# 0x6rss/instagram-private-graph: What the Tool Actually Does With a Private Account

> A local Python application that scores the accounts an authenticated Instagram session can see, then draws them as a network. It is an OSINT triage aid, and the README is unusually blunt about what the numbers are not.

**0x6rss/instagram-private-graph** — Analyze the followers and following accounts that a private (hidden) Instagram account interacts with.

- Repository: https://github.com/0x6rss/instagram-private-graph
- Stars: 439 · Forks: 58
- Language: Python
- License: not declared
- Published: 2026-09-17 · Updated: 2026-09-17 · Language: en
- Canonical page: https://hysenlabs.com/projects/0x6rss-instagram-private-graph

## The gap between an Instagram graph and a private account

Instagram's own Graph API answers questions about accounts you own or manage. It does not answer the question an investigator usually has: which accounts cluster around a target you do not control. This project targets that second question for the social-media portion of authorized OSINT work. It collects information visible to an authenticated session, stores the evidence locally, and produces a ranked candidate list, a radial network visualization, a target summary, a signal summary, and a human-readable report.

The README frames the purpose narrowly: case triage, hypothesis generation, and corroboration. It explicitly disclaims being an identity-resolution system, a follower-list bypass, or a surveillance service, and it says the output is not a source of factual relationship declarations. That framing is not modesty marketing. It is the difference between a tool that produces leads and a tool that produces claims, and the rest of the documentation keeps returning to it.

Who is it for? Someone who already has lawful access to the target account, already has a case file, and needs a starting order for manual review. The README requires an authorized, low-value test account and warns against primary, personal, business, creator, or irreplaceable accounts. If your account matters to you, this is not the tool for it.

## Scores, not edges: how the candidate list is built

The mechanism described in the README is a scoring pipeline rather than a scraper that dumps a follower list. The application runs an authenticated Instagram session through Playwright, collects what that session can see, and turns it into model-confidence scores over candidate accounts. Those scores are then rendered as a radial network graph, a ranked list, and a report.

The README is direct about the interpretation problem: a drawn line is not a confirmed Instagram follow edge. The graph visualizes candidate scores, and the numbers are algorithmic model-confidence values, not verified facts or calibrated probabilities. That distinction matters because a radial layout makes weak signals look structural. A cluster in the picture can come from a shared suggestion surface rather than from any relationship between the two accounts.

Signal quality also depends on the viewing account, which is an unusual property for a tool like this. Newly created, empty, or inactive viewing accounts have little stable ranking history and tend to receive generic onboarding suggestions. Newly created target accounts have sparse evidence. In both cases the README predicts lower coverage, greater uncertainty, and potentially more false positives. It also notes that an accepted follow does not turn the viewer's own suggestions into the target's followers, which closes off an obvious misreading of the output.

So the data flow is: authenticated session collects visible artifacts, the artifacts are scored, and the scores are presented for a human to triage. Nothing in that chain converts a score into a verified relationship, and the documentation never pretends otherwise.

## Installing it and running a first collection

The project is not published to a package index. The README says to download or copy the project, open a terminal, and change into the instagram-osint-app directory, and it explicitly assumes no repository URL. Requirements are Python 3.10 or newer, with 3.11 or 3.12 recommended for dependency compatibility, plus at least 500 MB of free space for the environment and browser runtime. Artifact and avatar cache capacity is separate and the README says it can grow without a fixed upper bound.

On macOS, the sequence creates a virtual environment, installs the requirements, installs the Chromium runtime that Playwright drives, and copies the environment template. The chmod step matters because the file will hold a live session cookie.

```bash
python3 --version
python3 -m venv .venv
./.venv/bin/python -m pip install --upgrade pip
./.venv/bin/python -m pip install -r requirements.txt
./.venv/bin/python -m playwright install chromium
cp .env.example .env
chmod 600 .env
```

On Linux the only meaningful difference is the Playwright dependency step, which the README says is intended for Debian and Ubuntu style systems and may request administrator privileges for system libraries. Other distributions need the equivalent Chromium runtime libraries from their own package manager, followed by a plain chromium install.

```bash
./.venv/bin/python -m playwright install --with-deps chromium
```

Before starting, edit .env. The template exposes seven keys, all empty:

```text
IG_SESSIONID=
IG_DS_USER_ID=
IG_CSRFTOKEN=
IG_MID=
IG_IG_DID=
IG_DATR=
```

