"Clear history" deletes the list of pages in the browser's history database. It is one record among many, and on a modern browser it is not even the most revealing one — cached favicons, site storage, autofill entries and the DNS cache each independently show where you have been.
If the goal is that someone else using your device finds nothing, you have to clear the whole set, and you have to know which items are outside the browser altogether. If the goal is that nobody anywhere knows, deletion is the wrong tool: the records that matter most were written on someone else's server.
What does your device actually store?
More than the history list, in more places.
| Store | What it reveals | Cleared by "Clear history"? |
|---|---|---|
| History database | URLs, titles, timestamps | Yes |
| Cache | Page assets, images, video segments | Only if selected |
| Cookies and site data | Login state, per-site identifiers | Only if selected |
| localStorage / IndexedDB | Application data, sometimes watch history | Usually with "cookies and site data" |
| Service worker caches | Whole offline copies of pages | Usually with site data; sometimes survives |
| Autofill and form data | Search terms, usernames, addresses | Separate checkbox |
| Saved passwords | Accounts you hold | No — never included |
| Download list | Filenames and source URLs | Only if selected |
| Downloaded files | The files themselves | No — deleted separately |
| Site permissions | Which sites you granted camera, notifications | No — cleared in settings |
| Favicon database | Every domain that set an icon | No |
| DNS cache (OS) | Domains resolved recently | No |
| Sync copy | Everything, on the vendor's servers | Depends on sync state |
| OS thumbnails and previews | Images from files you opened | No |
Two of these catch people out repeatedly. The favicon database retains a row per domain regardless of whether the history entry was deleted. And service worker caches can hold a functional offline copy of a page, which some browsers preserve unless you explicitly clear site data for that origin.
What is the correct clearing sequence?
Order changes the outcome, mostly because of sync.
- Decide about sync first. If you are signed in, delete while still signed in and with sync active, so the deletion propagates to the server copy. Signing out first leaves the remote copy untouched.
- Select all categories, not the default set. Browsers default to a narrow selection and a short time range. Set the range to all time and tick cache, cookies and site data, form data and download history.
- Clear site permissions separately. Notification, camera, microphone and location grants live in site settings and are not part of any history deletion. Granted notification permissions are also a live security issue.
- Delete the downloaded files. Emptying the download list leaves the files on disk, and then empty the trash.
- Flush the DNS cache at the operating system level:
| System | Command |
|---|---|
| macOS | sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder |
| Windows | ipconfig /flushdns |
| Linux (systemd-resolved) | resolvectl flush-caches |
- Check the browser account dashboard. If the browser vendor keeps a server-side activity record tied to your account, it is managed there, not in the browser.
What cannot be cleared from your device at all?
Everything written on the other side of the connection, and everything written by the network in between.
| Record | Held by | Your access |
|---|---|---|
| Connection logs | Your ISP | None |
| DNS query logs | Whichever resolver you use | None |
| Proxy and filter logs | Employer, school, managed network | None |
| Router logs | The router owner | Only if you own it |
| Account activity | Each site you signed into | Sometimes, via account settings |
| Server access logs | Every site you visited | None |
| Payment records | Your bank and card network | None |
This is the boundary that determines whether clearing history solves your problem. Against a family member on a shared laptop, it works. Against a network administrator or an ISP, it does nothing at all, because you were never deleting their copy.
Why is it better to store less than to delete more?
Because deletion is retroactive and always partial, while not writing the record is neither.
Practical configurations that reduce what accumulates:
| Setting | Effect |
|---|---|
| "Clear cookies and site data when you close all windows" | Wipes site storage every session, automatically |
| A separate browser profile for a separate purpose | Keeps history, cookies and permissions in different containers |
| Turn off history sync specifically | Local history stops being uploaded, while password sync can continue |
| Disable form and search autofill | Removes the most quotable single artefact |
| Turn off "preload pages" / prediction | Stops the browser resolving and fetching pages you never visited |
One honest caveat about deletion. On an SSD, overwriting a file does not reliably overwrite the physical blocks, and database files retain deleted rows until compacted. Ordinary deletion is sufficient against ordinary curiosity and is not designed to withstand forensic examination. If your threat model includes someone imaging the disk, the answer is full-disk encryption and a separate account — not a more thorough clearing routine.