Instagram account creator bot

The GitHub Instagram-account-creator scripts that dominate the SERP follow the same recipe. Spin up a headless browser or emulator, navigate to instagram.com/accounts/emailsignup, fill the form fields with generated credentials, solve any captchas (often by handing them off to a paid solver service), receive the email or SMS verification code, complete signup. Some scripts handle profile photo upload and a starter bio.

In a vacuum these scripts work. The accounts get created. The problem is what Instagram's detection systems do with new accounts created via this pattern.

Server fingerprint clustering. Scripts run on a server, datacenter VPS, or local machine. The IP, browser fingerprint, screen resolution, font list, and timezone all cluster across the batch — Instagram's anti-spam systems flag clusters of accounts created from similar fingerprints within a short time window.

Behavioral signature. Account creation followed by no activity for hours, then aggressive automation, is one of the highest-confidence bot signals Instagram tracks. Scripts that don't include a 7-30 day passive warm-up after creation have a 70-90% loss rate within two weeks.

Recovery contact pollution. Bots that reuse the same SMS provider or email domain across creations build a recovery graph Instagram can trace. The 50th account using the same throwaway-email service inherits the suspicion of the previous 49.

None of this is solved by “adding random delays.” The pattern lives at a layer the script can't see — the cluster signature across the batch, not the individual account's actions.

Two cases where a free open-source account creator works without much downside.

Burner test accounts. If you need 5-10 throwaway accounts to test a feature, scrape competitor follower lists, or experiment with Instagram's API behavior, the free bots are perfect. The accounts will die. That's fine because they were disposable.

Small-batch creation with manual warm-up. If you create 3-5 accounts per week, then warm each one manually for 30 days from a real phone before any commercial use, the script's cluster signature has time to dilute. This is laborious and most operators don't do it, but it works.

Outside those two cases — bulk creation, immediate use, no manual warm-up — the math doesn't work. You spend $1.50 per account on SMS PVA, generate 100 accounts, and 70 are dead within two weeks. Real cost per surviving account: $5 plus the time spent monitoring failures.

The operator-grade alternative is account creation that runs on the same real-phone infrastructure that runs everything else. ShadowPhone's account-creation module follows this flow:

Step 1 — provision a fresh GrapheneOS profile. The desktop app creates a new isolated user profile on one of your connected Pixel phones. Each profile is a separate filesystem, a separate Instagram app installation, a separate set of cookies, separate device-level identifiers. From Instagram's perspective, this is a different phone.

Step 2 — assign IP and PVA number. Each new account gets its own carrier IP (mobile data SIM or rotating residential proxy) and its own SMS verification phone number from a third-party PVA provider — TextNow, Twilio, or one of the dedicated Instagram-PVA marketplaces.

Step 3 — run signup through the actual Instagram app. The phone opens the Instagram app on the new profile. The desktop app drives the signup flow: enter username, enter email, enter the PVA phone number, receive the verification SMS, enter the code. Same as a person tapping through. No headless browser, no API call, no script signature.

Step 4 — staged warm-up. The account enters a 7-day passive period — open Instagram daily, browse, view stories. Then a 30-day graduated activity ramp from minimal engagement to operating volume. See the warm-up protocol. The result: account survival rates of 80-90% at 90 days, compared to 20-30% with script-based creation and immediate use.

The honest cost comparison over 100 accounts created and used commercially for 90 days.

ShadowPhone's real-cost-per-surviving-account is lower than free GitHub bots once you count the bans free bots produce. The ranking holds for portfolios above ~30 accounts. Below that, the math depends on how much your time is worth manually warming up bot-created accounts.

Both have valid use cases. The choice depends on what you need the account to do and how soon.

Create new accounts when: You're running a portfolio of theme pages where account age is less important than account isolation and operator control. You want full ownership of the recovery graph (your email, your phone number) so the original creator can't reclaim. You're willing to wait 30 days through warm-up before commercial use.

Buy aged accounts when: You need accounts active in commercial workflows immediately. Account age matters for the use case (lead gen at scale, niche pages where established follower count signals legitimacy). The receiving infrastructure is already set up to do the post-purchase device-match and IP-match work. See the aged-account buyer guide.

Most operators running serious portfolios end up doing both: create a steady stream of new accounts to populate theme pages and lead-gen pools where age doesn't matter, and buy aged accounts when a specific use case demands established history.

If you're considering writing your own Instagram account creator from scratch using Selenium, Puppeteer, or a similar framework, here's what to know before you spend a month on it.

Captcha solving has gotten harder. Instagram's reCAPTCHA Enterprise integration scores browser fingerprints in real-time. Headless browsers fail the score check before the captcha even renders. Adding stealth plugins works for a few weeks until Google updates the model.

SMS verification fraud detection has gotten better. Twilio and similar providers now cooperate with Meta to flag PVA numbers used at scale. The cheapest PVA pools are the most flagged. Your script will create accounts that get banned within hours because the verification number was already on the watchlist.

Mobile-app fingerprint signatures are hard to fake. Instagram's mobile app signs API requests with attestation tokens that emulators cannot reliably reproduce. The frameworks that fake these tokens get patched within months as Meta updates the attestation model.

Real Pixel phones running the actual Instagram app sidestep all three of these issues structurally — there's no fingerprint to fake because the app is genuinely running on a real device. That's the value proposition behind paying for ShadowPhone instead of building.