"I was in Incognito mode!" is a defense that falls apart the moment you understand what Private Browsing actually does. It is one of the most misunderstood features in modern computing — a checkbox people treat as an invisibility cloak when it's really just a broom that sweeps your own device after you close the window.

Incognito (Chrome), Private Browsing (Firefox and Safari), and InPrivate (Edge) are all the same idea under different names. They protect you from exactly one adversary: someone else who uses the same physical device. That's it. Everyone else on the path between your keyboard and the website still sees what they always saw.

What Incognito actually does

When you open a private window, the browser spins up a fresh, temporary profile that is discarded when you close it:

No local history. URLs you visit aren't written to your browsing history.
A clean cookie jar. You start logged out of everything, and any cookies set during the session are deleted on close.
No cached files. Images, scripts, and pages aren't kept in the local cache.
No autofill saved. Form data and search-bar suggestions from the session don't persist.

That's genuinely useful for narrow jobs: checking a flight price without your loyalty cookie skewing it, logging into a second account, or using a shared library computer. The keyword is local. Incognito changes what your own machine remembers — nothing more.

What Incognito does NOT do

Here is where the myth lives. Private Browsing does not make you anonymous on the network.

It doesn't hide you from your ISP. Your Internet Service Provider still sees every domain you connect to. Even with HTTPS encrypting the page contents, the domain name leaks through DNS lookups and the TLS handshake (SNI).
It doesn't hide you from the website. You still have a public IP address. You still carry a browser fingerprint — screen size, fonts, timezone, GPU, and dozens of other signals that identify you without any cookie at all. Ironically, blocking cookies can make fingerprinting the more attractive tracking method for the site.
It doesn't hide you from network admins. On a work, school, or corporate Wi-Fi network, the administrator can see the domains you reach regardless of Incognito. If IT has installed a root certificate on a managed laptop, they may see the full contents too.
It doesn't stop malware or extensions. A keylogger, a compromised extension, or monitoring software runs the same in a private window.
It doesn't protect what you send. The moment you type into a form and hit submit, that data leaves your browser exactly as it would in a normal tab.

The logged-in trap

The most common real-world mistake: people open Incognito, then log into Google, Facebook, or Amazon out of habit. The instant you sign in, that service knows exactly who you are and can tie the entire session to your account. Private Browsing gives you a blank slate — and users immediately fill it in with their identity. A clean cookie jar is worthless if you personally hand the site your username.

Who can actually see your traffic

A useful way to think about it — the chain of people between you and the site:

| Observer | Sees your activity in Incognito? | | --- | --- | | Someone on your device (later) | No — history is wiped | | Your ISP / mobile carrier | Yes — domains and timing | | Network / IT admin | Yes — domains, sometimes contents | | The website itself | Yes — IP + fingerprint | | Trackers embedded on the site | Yes — via fingerprint |

Incognito closes exactly one row of that table. If your threat model involves any of the others, you need real tools.

Real anonymity, and its limits

If you want to hide where you're going from the network, you need a VPN. It encrypts a tunnel between you and the VPN server, so your ISP and the local network admin can't see inside — they only see traffic to the VPN. But note the tradeoff: you're not eliminating the observer, you're moving trust to the VPN provider, who can now see your traffic. Choose one that doesn't log, and understand a VPN does nothing about your browser fingerprint or the accounts you log into. We go deeper on this in do you need a VPN.

If you want to hide who you are from the website, you need Tor, which bounces your connection through several volunteer relays so no single hop knows both your identity and your destination. Tor is far stronger for anonymity but slower, and some sites block it outright.

Neither tool is magic, and stacking them incorrectly can actually make you more identifiable. Anonymity is a discipline, not a button.

The part nobody thinks about: what the server keeps

Here's the deeper problem the Incognito myth distracts from. Even with a perfect VPN, Tor, and a hardened browser, you have zero control over what the other end stores. You close your private window and your device forgets — but the server on the receiving end remembers everything you sent for as long as it likes.

If you paste a password into a chat, email a document, or drop credentials into a support ticket "in Incognito," that data now lives on someone else's disk, in their backups, and in their logs indefinitely. Your browser forgetting is the least important half of the equation.

This is where true ephemerality has to be enforced at the source, not the browser. It's the core idea behind SnapSend: when you share a secret or file, it's encrypted in your browser with AES-256-GCM before anything is uploaded, and the decryption key lives in the URL's #fragment — a part of the link browsers never transmit to servers. The server only ever holds ciphertext it cannot read. Set the link to burn on read and it's destroyed the instant the recipient opens it. When we say "deleted," a TTL eviction actually removes the ciphertext — there's nothing left to subpoena or forensically recover.

Common mistakes and a quick checklist

Mistakes to avoid:

Treating Incognito as a VPN. It isn't one.
Logging into personal accounts and expecting to stay anonymous.
Assuming "private" means "encrypted" — it means "not saved locally."
Sending sensitive data in a private tab and thinking it vanished. The recipient's server kept it.

A realistic checklist for actual privacy:

[ ] Use Incognito only to keep your own device clean.
[ ] Add a no-log VPN or Tor to hide traffic from the network.
[ ] Test how identifiable your browser is with a privacy check.
[ ] For any secret or file you send, use a tool that self-destructs server-side.

Incognito mode isn't a lie because it does nothing — it's a lie because of what people believe it does. Understand its real, narrow job and it becomes a handy tool instead of a false sense of security.

Need to send a password or file that genuinely leaves no trace once it's read? Create an encrypted, self-destructing SnapSend link — no account required.