Incognito mode: what it really hides, and how to turn off incognito

What incognito mode actually does

So what does incognito mode do, precisely? When you open an incognito or private window, the browser starts a session it intends to throw away. During that session it still stores cookies, site data and history, because a website cannot function otherwise, since it needs to know you are the same visitor between one click and the next. The difference is that all of it goes into a separate container, and the container is deleted when the last window of that session closes.

The practical effects follow from that. Nothing you visit appears in your normal history. Sites you are signed into in the ordinary window do not recognise you, because the session starts with an empty cookie store. Anything you type into a form is not offered back to you as autofill later. And when you close the window, the browser has nothing left to hand over.

Two things survive on purpose, and both surprise people:

• Downloads. The file stays on your device. Only the entry in the download list is dropped, which is a distinction that has embarrassed a lot of people.
• Bookmarks. Anything you deliberately save is kept, on the reasonable assumption that a deliberate action was deliberate.

What it does not do

This is where the mode is most often misread, and the misreading is consequential enough that Google has revised the wording on Chrome's incognito screen more than once after criticism that users assumed far more protection than they were getting.

• The sites themselves see you. Your IP address is unchanged and every request looks ordinary. If you sign in, you are signed in, and the site knows precisely who you are.
• Your network sees the traffic. A workplace or school network, a public hotspot, and your internet provider observe the same connections they always would.
• The device may still record it. Managed devices, parental-control software and endpoint security tools log activity at a level the browser does not control.
• Fingerprinting still works. Screen size, fonts, time zone, graphics behaviour and dozens of similar signals do not reset with the cookie store.

A useful way to hold it: incognito answers the question "will the next person to use this computer see what I did?" It does not answer "can anyone tell it was me?"

How to go incognito

On a desktop, how to go incognito is one shortcut. Chrome and Edge use Ctrl+Shift+N, or Cmd+Shift+N on macOS. Firefox uses Ctrl/Cmd+Shift+P. Safari uses Cmd+Shift+N. All four also expose it in the main menu, under a name that varies: Incognito in Chrome, InPrivate in Edge, Private Window in Firefox and Safari, Secret Mode in Samsung Internet. The differences are entirely in the vocabulary.

The incognito meaning people arrive with is usually stronger than the one the browser implements: invisible, rather than merely unrecorded. Hold the narrower incognito meaning — the session is not written down on this device — and the behaviour is predictable in every browser on that list, including the ones that call it something else.

How to turn off incognito mode

There is no switch, which is why "how to turn off incognito mode" is searched far more often than the instructions for turning it on. You close the window and the session ends with it: on a desktop that is the whole of how to turn off incognito mode.

On a phone it is less obvious, because private tabs persist and the interface hides them behind a separate tab set rather than a separate window. There, how to go incognito and how to leave again are both questions about tab sets, and the steps differ enough by platform to be worth their own pages: Safari on iPhone and Chrome, Firefox and Samsung Internet on Android.

If a browser appears to open in private every time, it is almost always because it reopens whichever tab set you were last in. Switch back to the normal set once and close the app from there.

Where the mode genuinely helps

Shared and borrowed hardware is the honest use case, and it is a real one: a library terminal, a family tablet, a hotel business centre, a colleague's laptop. In every case the risk is local and the mode addresses it exactly.

It is also a working tool. Opening a site as a logged-out visitor without destroying your own session is useful for checking how a page looks to a stranger, for comparing search results against a personalised set, and for testing a sign-up flow. Support staff use it constantly for the same reason.

What it is not is a privacy measure against anyone upstream. If that is the concern, the tools are different ones — a VPN moves the apparent origin of the traffic, Tor removes the link between you and the destination, and neither is a checkbox in a browser menu. What a browser can meaningfully do about tracking sits in its settings rather than in this mode.

The mode is not identical across browsers

The storage behaviour is the same everywhere. What differs is how much extra protection each browser bolts onto the private window, and the differences are larger than the shared name suggests.

Firefox applies its strictest tracking protection in private windows, keeping cookies partitioned per site so a tracker present on many sites cannot join them into one profile. Safari goes further than most on links: in private browsing it strips known tracking parameters out of URLs you open and blocks known trackers from loading at all, and on recent versions it locks private tabs behind Face ID when you leave the app. Brave offers a private window that routes through Tor, which is a genuinely different proposition from the others because it does change the apparent origin of the traffic. Edge pairs InPrivate with its strict tracking-prevention tier. Chrome is the most conservative of the set, which is one reason its disclaimer has been the most contested.

