Open an incognito tab. Feel invisible? You're not.

Incognito mode does one thing: it stops your own browser from saving history, cookies, and form data on your device. That's it. It's a broom for your local footprints, not a cloak.

Here's who still watches you the whole time.

Who sees you in incognito

  • Your ISP. Every domain you visit passes through them. They log it. Some sell it.
  • Your router. The DNS lookups (turning example.com into an IP) often happen in plain text.
  • The websites themselves. They see your IP, your device, your login.
  • Your workplace or school network. If they run the router, they run the logs.

Incognito mode blocks none of these. The little "you've gone incognito" screen even admits it, in text nobody reads.

The myth that keeps spreading

People think incognito = anonymous. It got that reputation because the icon is a spy in a hat and the name sounds secretive. But it was built for a boring reason: shared computers. So your roommate doesn't see your gift shopping. So the next person at the library doesn't load your email.

That's the actual job. Private browsing is local privacy, not network privacy.

What actually hides your browsing

The biggest leak is DNS — the phonebook lookup that happens before any page loads. By default it's unencrypted, and your ISP reads it like a postcard.

Three fixes, easiest first:

  1. Turn on encrypted DNS in your browser. Firefox and Chrome both support DNS-over-HTTPS. Settings → search "DNS" → pick a provider like Cloudflare or Quad9. Now your lookups are sealed envelopes.

  2. Self-host Pi-hole. Run it on a Raspberry Pi or an old laptop. It becomes your home's DNS server, blocks ad and tracker domains network-wide, and shows you exactly which apps are phoning home. Pair it with DoH upstream and your whole house gets encrypted lookups — no per-device setup.

  3. Add a VPN when you need to hide the destination too. DNS encryption hides the phonebook lookup; a VPN hides the actual traffic path from your ISP. Use both for real coverage.

A 2-minute test

Want proof your ISP sees your DNS? Visit dnsleaktest.com and run the extended test. If the server list shows your ISP's name, your lookups are wide open — incognito or not.

Run it again after enabling encrypted DNS. The name changes. That's the whole point.

The takeaway

Incognito mode protects you from the person sitting at your desk next. It does nothing against your ISP. Turn on DNS-over-HTTPS in your browser today — it takes 60 seconds and closes the biggest leak most people never knew was open.