Blog
Most of us browse in one window that is signed in to almost everything: email, the bank, online shops, social media, work tools. That is convenient, but it also means that every page you open arrives in a browser that is already logged in to all of them. Browsers already keep sites apart, so an unrelated page cannot simply read your mail or your bank account. But requests it makes to those sites can carry your login cookies, and on a vulnerable service that can be enough to act on your behalf. For links you trust, that is fine. For a link from someone you do not know, a message you were not expecting or a QR code on a sticker, there is a simple way to keep it away from all of that: open it in a private window.
What a private window changes
Every major browser has one: Firefox and Safari call it private browsing, Chrome calls it Incognito, and Edge calls it InPrivate. What matters here is that it does not share your everyday session. Google's Chrome help says that when you open an Incognito window, Chrome starts a separate browsing session, and that Chrome doesn't automatically sign you into your Google Account or other websites. Apple's Safari guide says that in Private Browsing, browsing started in one tab is isolated from browsing started in another.
For a link you do not trust, that has two practical effects:
- The page cannot ride on your existing logins. Requests the page makes to your mail, bank or shop do not carry the login cookies of your normal window, which limits attacks that rely on them, such as cross-site request forgery against a vulnerable service. Work computers managed by an employer can be set up to sign in to work sites automatically, even in a private window, as Microsoft describes for Edge.
- What the page stores does not stay. Google and Microsoft say that Chrome and Edge delete the cookies and site data of the private session when you close all private windows, and Apple says that in Safari's Private Browsing, changes to your cookies and website data aren't saved.
It also hands you a clear warning sign. If a page you reached through an unknown link asks you to sign in, that is not the private window being awkward. It is the moment to close it and go to the service yourself, by typing its address or opening its app.
It does not make the link safe.
One detail matters. In Chrome and Edge, a private session is not reset per window: Chrome's Incognito session ends only when you close all Incognito windows, and Microsoft notes that cookies are not deleted until you close all InPrivate windows. So use the private window for the unknown link only, do not sign in to your real accounts there, and close every private window when you are done.
What a private window does not do
Private browsing is often oversold, so it pays to be precise. This is what the browser makers themselves say:
- It does not make you anonymous. Google says Incognito doesn't make you invisible: the websites you visit, and organisations that manage your network, such as your school, employer or internet service provider, may still be able to see your activity. Microsoft says your school, workplace and internet service provider might still be able to access your InPrivate browsing data, and Mozilla says Firefox's private browsing does not stop your internet service provider from logging what you do.
- It does not protect you from malware. Mozilla says private browsing will not protect you from malware or viruses, and Microsoft says InPrivate doesn't keep you safer from malicious websites. Files you download also stay on your device after you close the window, as Google and Apple both point out. A link can also start a download instead of showing a page: cancel unexpected downloads and do not open the file. Some browsers can open certain downloaded files automatically, such as Safari's Open “safe” files after downloading option, so check that setting too. So do not download or open anything from a link you do not trust, private window or not.
- It does not stop you from giving your password away. A fake login page looks exactly the same in a private window. Type your password or card details into it and they are gone, whichever window you used.
- It does not remove what the link itself carries. A personalised link can identify you to whoever sent it, and some links sign you in without a password. Do not open unexpected sign-in, password-reset or account links to explore them; go to the official service yourself.
How to open a link in a private window
In most browsers, the menu you get when you right-click a link on a computer, or touch and hold it on a phone, offers to open it in a private window. Two examples from the official help pages: in Edge, right-click a link and select Open link in InPrivate window; in Chrome on Android, touch and hold the link and tap Open link in new Incognito window (Google's Android instructions).
Links in an email app, a chat app or a QR code scanner open wherever that app sends them, which is often your normal browser window. If you want the private window instead, copy the link address itself rather than tapping the link, for example with Copy link address in the link's menu, not its visible text. Then open a new private window and paste the address into the address bar. In Chrome on a computer, the More menu has New Incognito window (or press Ctrl + Shift + N, or ⌘ + Shift + N on a Mac); in Safari on a Mac, choose File > New Private Window.
One habit among several
A private window limits what an unknown link can reach. It does not tell you whether to open it in the first place. These habits matter more, and come first:
- Look at the real destination before you click. The words in a message are not the address you visit. In Email link phishing: why your email app should always show the URL I argue that email apps should show that address by default, and Different hostname behind a link: red flag or harmless? explains how to judge an address that differs from the text.
- For anything involving your account or your money, skip the link. Go to the official website or app yourself, using an address you know or the app you already have.
- Let a tool show you the address an email link points to. Reveal URLs is a free, open-source browser extension and email add-on that shows each link's actual immediate URL before you click. It shows the immediate URL; it does not follow redirects.
- Check where a QR code goes before you open it. A QR code with a web address is a link you cannot read until something decodes it. If your scanner shows the address first, read it as carefully as any other link, as described in Scanned a QR code? Check the web address first.
Then, if you still want to see where an unknown link leads, open it in a private window, do not sign in, download nothing, and close every private window afterwards.
