All Ways of Cloning Instagram on iPhones

I often see questions about running multiple Instagram accounts on one iPhone. The obvious answer is "use in-app multi-accounting, which allows up to 5 accounts per app". People who run IG at scale know perfectly well that it’s a bad approach. Do smth wrong on one account – and trigger a cascade ban of all accounts.

I want to talk about the ways to keep accounts truly independent. With different IPs, different locations, and different fingerprints.

I have never seen a single public guide about this. Everyone has their own method, even though most of them fall into one of a few categories. In this post I want to structure information that I collected bit by bit for several years in this industry.

Contents:

1. Directions
2. Cloning Isn't Enough
3. Methods
4. Conclusion

---

1. Directions​

So basically there are 3 directions to choose from.

• Factory reset
• Containerization
• Cloning

Factory reset: it's the simplest one and completely legitimate. Use one account per iPhone. After you finish working with an account (e.g. it gets banned) do factory reset of the iPhone. It will reset all identifiers available to the apps. Create new iCloud account after factory reset, because CloudKit provides userRecordID which can link your new IG account to the old one. Or don't log in to iCloud at all.

• Pros: legitimate, free, zero setup
• Cons: only 1 account per iPhone = high hardware costs

Containerization: official IG apps being made to run inside "containers" – so-called "sandboxes", where the apps think they're in normal iOS, while in fact they're inside virtual environments. Containers can exist only on iPhones (not on PC or Mac), because they still need iOS features. Don't mistake them with emulators – they're not the same. There can be as many containers per iPhone as you want, each one with a separate IG app, with isolated data and keychain entries.

• Pros: unlimited accounts, you work with untouched IG apps
• Cons: requires heavy setup, container app & tweaks are separate

Cloning: you obtain your own apps, which are complete copies of IG, but with different bundle IDs and keychain entries. Of course, IG has their own protection. But since you own the app, you can spoof bundle ID checker and other identifiers.

• Pros: unlimited accounts, easy setup
• Cons: you need a reliable cloning service, where developers know their job very well

2. Cloning Isn’t Enough​

Many warriors have fallen because they've managed to figure out containerization / cloning, but they didn't take care of these things:

• Public IP
• Jailbreak detection
• Device IDs spoofing
• Device model spoofing

Public IP is handled with proxies / SIM with IP rotation. Has to be different for each account.
Jailbreak – honestly today there's no robust way to hide it. My conclusion is that it's better to avoid methods that require jailbreak. I still include them here for the full picture.
Device IDs include serial, UDID, IDFV, IDFA, FDID, ECID, IOPlatformUUID, etc. They are the most important parts of a fingerprint. Others are hardware (model, board, chip, RAM, CPU, GPU, screen, etc.), network (Wi-Fi MAC, Wi-Fi SSID, local IP, network type, etc.) location (locale, carrier name, MCC / MNC / ISO, coordinates, etc.), environment (battery, uptime, installed apps, free / total disk space, etc.). But they are less important, and in general everything works without spoofing them. However, I prefer to have them covered too.
Device model spoofing – it's a must have if you're tied to iPhone X or older. If IG sees you using such old models, it's already a red flag for the system.

3. Methods​

All these methods have been mentioned in different threads here on BHW. In this table I gather them together and compare based on the public info.

4. Conclusion​

Apple killed jailbreaking a while ago. Many people still live like it's old times, but in my opinion using old methods based on jailbreak brings more harm than good. It's time to move forward. Yes it's pricey, especially compared to Android. But it's worth the investments if you know exactly what you're doing. iPhone-based accounts are the most valuable and give the smoothest creation & reach.

Let me know your thoughts! I suspect that I don't see the whole iceberg yet. But the only way to dive deeper is to start sharing knowledge with other professionals on this forum, and I hope you find this post. Also if you guys have any questions, I'm here to help.

Thank you for the post. I know it was for iphone but do you know about the Pixel ? I think you can have 30 user profiles for the phone and people have been able to manage multiple social accts easily.

Rog said:

I think you can have 30 user profiles for the phone and people have been able to manage multiple social accts easily.

Click to expand...

Yes that's true. On Android it's much easier. All you need is a cloner which generates you APKs with unique fingerprints.

There are other ways too

Hey. I might be not have done enough research on the IOS, as I had totally discarded the platform from the start, considering the limited control we as a developer/hacker have on that platform to control a lot, in contrast to Android.
So this "legitimate signed clones" with a 5/5 rating really felt too good to be true. So I just did a bit of online search on it, like what this "legitimate signed clones" might be, like is it really that good, and got this below result.
Is this what you mean by that "legitimate signed clones"? Or something else, (making this whole below answer entirely wrong or something)?


What the method actually is
"legitimate signed clones" almost certainly means:

1. Take the Instagram IPA, change CFBundleIdentifier and keychain access group so iOS treats it as a distinct app with a distinct data container.
2. Inject a dylib into the binary that hooks the APIs Instagram uses to read device identity — identifierForVendor, IDFA, sysctl/uname for hardware model, locale, carrier, disk, uptime, etc.
3. Re-sign the modified binary with a real Apple-issued certificate (Apple Developer Program ad-hoc, or a shared/leased enterprise cert) so it installs on a stock, non-jailbroken phone.

