What Incognito Actually Hides
Private mode is real, useful, and far smaller than its name suggests. It hides your browsing from other people who use your device — and from almost nobody else.
When I really want privacy I open an incognito window. That makes me anonymous, right?
It is my favourite kind of "private." It hides you from whoever else uses your laptop — your family, your flatmate. From me, on the network and on the site, it hides nothing at all.
Private mode is genuinely useful, but its name oversells it by a mile. It is worth knowing exactly the one thing it does, and the long list it does not.
The one thing it does
A private window keeps this device from remembering the session. When you close it, the history, the cookiesCookieA small labelled note a website asks your browser to keep and hand back on your next visit — how a site remembers you between pages., and the local storage from that session are discarded, so the next person to open the browser sees no trace. That is the whole feature: it protects you from other people who use the same machine.
The long list it does not
Everything outside your device still sees you exactly as before. Your IP addressIP addressThe number that identifies where your traffic comes from on the internet — roughly, which door it should be delivered back to. is unchanged, so the sites you visit and your ISPISPYour internet service provider — the company whose wire or signal you use to reach the internet, and which can see every site you connect to. see the same connection. The site still knows who logs in. FingerprintingBrowser fingerprintA near-unique profile of your device built from the small ways your browser differs from everyone else's — no cookies required. still identifies the browser. Within the session, trackers still course. Private mode changes none of it.
Incognito hides from: other users of THIS device (yes)
Incognito hides from: the websites you visit (no)
Incognito hides from: your ISP / employer / network (no)
Incognito hides from: trackers during the session (no)
- Line 1The real and only promise: nothing from this session is left on the device after you close the window.
- Line 3Your network sees every destination as usual. On a work or school network, "incognito" is not private from the people who run it.
You log into your email in a private window, on your home connection. Who can still tell it was you?
You browse in incognito on your employer's Wi-Fi. Who can still see which sites you visit?
Trusting the name
- Believing incognito makes you anonymous to sites or the network
- Assuming your ISP or employer cannot see incognito browsing
- Reaching for it to hide activity from a serious adversaryUsing it for what it is
- Using it to keep a shared or borrowed device from remembering a session
- Reaching for a [[vpn|VPN]] to hide destinations from the local network
- Reaching for [[tor|Tor]] when you need to hide from the site and the network both
- Matching the tool to the row of your [[threat-model|threat model]] it answersPrivate mode answers exactly one question — "will this device remember?" — and answers it well. For "can the network see me?" or "can the site identify me?" you need the tools from the rest of this course.
So incognito is "my laptop forgets", not "I disappear." I had those completely confused.
Almost everyone does — the name invites it. Keep the one real use in mind, and reach for a VPN or Tor when the adversary is the network or the site, not your own device.
And I will keep quietly enjoying every "private" window opened on a network I am watching. It hides you from the person next to you, and hands the rest to me.
Legal
Using private mode to keep your own device tidy is entirely ordinary. Relying on it to evade monitoring you are subject to, or to hide unauthorised activity, is both ineffective and beside the point — it was never private from the network in the first place.
So private browsing is real but narrow: this device forgets the session, and nothing more. Your IP, the sites, the network and the trackers are untouched. Next: the padlock — what HTTPSTLSThe encryption behind the padlock — it scrambles the contents of a page between your device and the site so nobody in between can read it. actually promises, and the three things people wrongly think it does.