Kasm Workspaces is an open-source container streaming platform that delivers disposable virtual browsers, desktops, and applications through Docker — a strong pick if your team has the server resources to self-host it. If you’d rather skip the infrastructure and still get isolated, multi-account browsing out of the box, Send.win offers a native desktop app with encrypted cloud sync plus on-demand cloud browser sessions, both ready in minutes with nothing to patch or maintain.
What Is Kasm Workspaces?
Kasm Workspaces spins up virtual browsers, Linux desktops, and individual applications inside Docker containers, then streams them to any device through a standard web browser using KasmVNC, its own WebSocket-based streaming protocol. No client software is required on the end-user side — everything renders in a browser tab, while the actual computing happens on a server you control.
Originally built for cybersecurity and threat-intelligence teams who needed a disposable place to detonate suspicious links, Kasm has grown into a broader platform for browser isolation, remote work, DevOps sandboxes, and secure web access. It’s fundamentally a self-hosted alternative to managed cloud browser services: you get complete control over the infrastructure, but you also own the deployment, patching, and scaling work that comes with it.
How Kasm Workspaces Works
Architecture Overview
- Kasm Server: the management plane that orchestrates containers, users, and policies
- Docker Engine: runs the containerized browser and desktop instances
- KasmVNC: a custom VNC protocol optimized for low-latency web streaming
- Web Client: the HTML5 viewer that renders inside the user’s own browser
- Database: PostgreSQL stores configuration, users, and session metadata
Container Lifecycle
- On-demand creation: a container spins up the moment a user requests a session
- Isolation: each container runs completely independent of every other session
- Resource limits: CPU, memory, and network usage are capped per session
- Auto-destruction: containers are destroyed when the session ends, unless persistence is configured
- Image management: pre-built and custom Docker images cover different workloads
Key Features
Browser Isolation
This is Kasm’s flagship use case. Web browsing happens entirely inside disposable Docker containers, so malware, exploits, and tracking cookies never touch the endpoint. Every session starts from a clean image, and Kasm supports Chromium, Firefox, Brave, and Tor, making it a reasonable fit for high-risk browsing such as OSINT research or opening untrusted links from email.
Virtual Desktop Infrastructure (VDI)
- Full Linux desktops in containers (Ubuntu, CentOS, Kali Linux)
- Development environments with pre-installed toolchains
- Windows desktops via Windows container or RDP-based support
- Persistent or ephemeral storage, depending on the use case
Application Streaming
- Stream a single application rather than a full desktop
- VS Code, Sublime Text, and LibreOffice all run in containers
- Terminal sessions for remote server management
- Custom applications can be containerized for team-wide access
KasmVNC Technology
Kasm’s custom VNC implementation is built specifically for web delivery:
- WebSocket-based streaming that works through most corporate firewalls
- Hardware video encoding (H.264) for smoother playback
- Dynamic quality adjustment based on network conditions
- Clipboard sharing between the local machine and the remote session
- File upload and download support, plus audio streaming
Deployment Options
Single Server
Everything runs on one machine — a minimum of 2 CPU cores, 4GB RAM, and 50GB SSD is enough for 5-10 concurrent users. This is the simplest model and a good fit for evaluation or small teams.
Multi-Server
A distributed architecture scales to hundreds of concurrent users: a web application server handles management, separate agent servers run the actual containers, a dedicated database server stores configuration, and load balancing spreads sessions across agents.
Cloud Deployment
- AWS: EC2 instances with EBS storage, with an official AMI available
- Azure: virtual machines with managed disks
- Google Cloud: standard Compute Engine deployment
- DigitalOcean: droplets via a marketplace image
- Oracle Cloud: deployable within the free tier
Installing Kasm Workspaces
Prerequisites
- A Linux server (Ubuntu 20.04/22.04 recommended)
- Docker engine installed
- Minimum 4GB RAM and 2 CPU cores
- Port 443 (HTTPS) open
- A domain name with an SSL certificate, strongly recommended for production
Quick Install
- Download the latest release from kasm.io
- Extract the archive and run the installation script
- The script installs Docker, PostgreSQL, and the core Kasm components
- Access the admin interface over HTTPS
- Log in with the default admin credentials generated during install
Post-Installation
- Change the default admin password immediately
- Configure an SSL certificate before going to production
- Set up authentication — LDAP, SAML, and OIDC are all supported
- Pull the workspace images you’ll actually need (browsers, desktops, apps)
- Configure zones and per-session resource allocation
Available Workspace Images
Browsers
- Chrome: the full Chrome browser in a container
- Firefox: standard or hardened configuration
- Tor Browser: pre-configured for anonymous browsing
- Brave: a privacy-oriented option
Desktops
- Ubuntu: a full XFCE desktop environment
- CentOS: an enterprise Linux desktop
- Kali Linux: for penetration testing
- Remnux: a distribution built for malware analysis
Development
- VS Code: a full IDE running in the browser
- Terminal: shell access for DevOps tasks
- Jupyter: notebooks for data science work
You can also build custom images with your own Dockerfiles, extending Kasm’s base images with specific tools, configurations, and a private registry.
