Browser Fingerprinting in Incognito Mode

Browser Fingerprinting in Incognito Mode: What Private Browsing Hides

Incognito mode does not prevent browser fingerprinting.¹ Opening a private browsing window creates a fresh session with no cookies, no browsing history, and no form data, but none of these changes affect the hardware signals that fingerprinting scripts collect.² Your canvas hash, WebGL renderer string, audio fingerprint, screen resolution, hardware concurrency, and installed font set are all identical in an incognito window compared to a regular window, because they reflect the underlying browser and hardware configuration rather than stored session data.

Consequently, a site that records your fingerprint in a regular session can re-identify you when you visit in incognito mode, without any cookies or localStorage data.¹ Building on this, many users rely on incognito mode as a privacy tool without understanding that it was designed to prevent local history exposure, not cross-site tracking. The fingerprint persists across private and regular windows because it is computed fresh from hardware on every page load.

What incognito mode clears versus what fingerprinting uses

Incognito mode performs a defined set of session isolation operations. It starts a fresh cookie jar, clears any localStorage and sessionStorage from previous sessions, discards the browser history for the session, and prevents form autofill data from being saved. These protections are effective against attacks that rely on reading previously stored data, tracking pixels that set a first-party cookie, or scripts that read a user ID from localStorage. Yet fingerprinting scripts do not read stored data.

Why incognito does not erase live signals

They call browser APIs to retrieve live hardware and software characteristics: HTMLCanvasElement.toDataURL() to get the GPU-rendered pixel hash, navigator.userAgentData to get the browser version, OfflineAudioContext to hash the audio processing output, and screen.width to get the display dimensions.² Consequently, none of the values these APIs return change between a regular window and an incognito window on the same machine. Building on this, the fingerprint computed in incognito mode is byte-for-byte identical to the fingerprint from the previous regular session.

You can confirm this for yourself by opening the inspector in a normal window, recording the entropy score, then opening an incognito window on the same machine and running the same check. The score and the individual signal rows stay the same, which shows that private browsing changes nothing about what a script can read. The only way to alter the result is to switch to a browser with built-in anti-fingerprinting or to enable a protection setting that changes the underlying values.

How a fingerprint persists across regular and incognito windows

The mechanism of fingerprint persistence across window modes is structural rather than a design flaw in the browser's implementation of private browsing. Fingerprinting works by computing a deterministic function of stable hardware and software inputs that remain identical regardless of which window mode is active.³ The GPU model does not change between windows, the font rasterizer does not change, the CPU core count does not change, and the audio driver behavior does not change because none of these are session-level properties.

When private browsing still helps

Consequently, identical inputs produce identical outputs on every computation, regardless of which browsing mode the window uses. Building on this, a site that records a fingerprint hash during a regular session will see the same hash when the user visits in an incognito window the next day. There is no session boundary that separates these computations because no session data is involved in generating the hash. Furthermore, the fingerprint is stable even across browser restarts, VPN connections, and IP address changes, none of which alter the hardware configuration that produces the hash.

What actually reduces fingerprinting in private browsing

Adding meaningful fingerprint protection to a private browsing session requires browser-level changes that go well beyond the standard incognito implementation found in most browsers. Brave's private browsing mode applies the same farbling protections as regular Brave windows, including canvas noise injection, WebGL suppression, and audio context randomization, on top of the standard session isolation that clears cookies and storage.⁴ Firefox's private windows do not apply RFP protections unless privacy.resistFingerprinting is manually enabled in about:config, which then affects all windows globally rather than being scoped to private mode only.⁵

Tor Browser's private mode eliminates high-entropy signals by normalizing all fingerprint surfaces across all Tor users, providing the strongest protection at the cost of browsing speed, since every Tor user appears to share identical hardware characteristics regardless of their actual device configuration.⁶ Conversely, Chrome's Incognito mode and Safari's Private Browsing mode provide no fingerprint protection beyond standard session isolation, leaving every hardware signal fully exposed to any script that runs in the private window.⁷

Which private mode is actually safer

For users who want private browsing that also resists fingerprinting, the choice of browser matters more than which browsing mode is selected. Brave private windows apply canvas farbling, WebGL suppression, and audio randomization on top of standard session isolation, making them meaningfully more resistant than Chrome Incognito or Safari Private Browsing, which provide no fingerprint protection at all. Firefox private windows with privacy.resistFingerprinting enabled also reduce high-entropy signals, though the setting applies globally rather than being scoped to private mode. Test the exact fingerprint before trusting the mode label, because the name "private" or "incognito" tells you nothing about whether the browser actually modifies the hardware signals that fingerprinting scripts collect.

When to use this

Use this guide when checking whether incognito mode changes your fingerprint before relying on private browsing, or when explaining why a fingerprint score is identical between private and regular browser windows on the same machine.

Examples

Open CapyToolkit Browser Fingerprint Inspector in a regular Chrome window. Record the canvas hash value shown under the Canvas row.

Open the same tool in a Chrome Incognito window. The canvas hash is identical to the regular window value. Incognito cleared cookies; it did not change the GPU rendering behavior that produces the hash.

Chrome Incognito: canvas hash = c84efb8e... (identical to regular Chrome window, no protection)

Brave Private Window: canvas hash = 7a1df3c9... (different from regular Chrome baseline, changes per origin, farbling active)