Chrome Incognito on a shared PC: what stays behind?

You borrow a family laptop to check an email, download an attachment and then close the Incognito tab. The tab is gone. The attachment can still be sitting in Downloads.

Chrome Incognito limits what the browser keeps from a browsing session. Downloaded files and bookmarks can remain, and closing the browser does not delete records held by a website. Chrome's August 2021 Incognito messages explicitly warn that downloaded files and bookmarks are retained.

For a shared PC, three questions matter: which browser windows are still open, which files did you save, and whose Windows account are you using? Answering those gives you a useful way to finish the task without leaving more behind than you intended.

This guide covers Chrome on Windows as of 23 August 2021. It explains documented behaviour; the examples below are illustrative.

What Incognito clears, and what stays

Incognito gives you a temporary browsing session. Chrome's August 2021 Incognito messages identify the information it does not retain and the things you deliberately save.

A cookie can hold a website's sign-in state or preferences. Temporary cookies let a site work during the session; the word “private” does not mean the browser refuses to hold any data while you use it.

The scope is the browsing you do inside the private session. Opening Incognito after using an ordinary window does not undo those earlier visits. Start the private session before the activity you want to keep out of the normal browser history.

Closing one window may leave the session open

A second Incognito window belongs to the same open browsing session within that Chrome profile. Closing the first one does not finish the session while the second remains. Chromium's engineers confirmed this design : multiple Incognito windows share session state, including cookies.

Suppose you open window A for webmail, then window B for a related page. When you close A, B is still part of the session you started. A new window is not a separate private identity.

*Illustrative sequence, not elapsed time. Within the same Chrome profile, the Incognito session ends only when its last window closes.*

Before handing over the PC, check for other Incognito windows, including any minimised behind the one you were using.

Follow one downloaded receipt

Imagine you borrow your sibling's PC to retrieve a receipt for a purchase. You open Incognito, sign into your email, download the PDF and close every Incognito window.

There are now three different places to think about:

• Chrome's private session: its temporary cookies and site data have been discarded.
• The computer's storage: the PDF is still in the folder you chose.
• Your email account: the original message and attachment remain with the email service unless you take a separate action there.

The download list and the downloaded file are also different things. Removing a browser's record of a download does not remove the document itself. Google's 2019 explanation explicitly distinguishes those records from files stored elsewhere on the computer.

That distinction changes the plan before you start. If you only need an order number, consider viewing it on your own phone instead of saving the whole receipt onto a borrowed PC. If you need the PDF, decide where it should live and keep track of any copy you create.

For example, copying the PDF from Downloads to your own storage leaves the original copy to account for. Check the actual destination you used; a clean-looking browser window does not tell you whether the document is still there.

Signing in still tells a website who you are

Incognito does not stop a website recognising an account you deliberately sign into. Opening your email privately still requires the email provider to know which inbox to show you.

Google's Privacy Policy effective 1 July 2021 explains that information it collects while you are signed in can be stored with your Google Account. It also lists activity controls separately from the browser's private mode. Other services have their own collection and retention policies.

This means “not in Chrome's history” and “not recorded by the service” are different outcomes. If you search while signed into an account, do not use an empty local history list as evidence that the service has kept no record. Check that service's activity settings if that is what you want to control.

Mozilla's 2020 explanation of browsing history makes the broader distinction: browser history on your computer, website logs and third-party records can exist in different places. Ending a private session does not send a deletion request to all of them.

What your Wi-Fi provider or ISP can see

Incognito does not conceal your network connections. However, that does not mean an internet service provider can automatically read every page, password or message.

With a properly protected HTTPS connection, an ordinary passive network observer generally cannot read the page contents or the exact page path. The observer may still be able to identify the website you contacted. EFF's explanation of HTTPS and ISP visibility uses this distinction between a website and a particular page within it.

For example, knowing that a connection went to a retailer is different from reading the receipt displayed inside that connection. The encryption comes from HTTPS, whether you use an ordinary window or an Incognito window.

A managed work or school computer can be a different situation. Installed monitoring or configured HTTPS inspection may expose more than a passive network observer sees. Chromium's security FAQ describes this distinction. Incognito does not switch those controls off.

Guest mode helps with borrowing; separate accounts help with regular sharing

For a brief visit on a trusted person's computer, Chrome's Guest mode is worth choosing. Google's description of Guest mode says it starts with a blank browser profile, keeping the owner's other Chrome profile information out of that guest browsing interface.

This solves a different problem from temporarily browsing inside your own Chrome profile. Ask the owner to start a Guest session before you use their browser. Remember that a downloaded file can still stay on the PC.

Guest mode is not a separate Windows login. If people regularly share a computer, give them separate operating-system accounts and lock or sign out of your account when someone else takes over. Chromium's shared-computer guidance recommends distinct login accounts and screen locking.

Those accounts provide a more appropriate everyday separation for people's documents and app settings. They are not a guarantee against a malicious administrator or an already compromised machine.

For sensitive tasks on a public or unfamiliar PC, prefer your own trusted device. Private browsing cannot protect your activity from malicious software already running with your Windows account's permissions.

A practical handover routine

Use this sequence when you need a temporary session on a trusted shared PC:

1. Choose the session before you sign in. Use Guest when borrowing someone else's Chrome environment, or open Incognito for temporary browsing in your own profile. On Windows, Ctrl + Shift + N opens an Incognito window; the shortcut appears in Chrome's 2021 source messages .
2. Decide whether you need a local file. If you download one, note where it is saved. A sensitive document is better kept off a borrowed PC when you can complete the task on your own device.
3. Sign out of the websites you used. Finish or save any work first. This is a separate action from dealing with local files.
4. Account for what you deliberately saved. Keep the copy you need, then remove your unwanted downloads or bookmarks. Windows can put deleted files in the Recycle Bin . If your copy goes there, remove only that item too; do not empty the owner's other deleted files. This housekeeping does not guarantee secure erasure or remove copies elsewhere.
5. Close every window from the temporary session. Include Incognito windows hidden behind others. If you used Guest, finish that Guest session too. For your own Windows login, sign out before another person takes over, or lock it while you step away.

Before handing over, check that the private windows are closed, that you have accounted for the local copies you created, including any in Recycle Bin, and that the next person will use the appropriate Windows account.

Sources

• Google Cloud: Chrome Insider: A primer on enterprise private browsing modes , 26 November 2019.
• Chromium: Incognito interface messages in version 92.0.4515.159 and the security FAQ for that version .
• Google Chrome: Desktop release announcement for 92.0.4515.159 , 16 August 2021.
• Chromium: Engineering explanation of shared Incognito session state , 6 February 2012.
• Google: Privacy Policy effective 1 July 2021 .
• Mozilla: The USA Freedom Act and Browsing History , 22 May 2020; cited here for its technical explanation of where browsing records exist.
• EFF: Here's How to Protect Your Privacy From Your Internet Service Provider , April 2017.
• Microsoft: Managing the File System , updated 9 July 2021; cited for Recycle Bin behaviour.
• NIST: Guidelines for Media Sanitization, SP 800-88 Revision 1 , December 2014; cited for the distinction between removing a file and sanitising stored data.