Common Use Cases
Enterprise Browser Isolation
The most common deployment: risky URLs are automatically opened inside a Kasm container instead of the local browser, so users can click through suspicious links without exposing the endpoint. Category-based isolation rules integrate with the rest of the security stack.
Remote Work and BYOD
- A secure workspace reachable from any device, personal or corporate
- No VPN required — everything runs over standard HTTPS
- Data stays on the server rather than on the endpoint
- A consistent environment regardless of what device connects
Cybersecurity and OSINT
- Disposable browsers for threat research
- Investigating malicious sites without risking the analyst’s machine
- Kali Linux containers for penetration testing
- Session recording for evidence collection
Education and DevOps
Kasm also shows up as a lab environment for students (consistent setups with zero local installation) and as ephemeral, browser-based development environments for CI/CD and testing workflows.
Kasm Workspaces Pricing
Community Edition
- Free and open-source
- Limited to 5 concurrent sessions
- Core features included
- Community support only
Enterprise Edition
- Unlimited concurrent sessions
- Advanced management and admin controls
- SAML/LDAP authentication
- Session recording and audit trails
- Professional support, priced on request
Security Architecture
Container Isolation
Each session runs in its own Docker container with network isolation from other containers, resource limits to reduce the blast radius of an escape attempt, and optional read-only root filesystems for maximum hardening.
Authentication
- Local accounts: built-in user management
- LDAP/AD: Active Directory integration
- SAML: Okta, Azure AD, OneLogin
- OIDC: Google, GitHub, or a custom identity provider
- Two-factor: TOTP-based 2FA
Audit and Compliance
Session recording, login and activity logging, session watermarking, and data-loss-prevention policies are all available on the Enterprise tier for organizations that need an audit trail.
Performance and Server Sizing
Budget roughly 1 CPU core and 2GB RAM per concurrent browser session — a server supporting 10 concurrent users needs 12+ cores and 24+ GB RAM. SSD storage is essential for container performance, and a GPU is optional but noticeably improves streaming quality through hardware video encoding. On the network side, users need at least 5 Mbps for a smooth experience, and deploying servers close to your user base keeps latency down; expect 10-30ms of added latency on a good connection, with heavy JavaScript apps and video streaming showing the most noticeable delay.
Kasm Workspaces vs. Send.win: Which Should You Choose?
Kasm and Send.win solve an overlapping problem — isolated, disposable browsing — from opposite directions. Kasm gives you a self-hosted platform you fully own and customize; Send.win gives you the same isolation and multi-account benefits without a server to run. If you’re comparing the two head to head, it’s worth also reading our breakdown of Kasm alternatives and how they stack up on cost and setup time.
| Feature | Kasm Workspaces | Send.win |
|---|---|---|
| Hosting | Self-hosted (your servers) | Native desktop app or managed cloud sessions |
| Setup Effort | Server provisioning + installation | Download and sign up, or launch a cloud session instantly |
| Fingerprint / Profile Management | Limited, needs manual configuration | Purpose-built profile management with per-session settings |
| Multi-Account Support | Possible with per-container configuration | Core feature — 150+ profiles depending on plan |
| Proxy Integration | Manual setup per container | Built-in, assignable per profile |
| Automation | Custom scripting per container image | Local Selenium/Puppeteer/Playwright automation on Pro and up |
| Data Control | Complete — your infrastructure | Local-first desktop app with encrypted cloud sync; cloud sessions run remotely |
| Cost Model | Free (Community) or infrastructure + license (Enterprise) | 30-day free trial, then flat monthly subscription |
| Best For | IT/security teams with server resources | Individuals, agencies, and teams that want isolation without ops overhead |
Choose Kasm if: you need self-hosted control, already run internal infrastructure, and data sovereignty is a hard requirement.
