DR

How Claude Code decides which account you're on

Step 1 on macOS and Linux: a folder and an alias

Don't point the variable at the default folder

Step 1 on Windows: PowerShell, cmd and Windows Terminal

Step 2: both accounts on screen at once

Step 3: let the project folder pick the account

VS Code and other editors

Make the two accounts impossible to mix up

What to share between accounts, and what never to share

The gotchas that put both terminals on the same account

Running both accounts in CI

What about Claude Desktop?

The no-setup way: Claude Sessions Pro

Troubleshooting

FAQ

Wrapping up

Catching Android adware by behaviour instead of signatures

The signal

Things that complicate it

Privacy constraints we kept

Signatures still help

Converting HEIC, WebP and AVIF to JPG without losing EXIF: where the metadata lives

WebP: RIFF chunks

HEIC and AVIF: items inside the meta box

Writing it back

Gotcha 3: orientation, twice

Don't forget the file's own dates

A quick check

Two Codex accounts on Windows: CODEX_HOME in PowerShell, cmd and Windows Terminal

How Codex decides which account you're signed in to

Which codex are you running?

PowerShell

Make it one word

cmd

A Windows Terminal profile per account

Don't set it permanently

What about WSL?

codex logout and the shared folder

What to copy between folders

The desktop app is the hard part

How to run multiple Claude accounts at once (Desktop + Claude Code), and why the obvious hacks break

TL;DR

Why Claude Desktop can only hold one login

Claude Code (CLI): one environment variable

Claude Desktop on macOS: a second copy, for free

Why the hacks break (the interesting part)

1. One Dock icon, one ‚åò-Tab entry

2. Google sign-in comes back to the wrong window

3. Claude Code sessions don't follow you

4. "Just copy Claude.app and rename it" doesn't survive updates

Claude Desktop on Windows: the same trick

The other options, briefly

What I built

Is this allowed?

Stop Instagram and TikTok labelling your Photoshop and Premiere exports as AI

Why your exports get labelled

What to look for

A DIY watcher (macOS, fswatch)

The app version

TL;DR

How to remove the "AI-generated" label from your TikTok videos (CapCut fix)

Free method 2: just the Codex CLI, with `CODEX_HOME`

HEIC and AVIF: items inside the `meta` box

`codex logout` and the shared folder