Incognito mode cookies live in a temporary jar that gets thrown out when the last private window closes. Most people still misjudge what goes into that jar and what leaks out of it. This guide covers both.
Key Takeaways:
- Incognito starts with 0 cookies from your regular profile. Every cookie set during the session is deleted when the last private window closes, not when a single tab closes.
- 4 storage types follow the same lifecycle: cookies, localStorage, sessionStorage and IndexedDB. All start empty and all are wiped on close.
- 3 things survive the session: downloaded files, bookmarks and changed browser settings. Incognito controls what your browser remembers, not what you saved on purpose.
What Happens to Cookies in Incognito Mode?
Incognito mode is a browser session that starts with an empty storage jar and discards that jar when the session ends. This means nothing from your regular profile follows you in, and nothing from the private session follows you out. For example, a site you’re logged into in your normal window will greet you as a stranger in a private one.
Four storage types start empty in every new private session: cookies, localStorage, sessionStorage and IndexedDB. Your existing logins don’t carry over because the cookies that hold them stay in the regular profile. The browser creates a separate, temporary store and keeps the two apart.
Do cookies work in incognito mode? Yes. They work normally inside the session. Sites can set them, read them, and keep you logged in until the session closes. They just don’t last.
That’s the whole mechanism. Incognito changes how long your browser keeps data. It doesn’t change how websites handle you while you’re connected.
I’ll say it once, because it trips up almost everyone. This describes what the browser stores locally. Nothing else. The rest of this article keeps coming back to that boundary.
Does Incognito Mode Delete Cookies, and When Exactly?
Yes, incognito mode deletes cookies, but the trigger is where people get it wrong. The browser discards everything when the last private window closes. One tab or one window closing does nothing.
Here’s the timeline:
- Open a private window. Storage starts empty.
- Visit sites. They set cookies, and the browser keeps them for the duration.
- Close one tab. Nothing changes, because the session is still alive.
- Close one of two open private windows. Nothing changes again. Closing 1 of 2 private windows deletes 0 cookies.
- Close the last private window. The browser discards every cookie and all site data at once.
Quitting the browser entirely also ends the session, so the same wipe happens there.
The common failure mode is a forgotten window. Leave one private window minimized behind your other work and the whole session stays alive, logins included. Someone who shares your computer can open that window and walk straight into your accounts.
Common misconception: people think closing a private tab clears that tab’s cookies. It doesn’t. The jar belongs to the session, not the tab.
Are Cookies Shared Between Incognito Windows and Tabs?
Yes, cookies are shared between incognito windows, as long as they belong to the same private session. One private session holds one shared cookie store. A login you complete in one private tab shows up in the next one you open.
The isolation boundary runs in the other direction. The private session can’t read cookies from your regular profile. Your regular profile can’t read the private ones. Two walls, one jar inside the private side.
This has two practical consequences. First, you can test a site as a logged-out visitor, because the private session starts with no trace of your account. Second, two private windows won’t give you two separate logins on the same site. Two private windows on the same site share 1 login, not 2. People try this to run two accounts side by side and get confused when the second window is already signed in as the first user.
Browsers handle this slightly differently. Firefox offers containers, which split cookie storage into labeled lanes, and Chrome treats all its private windows as one session. Check how your browser behaves before relying on it. I’m only flagging the difference here, not digging into it.
Keep the scope in mind. Everything above concerns client-side storage on your device. Nothing here describes what a website or network can observe.
Which Data Gets Deleted and Which Data Persists?
