Private browsing hides your activity from other people who use the same device: when the last private window closes, its history, cookies, cache, downloads list and form entries are discarded. It does not hide you from the websites you visit, from your network or ISP, or from anyone who can see your IP address or fingerprint, and it does not make you anonymous.
The promise, precisely
Every major browser offers the mode under a different name: Incognito in Chrome, Private Browsing in Firefox and Safari, InPrivate in Edge. The technical promise is the same in each. The private session gets an empty cookie jar, an empty cache and an empty local-storage area, all separate from your normal profile. Nothing you do in it is written to history. When you close the last private window, that temporary storage is deleted. Your bookmarks and downloaded files remain, because you explicitly chose to keep them.
That is a useful promise, and it is much narrower than the words "private" or "incognito" suggest. The vendors know this. Chrome's Incognito landing page has for years listed what the mode does not hide, and Google expanded that disclaimer in 2024 after settling a lawsuit over user expectations of Incognito. Firefox's and Safari's start pages carry similar text. The gap between the promise and the assumption is the subject of this guide.
Who still sees you
| Observer | Normal window | Private window | What changes it |
|---|---|---|---|
| Other users of the same device | See history, cookies, autofill | See nothing from the session after it closes | This is what private mode is for |
| The website you visit | Sees IP, fingerprint, and any login | Sees IP, fingerprint, and any login | VPN or Tor for the IP; fingerprinting protection; not logging in |
| Your ISP or mobile carrier | Sees every hostname (DNS, SNI) and every unencrypted request | Same | VPN or Tor; encrypted DNS and ECH narrow it |
| Your employer or school network | Sees hostnames; sees content if a corporate proxy or managed device is in use | Same | Do not use a managed device for private matters |
| Your DNS resolver | Sees every hostname you resolve | Same | Choose the resolver deliberately; use DoH or DoT |
| Extensions | Read what their permissions allow | Off by default in Chrome and Edge; asked at install in Firefox | Keep them off in private windows |
| The browser vendor | Sync, Safe Browsing lookups, telemetry per settings | Sync is off; Safe Browsing and DNS still run | Settings, not window type |
Read the second and third rows twice. The site sees the same public address it always sees, and the address is enough on its own to place you in a city and a provider, as explained in what your IP address reveals. The network sees the same hostnames it always sees. A private window is a change to what is stored on your disk, and neither of those observers ever depended on your disk.
The fingerprint does not change
The most consequential misunderstanding is that a private window is a fresh identity. It is a fresh cookie jar, which is not the same thing. The properties a fingerprinting script reads, described in browser fingerprinting explained, are your screen, your fonts, your GPU's canvas output and your hardware. None of those differ between a normal and a private window of the same browser. A site that fingerprints you on Monday in a normal window and again on Tuesday in a private one gets the same hash both times. You can test this yourself: run the browser check in both kinds of window and compare the fingerprint uniqueness result.
The one place a private window changes fingerprinting is where the browser deliberately applies stronger protections there. Safari enables its advanced tracking and fingerprinting protection in Private Browsing by default, and Firefox's fingerprinting protection is on in private windows even under standard tracking protection. Those are real improvements, and they are available in normal windows too if you switch them on, which is the better choice.
Logging in ends the privacy
Sign in to any account in a private window and, for that site and everyone it shares data with, you are identified for the rest of the session. This is obvious when stated and constantly forgotten in practice. The classic case is checking a search or video service in a private window while signed in to it: the private window has no cookies, so it is not signed in, but the moment you sign in to comment or save something, the history for that session attaches to your account, subject to the account's own settings. Private mode protects the disk, not the account.
The common myths, one by one
- "Private mode hides me from Google." Only if you do not sign in and Google cannot otherwise recognise you. Search queries still reach Google with your IP address and a fresh fingerprint identical to your normal one. What changes is that the query is not tied to your account and no cookie carries it into your next normal session.
- "It stops ads following me." Cookie-based retargeting is interrupted, because the advertising cookie does not survive the window. Fingerprint-based and IP-based targeting are not. Expect fewer follow-me ads for a day and then the same pattern if you keep using private windows on the same machine.
- "It protects me on public Wi-Fi." It does nothing for the network. Every packet leaves the device exactly as it would from a normal window. The protections that matter on an untrusted network are HTTPS-only mode, encrypted DNS and, if you want to hide destinations, a VPN.
- "It is untraceable." The website's server logs record the visit with your address and time; the ISP's logs record the connection; a court order reaches both. Private mode never touched either.
- "Nothing is left on the computer." The browser keeps its promise for history, cookies and cache. The operating system may still hold DNS cache entries, and files you downloaded stay where you saved them. On a shared machine, that is usually acceptable; for anything that matters, use a device you control.
What private mode is genuinely good for
- Shared or borrowed devices. The core use case. Nothing from the session is left for the next person.
- Checking how a site looks logged out. Developers, and anyone checking whether a price or search result is personalised, get a clean view.
- A disposable cookie jar. Visit something once without adding a long-lived tracking cookie to your main profile. The benefit is real but limited, for the fingerprinting reason above.
- Third-party cookies off in Chrome. Chrome blocks third-party cookies in Incognito by default even though it allows them in normal windows, and Google has been rolling out an IP-masking proxy for Incognito that hides your address from known third-party trackers. Our third-party cookies check will show the difference between the two windows.
- Extensions excluded. With extensions off, a private window is a quick way to see whether an extension is causing a problem, and it removes extension data collection from the session.
What to use instead, for each thing it cannot do
- To hide your IP address from sites: a VPN or Tor. They change which address the site sees; private mode does not. The trade-offs are compared in VPN vs proxy vs Tor, and remember to test for a WebRTC leak after connecting.
- To hide hostnames from your network: encrypted DNS plus a VPN. Without the VPN, the TLS handshake still names the server unless Encrypted Client Hello is in use.
- To be unrecognisable across visits: fingerprinting protection in a browser that ships it, a content blocker for tracking scripts, and, at the extreme, Tor Browser, which is built so every user looks the same.
- To keep a site from linking sessions: do not log in, and delete its cookies. Private mode does the cookie half automatically.
- To hide activity on a managed device: nothing available to you. Use a device you own.
The overall picture of who can observe what is in how online tracking works. Private mode addresses one observer, the next person at the keyboard, and does that well. Judged against that job it is a good feature. Judged against the anonymity its name implies, it is not even trying, and the vendors say so on the page it opens with. The rest of the tools that do the other jobs are catalogued in the browser security hub.
