Incognito mode — also called private browsing or InPrivate — is a local storage feature. It gives you a browser session that starts with no cookies and writes nothing durable when it ends. That is the entire mechanism.
It is not an anonymity feature, and the gap between what it does and what people assume it does is one of the widest in consumer software. The traffic leaving your machine in an incognito window is byte-for-byte the same traffic as in a normal window, sent to the same servers, over the same network, from the same IP address.
What does incognito mode actually do?
Two things, both about your own device.
It starts empty. The session begins with no cookies and no site storage from your normal profile, which is why you appear logged out everywhere. Sites cannot read identifiers your normal profile is carrying.
It ends clean. When the last incognito window closes, the browser discards history entries, cookies, site storage, cached files and form entries created during that session.
Both are real and both are useful — for a shared laptop, a borrowed computer, signing into a second account, or testing how a site behaves for a logged-out visitor. Nothing more is implied by either property.
Who can still see what you are doing?
Almost everyone outside your device.
| Observer | Can see your activity? | Why |
|---|---|---|
| Someone else using your device later | No | The local records were discarded |
| Websites you visit | Yes | They receive your requests and your IP address directly |
| Accounts you sign into | Yes | Signing in identifies you regardless of window type |
| Your internet provider | Yes | It carries the connection and can see destination addresses |
| Your DNS resolver | Yes | It answers every domain lookup you make |
| Employer or school network | Yes | Traffic passes through their equipment and often their filtering proxy |
| A managed or work device | Yes | Device-management software can log activity below the browser |
| Router owner | Often | Many routers log connected devices and destinations |
| Advertising networks | Partly | Cookie-based tracking resets; IP and fingerprint-based methods do not |
The employer case deserves emphasis, because it is the most common real-world misunderstanding. On a corporate network or a company-managed laptop, filtering and monitoring typically operate at the network or operating-system level. Incognito is a browser feature and sits above both. It has no effect on either.
What are the specific misconceptions?
Each of these is common, and each is false.
| Belief | Reality |
|---|---|
| "It hides my IP address" | The IP is set by the network; the browser cannot change it |
| "My ISP can't see it" | The ISP sees the same connections as always |
| "It's a VPN" | It performs no tunnelling and no rerouting of any kind |
| "Sites can't track me" | Sites see IP, user agent, screen and font characteristics regardless |
| "Downloads disappear" | Files you download persist; only the download list is discarded |
| "Bookmarks are temporary" | Bookmarks made in incognito are saved permanently |
| "It protects me from malware" | An executed file affects the device identically |
| "Nothing is recorded anywhere" | Every server you contacted has its own logs |
The download and bookmark cases produce the most awkward surprises, because both survive the session by design and neither is mentioned on the mode's splash screen.
What does incognito do about DNS?
Less than you might expect, and this is where the "nothing is recorded" belief usually breaks in practice.
Domain name lookups are made by the operating system or by the browser's own resolver, and the resolver answering them is the one configured on your device or network — typically your ISP's. Incognito does not change which resolver is used and does not prevent the resolver from logging the query. Some browsers keep DNS caching separate for private windows and some do not; the OS-level cache is unaffected either way.
The practical consequence: the list of domains you visited exists at your resolver whether or not the browser wrote anything down.
What actually addresses each concern?
Match the tool to the observer, rather than expecting one feature to cover all of them.
| What you want to prevent | What is relevant |
|---|---|
| Household members seeing local history | Incognito, or a separate OS user account |
| Records surviving on a shared device | Incognito, or full-disk encryption plus separate accounts |
| Your ISP seeing which domains you resolve | Encrypted DNS moves the queries to a different resolver — it does not remove them, it changes who holds them |
| Sites correlating you across visits | Blocking third-party cookies, separate profiles; fingerprinting still applies |
| An employer seeing your activity on their network | Nothing browser-side; use a personal device on a personal connection |
| A site knowing who you are | Not signing in — the single highest-impact step |
That last row is the one worth internalising. Incognito's protection ends the moment you authenticate. A private window with a signed-in account produces a permanent, identified activity record on the site's servers, and discards only the local copy you were least worried about.