Does Incognito Mode Keep You Private? What It Hides and What It Doesn't

Open a new incognito window in Chrome and the browser tells you, in plain text, that it is not doing what most people think it does. The screen lists what Chrome will not save — browsing history, cookies and site data, information entered in forms — and then lists, right underneath, who can still watch: the websites you visit, your employer or school, your internet service provider.

That second list is the whole story, and almost nobody reads it. Private browsing is a local storage feature with a privacy-sounding name. Understanding precisely where its boundary sits is the difference between using it correctly and relying on it for something it was never built to do.

What actually happens when you open a private window

Chromium calls it an off-the-record (OTR) profile. Instead of using your normal profile directory, the browser spins up a parallel profile whose storage backends are in-memory rather than on-disk. Visit chrome://version in a normal window and you will see a real filesystem path next to "Profile Path". The OTR profile has no equivalent durable location — its cookie jar, cache, session storage, and IndexedDB live in RAM for the lifetime of the session.

Three consequences fall directly out of that design:

1. You appear logged out everywhere. The private session starts with an empty cookie jar, so no site sees an existing session cookie. This is the single most useful practical property of private mode, and it has nothing to do with privacy — it is why developers use it to test a signed-out view and why you can open a second account in it.
2. Extensions are disabled by default. Each extension needs "Allow in Incognito" toggled on individually at chrome://extensions. Your ad blocker and your content blocker are off in a private window unless you went and enabled them, which means private browsing can expose you to more tracking scripts than your normal window does.
3. Closing the last private window destroys the session. Not the first one — the last. Chrome keeps the OTR profile alive as long as any private window exists. Leave a second one open and you stay logged in, which is the most common reason people think incognito "didn't work".

Firefox implements the same idea under a different name — Private Browsing windows share a single ephemeral container — and Safari goes further by giving each private tab its own isolated session, so two private tabs in Safari do not share cookies with each other at all.

The honest table: what is hidden, and from whom

The pattern is consistent: private mode controls what is written to your disk, and nothing else. Every row where the answer is "no" sits either on the network or above the browser in the stack.

Things that survive a private session

Downloaded files. The entry does not appear in chrome://downloads, but the file is on disk at whatever path you chose. On Windows that is usually %USERPROFILE%\Downloads; on macOS and Linux, ~/Downloads. The absence of a history entry is cosmetic.

Bookmarks. Bookmarking a page in a private window writes to your normal bookmark store. It is shared state, and it is synced if you have sync on.

OS-level DNS cache. On Windows you can inspect what the system resolver has cached:

ipconfig /displaydns | findstr "Record Name"

Chrome ships its own built-in asynchronous resolver, so many lookups will not appear here — but anything that falls through to the OS resolver does, and on Linux a systemd-resolved cache behaves the same way. The point is that resolution happens outside the browser's sandbox of ephemeral state.

Anything the OS or an agent recorded. Recently-opened-document lists, antivirus scan logs, endpoint-detection telemetry, Windows Timeline, and screen-time reporting all live below the browser. A private window is invisible to your own history and fully visible to them.

Why fingerprinting makes "anonymous browsing" a stretch

A private window reports the same user-agent string, the same screen.width and screen.height, the same Intl.DateTimeFormat().resolvedOptions().timeZone, the same navigator.hardwareConcurrency, the same installed font list, and the same canvas and WebGL rendering output as your normal window. That combination is frequently unique enough to re-identify a visitor without any cookie at all.

You can watch this happen yourself. Open the console in a private window and run:

console.log({
  ua: navigator.userAgent,
  cores: navigator.hardwareConcurrency,
  screen: [screen.width, screen.height, devicePixelRatio],
  tz: Intl.DateTimeFormat().resolvedOptions().timeZone,
  langs: navigator.languages,
});

Run the same snippet in a normal window and compare. The objects match. Nothing a tracker uses for passive identification changed when you switched modes — which is the mechanism explored in detail in how sites track you without cookies. If you want a read on how identifiable your own setup is, the browser privacy score tool reports the specific signals your browser is handing out.

