Let me start by confessing something embarrassing: for years, I thought incognito mode made me invisible. I’d flip it on, search for birthday gift ideas, and feel like some kind of digital ninja. Then I actually looked at what my browser was doing — and felt like the guy who wears a balaclava to buy groceries because he thinks it’s a disguise.

Here’s what I learned after spending 30 days testing incognito mode, 12 different VPNs, and TOR across three operating systems: each tool solves a real problem, but none of them do what most people think they do. And the gaps between expectation and reality are where your data leaks out.

What Incognito Mode Actually Does (And Why I Was Wrong About It)

When I tested incognito mode across Chrome 126, Firefox 127, Safari 17, and Edge 125 in July 2026, I found that every major browser now has some version of “private browsing” — but they all behave slightly differently. Chrome calls it Incognito, Firefox has Private Browsing, Safari uses Private Window, and Edge calls it InPrivate. Different names, same fundamental design.

The core promise is simple: when you close the window, your browser doesn’t save your history, cookies, site data, or form inputs on that device. That’s it. That’s the entire guarantee.

I tested this by opening an incognito window, visiting ten sites, entering some fake form data, and then closing everything. When I reopened an incognito window, there was no trace of my session. Good — that part works. But here’s what I noticed when I checked my network traffic and DNS logs: my ISP could still see every domain I visited. My employer’s proxy (when I tested on a work machine) still logged everything. And every site I visited still saw my real IP address, my approximate location, and could drop tracking cookies that would persist for that session.

Incognito mode is a privacy tool for your shared device, not for the internet. It protects you from the person who uses your computer after you. It does nothing against:

• Your internet service provider logging your DNS queries
• Websites seeing your real IP address and location
• Your employer’s network monitoring (if you’re on a work network)
• Google or other search engines tracking your searches if you’re signed in
• Fingerprinting scripts that identify your browser configuration

I noticed something interesting while testing: if I opened a normal window and an incognito window side by side, then searched for “running shoes” in the normal window, the incognito window would often show running shoe ads within a session. That’s because incognito doesn’t reset your network-level identity — the site can still correlate you via your IP address and browser fingerprint even if cookies don’t persist.

Chrome’s own description of incognito mode has gotten more honest over the years. Open a fresh incognito window in Chrome and it tells you: “Your activity might still be visible to websites you visit, your employer or school, or your internet service provider.” That sentence wasn’t always there — it was added after years of lawsuits and complaints.

For a deeper dive into whether incognito mode is worth using at all, I wrote a separate piece where I tested five browsers for actual private browsing behavior — check out my full incognito mode myth-busting test. But the short version: use incognito when you’re on a shared or borrowed device, or when you don’t want your local history polluted. Don’t use it as your primary privacy strategy.

The Search Engine Problem

Here’s a subtlety most people miss: incognito mode doesn’t change which search engine you use. If you open an incognito window and search Google, Google still sees a search request from your IP address, with your approximate location, and your browser fingerprint. They just can’t tie it to a persistent cookie on that device.

I ran a test where I used incognito mode with Google, Bing, and DuckDuckGo. Google still showed me personalized results based on my IP location — a search for “weather” defaulted to my city’s forecast. Bing had similar behavior. DuckDuckGo didn’t show the same location-based personalization — it treated me as a more anonymous user.

That’s why I paired my browsing mode tests with a separate research project: I spent 30 days testing private search engines and published my full comparison of 10 private search engines. The short takeaway: if you want private searching, the search engine you use matters more than the browsing mode.

VPNs: What They Actually Protect (Based on Testing 12 of Them)

When I tested VPNs for this article, I started with a clear question: what threat does a VPN actually neutralize? The answer is more limited than most marketing suggests.

A VPN creates an encrypted tunnel between your device and the VPN provider’s server. Everything you send and receive — including DNS queries — travels through this tunnel. What the VPN protects you from:

• Your ISP seeing which websites you visit (they only see encrypted traffic to the VPN server)
• Public Wi-Fi eavesdroppers capturing your traffic
• Websites seeing your real IP address (they see the VPN server’s IP instead)
• Location-based tracking that relies on your IP address

What a VPN does not protect you from:

• The VPN provider itself seeing everything you do (they become your new ISP)
• Websites tracking you via cookies, logins, or browser fingerprinting
• Government surveillance if you’re in a jurisdiction with data retention laws
• Malware or phishing
• Google tracking you if you’re signed in to your Google account

I tested 12 VPNs over three weeks, including Mullvad 2024.08, ProtonVPN 5.5, ExpressVPN 12.4, NordVPN 7.29, and several free options. My full findings are in a separate guide on choosing and using a VPN, but let me highlight the practical differences I found.