Then launch through the cross-platform start.py. The README notes that start.cmd was removed and that start.py is the single launcher.

```bash
./.venv/bin/python start.py --skip-deps
```

Passing --skip-deps is the documented preference: without it, start.py checks imports and declared minimum versions and runs an upgrade from requirements.txt if anything is missing or outdated, while with it startup stops instead of accepting an unsupported version. The README calls explicit installation followed by --skip-deps more predictable. The launcher also accepts --host, --port, --no-browser, and the README's option list is truncated mid-flag, so treat anything beyond those four as undocumented. On Apple Silicon, the README suggests a native arm64 Python install, and if the browser does not open automatically, add --no-browser and open the local URL yourself.

## The account ban is the expected failure mode

This is the limitation the README leads with, and it is not a theoretical one. Automated requests to undocumented Instagram endpoints can cause rate limiting, forced login, checkpoint challenges, session invalidation, temporary restrictions, or a permanent account ban. The README states plainly that there is no ban-proof request rate. That single sentence invalidates any plan built around using an account you care about.

The private-account case has a second constraint that is easy to miss. For a private target, the test account must already be a genuine, accepted follower with lawful access. The project does not bypass private-account access controls, and the README forbids using it to send deceptive follow requests. For a public target, following is not always technically required, but the README says a legitimate and established viewing relationship usually produces more interpretable signals. In other words, the tool's usefulness is bounded by a relationship you have to have earned first.

There is a subtler failure mode around account age. A fresh viewing account has no stable ranking history, so the scores it produces lean on generic onboarding suggestions. A fresh target account has sparse evidence. Either condition degrades coverage and inflates false positives, and no configuration flag fixes it. If your case depends on a brand-new target account, this tool will hand you a thin and noisy picture and you should know that before you build a hypothesis on it.

Finally, the output itself is a trap for the careless. The README states the numbers are not verified facts, not calibrated probabilities, and not proof that two people follow, know, communicate with, or are close to each other. A report that gets pasted into a case file without that caveat becomes a factual claim it was never designed to support.

## Where an API client or a graph library fits instead

The natural alternative for many teams is the official Instagram Graph API, which is what the search traffic around this topic usually points at. The difference in approach is fundamental rather than incremental. The official API is a documented, supported surface with authentication you can reason about, and it answers questions about accounts you own or manage. It will not give you a candidate ranking around a third-party private account, because that is not a question it is designed to answer. If your work stays inside your own accounts, an official API client is the lower-risk choice and this project adds nothing.

A second alternative is assembling the pieces yourself: a session library plus networkx for the graph and your own scoring heuristic. The requirements file shows this project is largely that assembly, with networkx for graph construction, curl-cffi and requests for HTTP, beautifulsoup4 for parsing, Pillow for avatar handling, Playwright for the browser session, and paho-mqtt for messaging. If you already have a scoring model you trust, bolting it onto your own collection layer gives you control over evidence handling and avoids adopting someone else's confidence heuristic. What you lose is the report generation, the radial visualization, and the launcher.

A third option worth naming is doing nothing automated at all. The README's own warnings, taken seriously, describe a tool whose output needs manual corroboration before it means anything. If your case is small enough that manual review of the target's visible interactions would finish the job, the automation buys you speed at the cost of an account and a pile of raw artifacts that then need encrypted storage and access control.

## Local-only by design, and what that costs you

The application binds to 127.0.0.1 and the README says it intentionally refuses non-loopback hosts. It has no remote-user login and no TLS. The instruction is explicit: do not expose port 8000 through a router, tunnel, reverse proxy, container port, LAN address, or public cloud VM. For a single analyst on a workstation, that is the right default. For a distributed team, it means the tool does not solve collaboration for you, and anything you build to share its output is outside the design and outside its security model.

Evidence handling is pushed onto the operator. Raw artifacts may contain usernames, numeric account identifiers, names, profile text, inferred connections, timestamps, and cached avatars. The README says to store them in a non-synced, encrypted location with access limited to the case team, and it names OneDrive, Dropbox, iCloud, and Google Drive folders as inappropriate places for live cookies or case evidence. Since the avatar cache can grow without a fixed upper bound, storage planning is part of running this, not an afterthought.