"Legitimate" here means only "installs through Apple's own signing chain instead of a jailbreak." It does not mean legal or sanctioned.


Is it possible? Mostly yes — the core mechanism is real

The genuinely important technical point, and the reason this category beats the jailbreak methods: in-process hooking doesn't need a jailbreak. When you own the binary, you can inject your own code into it before signing. You're not patching iOS, you're lying to one app inside its own sandbox. So spoofing IDFV, device model, locale, carrier, and disk stats per-clone is entirely achievable on a stock device. That part of his 5/5 row is defensible.


Where the table is misleading

• The "Device IDs" list is padded. He lists serial, UDID, ECID, IOPlatformUUID. Sandboxed App Store apps have not been able to read those since roughly iOS 7. There's nothing to spoof — Instagram never sees them. Listing them makes the spoofing sound more impressive than it is.
• Certificate fragility is completely absent from the table. This is the single biggest operational risk and it doesn't appear as a "con" anywhere. Enterprise certificates get revoked in waves; when one dies, every app signed with it stops launching simultaneously, on every device. Apple has been aggressive about this since the 2019 Facebook/Google enterprise-cert episode, and revocation sweeps have periodically caught even uninvolved developer accounts. A method whose entire uptime depends on a leased cert surviving is not a 5/5.
• App Attest / DeviceCheck is the real unknown. Apple's App Attest produces a Secure Enclave–backed attestation cryptographically bound to the app's actual App ID and team ID. A re-signed clone with a changed bundle ID cannot produce a valid attestation for Instagram's App ID. If Meta enforced this hard, the whole category would be dead. I don't know how strictly Instagram enforces it — the fact that this market exists suggests enforcement is soft or advisory rather than a hard gate, but I'd flag that as the load-bearing assumption nobody in the thread is examining.
• Fingerprint spoofing ≠ correlation resistance. One physical phone still means one Secure Enclave, one set of sensor noise characteristics, one photo library, one set of behavioral timings, and one iCloud identity unless carefully partitioned. Meta's detection is heavily graph- and behavior-based. Spoofing what the app asks for doesn't address what the server infers.
• Legality. Redistributing a modified Instagram binary is copyright infringement, breaches Meta's ToS, and breaches the Apple Developer Program Agreement. "Legitimate" is flatly wrong as a descriptor.

Verdict: the mechanism is real and it's the best of the five options on the technical axis that its graded on. The 5/5 comes from grading on axes that favour "legitimate signed clones", while omitting cost, cert revocation risk, App Attest, and legal exposure.

Rog said:

Thank you for the post. I know it was for iphone but do you know about the Pixel ? I think you can have 30 user profiles for the phone and people have been able to manage multiple social accts easily.

Click to expand...

And I have experience with this one. And yes, what you've heard, is absolutely correct, and a real legit way.

I think the fingerprint part is only half the story ınstagram probably looks at plenty of signals beyond the IDs, so I wouldnt assume separate clones automatically mean separate accounts.

duke1921 said:

So this "legitimate signed clones" with a 5/5 rating really felt too good to be true.

Click to expand...

I was thinking too, before I tested accounts creation, warmup, and posting.

duke1921 said:

"Legitimate" here means only "installs through Apple's own signing chain instead of a jailbreak."

Click to expand...

Yes that's correct.

duke1921 said:

There's nothing to spoof — Instagram never sees them.

Click to expand...

All I can say is that Instagram calls these methods (maybe on some iOS versions it sees nothing).

duke1921 said:

Certificate fragility is completely absent from the table.

Click to expand...

True.

duke1921 said:

App Attest / DeviceCheck is the real unknown.

Click to expand...

AppAttest is not used by IG for normal API calls (including login and registration). DeviceCheck doesn't fingerprint device.

duke1921 said:

one set of sensor noise characteristics, one photo library, one set of behavioral timings, and one iCloud identity

Click to expand...

All phones are motionless in my case (connected to clickers), limited photo library access, different timings, and no iCloud login.

duke1921 said:

Legality. Redistributing a modified Instagram binary is copyright infringement

Click to expand...

Totally. Was only tested in educational purpose, and nobody said about distribution.

La koui said:

I think the fingerprint part is only half the story ınstagram probably looks at plenty of signals beyond the IDs, so I wouldnt assume separate clones automatically mean separate accounts.

Click to expand...

They look at everything, but in the end, account's trust score is just a single number built from many factors. And the major part is IP address, JB or non-JB, and behavior patterns. Then a bit less – matching accounts by fingerprint. And the minimal amount – other signals that you mentioned. Practice shows that they are insignificant.

Rog said:

Thank you for the post. I know it was for iphone but do you know about the Pixel ? I think you can have 30 user profiles for the phone and people have been able to manage multiple social accts easily.

Click to expand...

I think you’re talking about GrapheneOS. Stock Pixel didn’t let me create more than 2–5 profiles. In GOS you can create up to 32, but there’s another problem. It used to work well, but then they broke app installation from the Play Store. On top of that, GOS doesn’t seem interested in doing anything about Media DRM, and it doesn’t pass Play Integrity beyond the most basic level, which apparently Instagram really doesn’t like. It worked pretty well before, but I’m disappointed with it now.