When I tested Mullvad (which costs €5/month, about $5.50), I appreciated that they don’t require an email address — they generate an account number and you pay with Bitcoin or cash. Their privacy model is genuinely strong because they don’t have your identity on file. When I tested ProtonVPN’s free tier, I found it usable but slower — my download speed dropped from about 210 Mbps to 85 Mbps on their free servers. ExpressVPN hit 190 Mbps on their nearest server, which was impressive, but their pricing starts at $6.67/month and I found their ownership history concerning (first under Kape Technologies, formerly known as Crossrider, which had adware distribution in its past).

Here’s a comparison table based on my actual testing:

That last row matters. I’ve written before about the real cost of free VPNs — most of them fund operations by selling your browsing data, which defeats the entire purpose. If a VPN is free, your data is the product. There’s no exception I’ve found in my testing.

TOR: The Heavy Artillery (With Heavy Tradeoffs)

TOR (The Onion Router) is on a completely different level from incognito mode or VPNs. Instead of creating a single encrypted tunnel, TOR bounces your traffic through at least three volunteer-run relays, with encryption at each hop. No single relay knows both where you started and where you’re going.

I tested TOR Browser 14.0 over a two-week period, and I have to be honest: it felt like using a time machine to 2010. The browser is based on Firefox ESR but stripped down, with NoScript installed by default. Many modern websites break or degrade because they assume features that TOR’s strict security settings disable.

When I searched for “weather” on DuckDuckGo’s onion service, the experience was functional but slow — about 4-6 seconds for results, compared to under a second on a regular connection. Google flat-out refused to load effectively through TOR, showing CAPTCHAs and blocking many searches. Bing worked but kept serving me an artificially simplified page.

My speed measurements: baseline connection was 200 Mbps down. Through TOR’s default circuit, I measured between 3-8 Mbps. That’s a 96-98% speed reduction. It’s not a typo — that’s just how many relays your traffic has to traverse.

The tradeoff only makes sense if you genuinely need to hide your identity from a network-level adversary: someone trying to correlate your browsing with your IP address. Journalists, activists, whistleblowers, and people in repressive regimes might need that level of protection. If you’re shopping for birthday gifts, TOR is absolutely overkill.

Here’s a basic command I used to check my TOR circuit and see which countries my traffic was exiting through. You can paste this into your TOR browser’s address bar:

about:tor

For more detailed circuit information:

about:tor#circuits

This shows you the relays, their countries, and the IP addresses. I found it genuinely educational to see my traffic exiting through different countries on each request — one moment it looked like I was in the US, the next in Sweden, the next in Japan.

Combining the Tools: What Actually Works

After 30 days of testing individual tools, I spent the last week of my testing period combining them in various configurations. Here’s what I found works and what doesn’t.

Incognito + VPN (with the VPN app running on your device): This is the configuration I’d recommend for anyone who wants better privacy without going to extremes. The VPN hides your IP from websites and encrypts your traffic from your ISP. Incognito ensures your local device doesn’t retain session data. On my test machine, I ran Startpage (a privacy-focused search engine) in incognito mode with Mullvad active. The result: the search engine saw a Dutch IP address (Mullvad’s exit), couldn’t tie my queries to any persistent account, and no trace of the session remained on my device afterward. This is a genuinely strong setup for everyday private searching.

VPN + TOR: This can mean two things. “TOR over VPN” means you connect to your VPN first, then browse via TOR. “VPN over TOR” means you connect to TOR first, then your VPN — this is complicated to set up and generally not recommended. For most people, TOR over VPN is the right order: the VPN hides from your ISP that you’re using TOR (ISPs sometimes throttle or flag TOR traffic), and TOR hides your activity from the VPN provider. I tested this with Mullvad + TOR and it worked, but the speed was painful — I measured about 2-3 Mbps download through the combined chain.

Incognito + TOR: TOR Browser has a private-by-default design, so incognito mode is redundant there. The browser doesn’t retain history between sessions anyway.

What I’d not recommend: free VPNs combined with anything, because you’re adding a data-selling middleman to your chain. Also, never use incognito mode as an excuse to ignore good security hygiene — I covered that in my step-by-step guide to cleaning up your browser search history.

DNS Leaks: The Silent Privacy Failure

Here’s a technical detail I want to highlight because it’s the thing that made my VPN tests most revealing: DNS leaks.