Incognito mode discards cookies, site data, history and form entries when the session ends, and it leaves downloads, bookmarks and settings intact. The table covers 11 data types. Only 3 persist after close.
| Data type | Created or shared during the session | Survives closing? |
|---|---|---|
| Cookies | Created by sites, shared across the private session | No |
| localStorage | Written by sites, shared across the private session | No |
| sessionStorage | Written by sites, scoped per tab | No |
| IndexedDB | Written by sites, shared across the private session | No |
| Browsing history | Not recorded locally | No |
| Form entries | Held temporarily, not saved | No |
| Autofill data | New entries not saved | No |
| Saved passwords | New credentials not saved | No |
| Downloaded files | Written to your disk | Yes |
| Bookmarks | Written to your profile | Yes |
| Changed browser settings | Written to your profile | Yes |
Does incognito mode save passwords or autofill data? The browser doesn’t save new passwords or form entries from a private session. Credentials already stored in your regular profile or a password manager may still be offered inside a private window, depending on your browser and extension settings. Check yours instead of assuming.
The rule is short. Anything you deliberately saved to disk or changed in settings stays. Anything the browser collected passively gets dropped.
How Do Third-Party Cookies Behave in Incognito Across Browsers?
A third-party cookie is a cookie set by a domain other than the one in your address bar. Embedded content, ad networks and analytics scripts use them. This matters because they’re how one company recognizes you across many unrelated sites.
Chrome blocks third-party cookies by default in incognito, and you can toggle that setting. Firefox takes a different route called Total Cookie Protection, which gives each site its own separate cookie jar so a tracking cookie can’t be shared between sites. That’s 2 distinct mechanisms: blocking in Chrome, partitioning in Firefox.
| Browser | Default behavior in private mode | Who can change it |
|---|---|---|
| Chrome | Blocks third-party cookies in incognito | You, through cookie settings |
| Firefox | Total Cookie Protection partitions cookies per site | You, through privacy settings |
| Brave | Applies its own restrictions in every mode | You, through shield settings |
| Safari | Applies its own restrictions in every mode | You, through privacy settings |
Brave and Safari restrict cross-site cookies even outside private mode, so a private window adds less difference there than it does in Chrome.
Defaults change between releases. I’m not going to give you version numbers I can’t verify, so confirm the behavior in your own version’s settings.
Why Do Deleted Cookies Not Make You Anonymous, and What Do Separate Profiles Add?
Incognito mode controls what your browser remembers. Separate browser profiles control what websites can see and correlate. They solve different problems, and neither replaces the other.
Here’s the boundary. Incognito leaves your browser fingerprint untouched: user agent, screen size, fonts, canvas, WebGL, timezone, language and the TLS/JA3 fingerprint your browser produces during the handshake. A fresh, empty cookie jar still rides on the same device signature. This is a one-paragraph boundary note, not a network explainer.
If you want to understand fingerprinting from the ground up, start with what a browser fingerprint is. If you’re comparing the two approaches directly, incognito vs browser profiles covers that in depth.
Separate profiles add five things incognito doesn’t:
- Persistent storage. Each profile keeps its own cookies and logins between sessions, the opposite of incognito’s wipe-on-close.
- A distinct fingerprint configuration. Each profile carries its own setup instead of the device default.
- Aligned signals. Timezone, locale and geolocation can match the profile’s exit IP, so the signals agree with each other. A timezone and geolocation mismatch with the proxy is one of the most common reasons accounts get linked.
- Graduated protection. You set base, medium spoof or full spoof per profile and raise it as an account matures.
- Real browsers. Chameleon Mode runs vendor-signed Chrome, Firefox, Brave and Edge, not a modified Chromium fork, so the native TLS/JA3 handshake stays authentic.
Who needs this? Affiliates, agencies, e-commerce sellers and social media managers who run multiple accounts. If you open one personal account, incognito is plenty.
Chameleon Mode is built around separate environments. It has operated since 2014 as BrowSEO and relaunched under its current name in 2019. It’s a different tool for a different problem, not a replacement for incognito. You can start the 7-day free trial at chameleonmode.com and judge it on your own workflow.
Frequently Asked Questions
Does incognito mode save passwords or autofill data?
Incognito doesn’t save new passwords, form entries or autofill data from a private session once it closes. Credentials already stored in your regular profile or a password manager extension can still be offered inside a private window, depending on your browser and extension settings. Check both before assuming a clean slate.