Private browsing storage

A private window uses a separate storage context from your regular browser profile. Cookies, localStorage, IndexedDB, and cache created there are temporary. When the private session ends, the browser throws them away.

That’s the whole feature. It’s useful, and it’s much smaller than most people think.

What “session” means here

The lifetime rules differ by browser. In Chrome and Firefox, every private window shares one private session. The data disappears only when the last private window closes. Closing one window while another stays open clears nothing.

So don’t assume “closed the window, data gone”. Test it in the browsers you care about, because the isolation between private tabs and windows is not the same everywhere.

What private browsing does not do

Private mode protects against one thing: leaving history and site data on the device’s regular profile. It does not make you anonymous:

• the site still receives your IP address and every request you make
• your network administrator or internet provider still sees the traffic metadata
• files you download and bookmarks you save stay on the device
• signing in to an account identifies you, private window or not

An “incognito” label on the window changes nothing about what leaves the machine.

Test the boundary yourself

Open a regular window on any site and run this in the Console:

localStorage.setItem('mode', 'regular')

Now open the same site in a private window and read it back:

localStorage.getItem('mode')
// null

The private window can’t see the regular profile’s data. Set a different value in the private window, close every private window, open a new one, and read again. It’s gone.

What this means for your code

Your app must work when storage is missing or short-lived. Wrap localStorage access in a try block, because some configurations throw on write. Treat anything you stored as a cache, and rebuild it when it’s not there.

Two things I’d never do. Don’t try to detect private mode and use it as a security or auth signal. The detection tricks break with every browser release, and they answer the wrong question. And don’t promise users anonymity the browser can’t deliver. If your product needs privacy guarantees, they have to come from the server and the network, not from a window mode.