Incognito Mode Explained — What It Does and Doesn't Hide

A private window is a forgetting feature for one browser on one device. It is not invisibility. The whole topic fits in one table, so here it is first, then the three traps that quietly undo it.

Updated September 2026By the AI Help Guide editorial team8 min read

The Whole Thing, In One Table

Who Can Still See You, And What Stops Them

Read this as the answer to "am I hidden?" for each layer. A check means incognito protects you there; a cross means it does not, and you need a different tool.

One line summarises the table: incognito governs what your browser writes to disk on this device, and nothing else. Every "No" row is a layer the window was never designed to touch, which is why people open it, see a clean history list, and wrongly conclude they are unobserved.

Myth vs Fact

The Four Beliefs That Get People Into Trouble

The Traps

Three Ways a Private Window Betrays You

1. The saved-password leak. Sign into your real account inside a private window and let the browser offer to save the password, and that credential can land in your password manager — sometimes syncing back to your own devices. The window forgets the session; the credential store does not. Decline every save prompt in private mode, and on a machine you don't own, avoid real logins entirely.

2. The extension you forgot. Extensions are off in private windows by default, but any you explicitly allowed keep running and keep seeing your traffic. A malicious or over-permissioned add-on therefore observes exactly the browsing you thought was isolated. Open your browser's extension settings and check which ones are permitted in incognito; keep that list as short as you can.

3. The download you walked away from. Files fetched in private mode go to your normal downloads folder and stay on disk. On a shared or public machine, that is a trace the next person can find. Take your downloads with you or delete them before you leave.

A Concrete Scenario

The Library Computer, Done Right

Suppose you need to look up a medical symptom on a public terminal. A private window is the correct first move: when you close it, the browser keeps no history, no cookies, no autofill, so the next user sees a clean session. That genuinely protects you from the realistic threat on a public machine — the person after you.

But do the three follow-ups or the protection is half-done. Decline any "save password" prompt. Carry your downloads off the machine. And accept that the library's own network logging and the website's analytics still saw the visit, because no window type changes that. If the threat were a monitored network rather than the next user, the tool would be a VPN, used alongside a private window for the local-cleanliness benefit. They stack; they do not replace each other.

Browser by Browser

What Each Browser Adds on Top of the Basics

The core behaviour is shared everywhere: history, cookies, site data and form entries are dropped when the window closes, while downloads and bookmarks stay. Beyond that, the browsers differ in small ways that are worth knowing before you rely on any of them.

Chrome blocks third-party cookies inside Incognito by default, which limits how much cross-site tracking can build up during a single private session. On phones it can also lock Incognito tabs behind your screen lock or biometrics, so a borrowed phone does not show an open private tab to whoever picks it up. That lock is a setting, so check whether it is actually switched on rather than assuming it is.

Firefox private windows apply its tracking protection, which blocks known trackers as pages load. Safari Private Browsing, in recent versions of iOS and macOS, also blocks known trackers and strips tracking parameters from links, and on iPhone you can require Face ID or a passcode to reopen your private tabs.

None of these extras changes the answer to the main question. They reduce what advertisers and casual observers can collect during the session. They do not touch what your network, your employer or the website itself can see, so the table above still holds for every browser.

Signed-In Sessions

Signing In Undoes the Point

A private window does not stop an account from remembering you once you sign in to it. If you log into Google inside Incognito and your activity controls are on, searches made while signed in can still be saved to your account history, just as they would be in a normal window. The same logic applies to any service with an account: the window forgets locally, and the account keeps its own record.

So if your reason for going private is to keep a particular search out of your history, do not sign in first. And if you do sign in, treat the session as an ordinary one. The activity controls that decide what a Google account keeps are covered in our guide to stopping Google from tracking you, and the same log is the surface behind recovering a search you have lost.

The practical habit is to decide before you open the window which of two jobs you are doing. If the job is keeping this device clean, use a private window and stay signed out. If the job is keeping an account clean, change that account's activity settings, because no browser mode can do that for you.

The Honest Default

When To Actually Use It

Use incognito for its real strengths: shared or borrowed devices, a second account session alongside your first, and one-off lookups you don't want shaping your normal profile. In those cases it is simple, effective, and free. Do not use it as an anonymity tool, because it is not one, and do not let its empty history list lull you into thinking a monitored network is unaware of you.

The mature position is to name the layer you are protecting. "This browser on this device" — incognito nails it. "The network between me and the site" — that is a VPN or Tor, with incognito on top only for local tidiness.