The sessionid warning deserves its own sentence. The README states it is equivalent to authenticated account access and must never be committed, pasted into an issue, sent in chat, included in a screenshot, or captured with a browser cookie-export extension. If it has ever appeared in a log, terminal recording, archive, cloud share, or diagnostic output, the documented response is to log out all Instagram sessions, rotate the test-account password, and collect a fresh cookie pair. That is a real operational procedure, not boilerplate.

## Maintenance, dependencies and the missing licence

The repository is not archived and the last push was on 2026-09-03, so the codebase has moved recently. There are no retrieved releases, which means upgrades arrive as commits rather than versioned artifacts you can pin against. For a tool that handles case evidence, that is a real cost: you are tracking a branch, not a release train.

The dependency policy reinforces this. The README says the requirements use reviewed minimum-version constraints rather than a cryptographic lock file, and it recommends that evidence-sensitive deployments create and review a lock file with hashes for the exact platform, repeat dependency auditing, and archive that environment manifest with the case record. It also flags a specific floor: curl-cffi must be 0.15.0 or newer, because older releases include a known redirect-related SSRF vulnerability. That is the kind of constraint you want to check on every upgrade rather than assume.

Upgrading an existing environment is documented as two commands, and the second one is the interesting part because it verifies the resolved set rather than just installing it:

```text
python -m pip install --upgrade -r requirements.txt
python -m pip check
```

Use the virtual-environment Python path for your operating system in place of python. The README also notes that without --skip-deps, the launcher will upgrade packages on startup, which is convenient for a scratch environment and undesirable for a case environment where you want the manifest frozen before collection begins.

On licensing, the repository metadata does not carry a licence identifier and the README does not state one. Absence of a licence is not the same as permissive use, and this is not a legal opinion, so the practical step is to confirm terms with the maintainer before the tool or its output goes anywhere near a deliverable.

## Conclusion

Adopt it if you run authorized OSINT casework on a disposable, lawful test account and you want a ranked candidate list plus a radial graph to guide triage, not to prove anything. Do not adopt it if you need a follower-list bypass, an identity-resolution system, or anything you can run against a private target without an accepted follow. Verify three things first: that your test account is genuinely accepted by the target, that .env holds a freshly rotated sessionid rather than one that has ever touched a log or a screenshot, and that the artifact directory sits on encrypted local storage rather than a synced drive. The README states there is no ban-proof request rate, so plan for the account to be lost.

## FAQ

### Can I analyse a private Instagram account with 0x6rss/instagram-private-graph?

Only if your test account is already a genuine, accepted follower with lawful access to that private target. The README states the project does not bypass private-account access controls and must not be used to send deceptive follow requests.

### What is an Instagram graph in the context of 0x6rss/instagram-private-graph?

In this project it is a radial network visualization of candidate scores produced from an authenticated session. The README stresses that a drawn line is not a confirmed Instagram follow edge, and the graph is a visualization of candidate scores rather than a record of relationships.

### Does 0x6rss/instagram-private-graph use the official Instagram Graph API?

The README does not describe official Graph API usage. It says the application collects information visible to an authenticated Instagram session and notes that automated requests to undocumented Instagram endpoints can trigger rate limiting, forced login, checkpoint challenges, or a permanent account ban.

### What do I need to put in the .env file for 0x6rss/instagram-private-graph?

The .env.example template lists seven empty keys: IG_SESSIONID, IG_DS_USER_ID, IG_CSRFTOKEN, IG_MID, IG_IG_DID, and IG_DATR. The README warns that a sessionid is equivalent to authenticated account access and must never be committed, pasted into an issue, sent in chat, or captured with a browser cookie-export extension.

### Why does 0x6rss/instagram-private-graph only listen on 127.0.0.1?

The README states the application has no remote-user login and no TLS and intentionally refuses non-loopback hosts. It instructs against exposing port 8000 through a router, tunnel, reverse proxy, container port, LAN address, or public cloud VM.

### What Python version does 0x6rss/instagram-private-graph require?

Python 3.10 or newer, with Python 3.11 or 3.12 recommended for dependency compatibility. The README also lists at least 500 MB of free space for the Python environment and browser runtime, with separate capacity for case artifacts and avatar cache.

## Sources

- [0x6rss/instagram-private-graph on GitHub](https://github.com/0x6rss/instagram-private-graph)
- [Issues](https://github.com/0x6rss/instagram-private-graph/issues)
- [README](https://github.com/0x6rss/instagram-private-graph/blob/main/README.md)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/0x6rss-instagram-private-graph