None of this changes the boundary in the diagram above. A private window with aggressive tracker blocking still sends ordinary requests from your ordinary IP address, and the site at the other end still knows it was served.

What can still recognise you inside a private window

A private session starts with an empty cookie jar, which defeats the most common way sites follow people between visits. It does not make the browser anonymous, because a request carries far more than cookies. Your IP address is the same one, so any service that logs addresses sees the same origin it always did. The request advertises a user agent, a language list, the formats the browser accepts and a set of client hints, and that combination is often narrow enough to be distinctive on its own.

Beyond the headers sit the measurable properties of the device: screen dimensions, device pixel ratio, the fonts installed, how the graphics stack renders a test image, how many cores the machine reports, the timezone. Read together these produce a fingerprint that survives having no cookies at all, which is the mechanism behind the standard warning that private browsing is not a privacy tool in the way people hope. Safari and Firefox actively work against some of these signals, reporting rounded or generic values in private windows; the effect is to make the fingerprint less unique rather than to remove it.

The most reliable identifier is the simplest one. If you sign in to an account inside the private window, that account now knows the session is yours, and everything you do in it can be attached to the profile you signed into. This is worth stating plainly because it is where the expectation breaks most often: the window forgets you afterwards, but the service you signed into does not.

What it does to logins, 2FA and saved cards

Because the session begins with no cookies, every site treats you as a first-time visitor. Sites that remember a trusted device do so with a cookie, so a private window usually triggers the full second-factor challenge again, and a site with rate limits on new sessions may present a check you never normally see. Password managers still offer to fill credentials, since they live outside the session store, but a browser-native manager may require the device passcode first depending on how it is configured.

Payment autofill behaves the same way in reverse: cards saved in the browser are still offered, while cards remembered by the site are not, because that memory was a cookie. Anything you save during the session, from a bookmark to a downloaded file, is kept on purpose. The rule that predicts all of this is worth carrying around: a private window discards what the browser wrote about you, and nothing else.

Incognito, guest mode and a second profile

Browsers offer three overlapping ways to keep one activity apart from another, and picking the wrong one is common because the names do not describe the difference.

Incognito and guest mode are near-identical in what they store; the difference is that guest mode also hides your bookmarks and profile from whoever is using the machine, which is the point when the person at the keyboard is not you. A second profile is the one people actually want when they reach for incognito daily: it is persistent, it keeps its own history and passwords, and it never mixes the two sets of accounts.

The lawsuit that changed the wording

The gap between what incognito does and what users believed it did was large enough to litigate. A class action filed against Google in 2020 alleged that Chrome's incognito mode misled people into thinking their activity was private while Google continued to collect data about it. The suit sought around five billion dollars and was settled shortly before trial, with final approval sought in April 2024.

The settlement was not about payouts: it produced no automatic payments to users. It was about data and disclosure. Google was required to destroy or de-identify the browsing data it had retained from incognito sessions, running to billions of records, and to make the explanatory text clearer about what the mode does and does not prevent. Chrome was showing the revised wording by early 2025. A later attempt by a group of Chrome users to intervene and reopen a class-wide payout was ruled untimely by the Ninth Circuit in April 2026.

The practical lesson for a reader is not legal. It is that the confusion described at the top of this page was widespread enough to be a matter of public record, and that the current wording on the incognito screen exists because the previous wording was judged insufficient. It is worth reading rather than clicking past.

One consequence is worth stating on its own: a private session is per-window, not per-tab. Every private tab you open shares the same empty-at-the-start store, so two private tabs can see each other's cookies and a site opened in both recognises the same session. Closing one tab ends nothing. The store is discarded when the last private window closes, which on a phone means the last private tab in the group, and that is the step people skip.

Incognito and storage are different problems

A recurring confusion is between browsing privately and clearing what is already stored. Incognito prevents new local traces; it does nothing about the history, cookies and cached files already on the device from every normal session before it. Removing those is a separate operation, and on a phone it happens in two different places depending on what you mean — covered under clearing the cache on Android, where the distinction between cache, cookies and app storage decides whether you stay signed in.