And the cheapest de-anonymizer of all is still the login form. Signing into an account inside a private window hands the provider an authenticated identity to attach every subsequent request to. The empty cookie jar bought you exactly one thing: the login happened fresh.

Chrome, Firefox, Safari, Edge: the private modes are not equivalent

Treating "private mode" as one feature across browsers is the second common mistake. The implementations diverge sharply on tracking protection.

Firefox's Total Cookie Protection is the most structurally interesting of these: rather than blocking third-party cookies outright, it gives every top-level site its own cookie jar, so an embedded tracker on site-a.com cannot read the identifier it wrote on site-b.com. That is a genuine cross-site tracking defence operating inside the private window, not just a disk-write suppression.

Mobile adds its own quirk. Private tabs in iOS Safari persist across app restarts — they stay open, and anyone who picks up the phone and taps the tab switcher sees them. Chrome on Android went the other way and added a biometric gate: Settings → Privacy and security → "Lock Incognito tabs when you close Chrome", which puts a fingerprint or face check in front of private tabs when you leave the app. That setting is worth turning on, and it is a tacit admission of the gap described in the next section.

The gap nobody budgets for: the session that is open right now

Every property of private browsing is about after. After the window closes, there is no history entry. After the session ends, the cookies are gone.

None of it applies to the window currently on your screen.

A private window holding your medical portal, a second email account, a legal document, or a bank statement is exactly as readable to the person standing behind you as a normal one. If you walk away from the machine, the session is still authenticated and still rendered. The disposable cookie jar protects a future user of the device from your past; it does nothing for your present. This is the same structural distinction that makes passkeys and session protection complementary rather than redundant — strong authentication secures the entrance, not the room.

Closing the window every time you step away works and costs you the page state. Locking the screen — Win+L on Windows, Control+Command+Q on macOS — is faster and covers everything at once. For the narrower case of one sensitive tab among twenty that you want gated behind a password while the rest stay usable, a tab-level lock such as Locksy sits in front of that single tab's contents. Pick whichever matches how often you actually leave the desk.

A threat-model-first replacement table

Stop asking "is incognito enough" and start from what you are defending against.

Two of those deserve expanding, because they are the cases people get wrong most often.

Shared or family computers. This is the scenario that drives most incognito use, and it is the one where a better tool already exists. Create a second OS user account, or at minimum a second Chrome profile via the avatar menu → "Add Profile". You get an isolated cookie jar, separate history, separate extensions, separate autofill — permanently, without having to remember to open a special window. Incognito is a mode you can forget; a profile is a boundary you cannot.

Managed devices. Before assuming anything about privacy on a work machine, look at what is actually configured:

chrome://management   → what your organisation can see and enforce
chrome://policy       → the exact policies applied to this profile
chrome://net-internals/#dns → the browser's own DNS cache

If chrome://management says your browser is managed, treat every page you open as logged. TLS inspection via a corporate root certificate means a proxy can read decrypted request bodies regardless of the padlock in your address bar, and no browser mode changes that.

Checking what your browser has actually stored

A useful habit, independent of private mode: audit the state your normal profile is holding. Open chrome://settings/content/all and sort by storage size. Sites you visited once and forgot are often sitting on megabytes of IndexedDB. That is the data private mode would have discarded, persisting in your main profile — and clearing it there is more consequential than any single private session.

For a deeper look, chrome://net-export captures a full network log you can load into the Netlog viewer to see exactly which hosts a page contacted. Running that on a news site is an education in how many third parties a single page view touches.

Where this leaves private browsing

Private mode does one job well and is sold as doing a different job entirely. Use it for the thing it is actually good at — a clean, signed-out, disposable session — and route everything else to the control that genuinely covers it: profiles and OS accounts for shared devices, screen and tab locks for physical exposure, DNS-over-HTTPS and a VPN for the network path, strict tracking protection and a content blocker for cross-site tracking.

The disclaimer on that New Incognito Tab page is accurate. It is just three sentences longer than anybody reads.