Incognito vs. container tabs: what each one actually hides
Three different tools, three different jobs
“Incognito,” container tabs, and separate browser profiles all get lumped together as “the private browsing stuff,” and people pick between them based on vibes rather than what each one is actually built to do. That’s understandable, because browser vendors don’t explain the mechanics very well. But the three tools solve different problems, and using the wrong one for your situation means you end up with a false sense of separation.
Here’s what’s actually happening under the hood with each, and who they’re really protecting you from.
What private/incognito mode does
Private browsing windows (Chrome and Edge call it Incognito, Firefox calls it Private Browsing, Safari calls it Private) create a temporary, isolated storage container for that window. When you close it, the browser discards:
- Browsing history for that session
- Cookies and site data created during the session
- Local storage and cache
- Form and search autofill entries from that session
That’s the whole mechanism. It’s a scratch space that gets wiped on close. Most browsers also disable your regular extensions inside private windows by default, since extensions can read page content and write their own tracking data, which would defeat the point of the temporary container.
What private mode does not touch: your IP address, your device and browser fingerprint (screen size, installed fonts, GPU details, timezone, and dozens of other signals sites can read), your network’s DNS resolution, or anything visible to your ISP or network administrator. A website you visit in an incognito window can still recognize your connection as “probably the same person” through fingerprinting, and it still sees the same IP address it would in a normal window. Your employer’s network or your home router logs don’t care whether the tab said “incognito” on it.
The honest way to think about private mode: it’s aimed at the person who might look at your device later, not at the sites you’re visiting. It’s useful for shopping for a gift on a shared family computer, checking a second Gmail account without logging out of the first, or running a search you’d rather not have autocomplete later. It is not a tool for hiding what you do from the website itself or from anyone watching the network.
What container tabs actually do
Firefox’s Multi-Account Containers (and similar features in a few other browsers) take a different approach. Instead of a temporary wipe-on-close space, a container is a persistent, separate cookie jar that lives alongside your normal browsing. You can have a “Work” container, a “Shopping” container, and a “Personal” container open in tabs side by side, and each one keeps its own cookies, local storage, and logged-in sessions completely separate from the others.
The specific problem containers solve is cross-site tracking cookies that follow you between tabs in the same browser. If you’re logged into Google in one tab and browsing an unrelated site in another tab within the same container, tracking scripts and shared login cookies can link those visits together. Put those two activities in different containers, and the cookie jars don’t mix, so that particular linkage breaks.
Containers do not change your IP address. They do not alter your browser fingerprint, since the underlying browser, extensions, and device are all identical across containers. A site using fingerprinting rather than cookies to track you will generally still recognize you as the same visitor across containers, because the things fingerprinting reads (screen resolution, installed fonts, WebGL renderer info, and so on) are properties of the browser and device, not the container. Containers are a compartmentalization tool for accounts and cookies, not a general anti-tracking tool.
Where they genuinely shine is juggling multiple accounts on the same site without constantly logging in and out, or keeping your work Google identity from bleeding cookies into your personal browsing. That’s a real, specific problem, and containers solve it cleanly.
What separate browser profiles do
Browser profiles are the heaviest form of separation among the three, because they’re not a browser feature layered on top of one browsing session, they’re entirely separate instances of the browser’s data. Each profile has its own cookie storage, history, bookmarks, saved passwords, and, critically, its own set of installed extensions and settings.
That last part matters more than people expect. Extensions are a major fingerprinting and tracking surface. An ad blocker, a password manager, a shopping-rewards extension, each one can leak information about which extensions you have installed, and some inject content into pages in ways that sites can detect. If your “personal” profile runs six extensions and your “client work” profile runs zero, those two profiles will look meaningfully different to a fingerprinting script, which is a real separation containers can’t give you since containers share one extension set.
Profiles are still on the same machine, on the same network connection, with the same operating system and hardware reporting the same underlying fingerprint signals (GPU, screen, timezone, installed system fonts). A sophisticated tracker comparing fingerprints across your two profiles can still find similarities. Profiles reduce linkage, they don’t eliminate it.
Profiles are the right call when you want durable, everyday separation between contexts that matters over weeks or months, not just within a session, for example keeping a freelance client’s research entirely apart from your personal accounts, or keeping a business’s social accounts logically separate from your own. It’s a bigger commitment than a container tab because you have to actually switch windows or reopen the browser, but the isolation is more complete.
What none of these do
It’s worth being direct about this, because a lot of content online oversells all three of these features. None of them:
- Hide your IP address from the sites you visit or from your ISP
- Defeat browser fingerprinting on their own
- Stop your network operator (ISP, employer, school) from seeing which domains you connected to, since DNS queries and the destination server name in HTTPS connections are visible on the network unless you’re using something like encrypted DNS or a VPN, and even then the network operator sees that you connected to a VPN provider
- Prevent the website itself from logging your visit on its own servers
- Add up to being untraceable or fully anonymous, no matter how many of them you stack together
Pairing any of these with a VPN changes what your ISP and the destination site see about your IP address and general location, which is a genuinely different layer of protection, but it doesn’t erase fingerprinting, and it doesn’t make the combination “anonymous.” Each tool closes one specific gap. None of them, alone or together, closes all of them, and treating any single setup as a complete privacy solution usually just means you stop thinking about the gaps that are still open.
Picking the right one for the situation
A practical way to match tool to task:
- Use private/incognito windows for anything short-lived where you don’t want it in your history or autofill afterward, especially on a device other people use.
- Use container tabs when you’re regularly juggling multiple accounts on the same services and want their cookies to stop crossing over, without the overhead of switching windows.
- Use separate profiles when you want durable, extension-level separation between two contexts that both stick around, like a work identity and a personal one.
None of these decisions requires guessing. Each tool does one specific, mechanical thing, and picking correctly just means matching the mechanism to the actual gap you’re trying to close, rather than reaching for whichever one sounds the most private.
If you want more breakdowns like this one that stick to what tools actually do instead of what they’re marketed as doing, head back to the Privacy Wire homepage.