Choose Send.win if: you want multi-account management, session isolation, and an isolated browsing environment up and running today, without dedicating IT time to servers, patching, or scaling.
How Send.win Actually Works
Send.win ships in two modes, and it’s worth being precise about what each one is. The first is the Sendwin Browser, a native desktop app for Windows, macOS, and Linux. It’s local-first — your profiles and sessions live on your machine — with encrypted cloud sync so the same profiles follow you to another device. The second is cloud browser sessions, which run entirely on Send.win’s infrastructure with zero local install; these are metered by cloud browsing time rather than a flat seat count, which makes them a good fit for occasional or short-lived sessions, similar in spirit to how you’d spin up a Kasm container on demand. If you’re weighing which mode fits a specific use case, our comparison of the safest cloud browser for handling suspicious links covers that decision in more depth.
For teams that need to script repetitive tasks, Send.win supports local automation against the desktop app through standard Selenium, Puppeteer, or Playwright tooling, available starting on the Pro plan — you point your existing automation framework at the desktop app the same way you would any local browser instance, without learning a proprietary API. That’s a meaningful difference from Kasm, where automation means writing custom scripts inside each container image.
Each profile in Send.win keeps its own cookies, storage, and identity, isolated from every other profile — the same core idea behind Kasm’s disposable containers, just packaged as a desktop app or a cloud browser session instead of a self-managed Docker deployment.
Send.win Pricing
Send.win offers a 30-day free trial with no credit card required, so you can test both the desktop app and cloud sessions before committing.
| Plan | Monthly | Billed Annually | Profiles | Proxy Bandwidth | Automation API | Seats |
|---|---|---|---|---|---|---|
| Pro | $9.99/mo | $6.99/mo | 150 | 5GB | Included | 1 |
| Team | $29.99/mo | $20.99/mo | 500 | 20GB | Included | 16 |
Notably, the Automation API is available starting on the Pro plan — you don’t need to jump to Team pricing just to script your browsing sessions, which is a common sticking point with self-hosted platforms where automation is either fully manual or requires custom container builds.
🏆 Send.win Verdict
Kasm Workspaces is genuinely strong if you have the IT resources to deploy, patch, and scale your own container infrastructure — it gives you full data sovereignty and deep customization. But for most individuals, agencies, and small teams, that’s a lot of ongoing overhead just to get isolated, multi-account browsing. Send.win delivers the same core benefit — separate, isolated sessions per account or task — through a native desktop app with encrypted cloud sync or an on-demand cloud browser session, with local automation support built in from the Pro plan, and no server to maintain.
Try Send.win free today — start your 30-day trial, no credit card required.
Frequently Asked Questions
Is Kasm Workspaces really free?
The Community Edition is free for up to 5 concurrent sessions. Enterprise features — unlimited sessions, LDAP/SAML, session recording — require a paid license priced on request.
Can I use Kasm Workspaces for multi-account management?
Yes, but it takes manual configuration: you’d need to set up separate proxies per container and manage fingerprint settings yourself. Purpose-built tools like Send.win handle profile and proxy management automatically, without any container setup.
How does Kasm’s performance compare to local browsing?
Expect roughly 10-30ms of added latency on a good network. Most everyday browsing feels responsive, though heavy JavaScript applications and video streaming can show slight lag compared to a local browser.
Can Kasm Workspaces run Windows desktops?
Yes — Kasm supports Windows containers and RDP-based Windows sessions, though Windows licensing has to be handled separately.
Is Kasm Workspaces suitable for production use?
Yes, plenty of organizations run Kasm in production for browser isolation and secure remote access. The multi-server deployment option adds the high availability and scalability that production workloads typically need.
Does Send.win require installing a server or client?
No server is required either way. You either install the native Sendwin Browser desktop app on Windows, macOS, or Linux, or launch a fully cloud-hosted session with zero local install, metered by cloud browsing time.
Does Send.win support browser automation?
Yes. Starting on the Pro plan, you can run local automation against the desktop app using standard Selenium, Puppeteer, or Playwright, the same way you’d automate any local browser — no proprietary scripting language to learn.
Which one should a small team without dedicated IT staff pick?
Send.win. Kasm Workspaces is a capable platform, but deploying, securing, and scaling it is itself an IT project. Teams without that bandwidth get the same isolation benefits from Send.win in minutes, with pricing that scales by profile and seat count rather than server capacity.