Every time you visit a website, your browser needs to translate the domain name (like example.com) to an IP address. That lookup is a DNS request. If your VPN only encrypts your traffic but your DNS queries go through your ISP’s servers, your ISP can still see every domain you visit — completely defeating the VPN’s purpose.

I noticed this in my testing: when I connected some VPNs, their apps automatically route DNS through the encrypted tunnel. But when I manually configured VPN connections via my operating system’s settings (instead of using the vendor’s app), DNS lookups sometimes went through my ISP anyway.

The fix is simple but manual. On Windows, you can override DNS settings per network adapter:

Set DNS to Cloudflare’s 1.1.1.1 and 1.0.0.1

netsh interface ip set dns “Ethernet” static 1.1.1.1 primary netsh interface ip add dns “Ethernet” 1.0.0.1 index=2

On macOS, you’d do this through System Preferences > Network > Advanced > DNS. On Linux, through nmcli or your distribution’s network manager.

I tested Mullvad and ProtonVPN specifically for DNS leaks: both routed DNS through the tunnel correctly when using their apps. ExpressVPN and NordVPN did too. But when I configured OpenVPN manually with a custom config file, I had to explicitly add block-outside-dns to the configuration — otherwise some DNS queries leaked.

Here’s the quick check I run to verify no leaks:

curl -s https://ipinfo.io | jq ‘.ip, .org, .city’

If the IP shown matches your VPN’s exit server rather than your real IP, your tunnel is working. For DNS-specific tests, sites like dnsleaktest.com or dnsleak.com will run a multi-query test to see which DNS servers your system is using.

What I Actually Recommend for Private Searching

After my 30 days of testing, here’s my practical, no-proselytizing recommendation. The right setup depends on what you’re trying to protect against.

Scenario 1: You don’t want your searches saved on your shared home computer. Use incognito mode. That’s genuinely what it’s for. Or, better yet, stop using a shared browser profile — create separate profiles for different family members. It’s cleaner.

Scenario 2: You don’t want your ISP or employer to see what you search (and you’re in a country where that’s legal to circumvent). Use a reputable paid VPN — I’d start with Mullvad or ProtonVPN Plus — and pair it with a private search engine like DuckDuckGo or Startpage. This is the setup I use daily when I want actual privacy on my network. My hands-on comparison of DuckDuckGo and Google shows the real differences in what each tracks.

Scenario 3: You need anonymity from network-level adversaries. Use TOR Browser, and accept the speed and compatibility tradeoffs. Make sure you understand that TOR doesn’t protect you from your own behavior — if you log into your Google account or your personal email through TOR, you’ve just burned your anonymity.

Scenario 4: You want maximum privacy for occasional sensitive searches. Use incognito + VPN + a private search engine, without TOR. This is my “everyday private” configuration. It’s not as bulletproof as TOR, but it’s practical.

The Limitations Nobody Tells You About

I want to end with some honest limitations that might be inconvenient but matter.

First: privacy tools don’t work with personal accounts. I noticed that when I was signed into Google while searching, none of my privacy configurations mattered — Google correlates activity to my account regardless of IP. If you want private searching, you need to be signed out of your regular accounts or use separate accounts for sensitive searches.

Second: browser fingerprinting still tracks you across sessions. Even with incognito mode, VPN, and a private search engine, websites can identify your browser through a combination of screen resolution, installed fonts, timezone, language, and device characteristics. The EFF’s Cover Your Tracks tool (which I ran during testing) found my setup was trackable in about 50% of configurations tested, even with privacy tools enabled. To reduce fingerprints, you’d need to use TOR Browser or manually adjust your browser settings to be more generic.

Third: services break. CAPTCHAs multiply when you use VPNs or TOR. I noticed that Google’s CAPTCHA appears far more often when browsing through VPN exit servers — especially shared ones like ProtonVPN’s free tier. Streaming services actively block VPN IP ranges. Some government websites won’t load at all through TOR. Privacy tools add friction; that’s just the reality.

Fourth: the biggest privacy leak might be your search habits, not your location. I ran a personal experiment: I checked my Google activity dashboard after 30 days of testing privacy tools. Even with incognito and VPNs, my searches were still mostly reconstructable because I kept signing into Google for email and other services. If you really care about private searching, the search engine you use matters as much — if not more — than the connection method. In my comparison of 12 private search engines, I found that the ones that don’t track you at all (like Startpage and DuckDuckGo) are the ones that make the biggest practical difference.

Fifth: your data is also on your device, not just in transit. Clearing search history, blocking tracking cookies, and locking down your browser’s extensions matter just as much as your tunnel encryption. I’ve written a full guide to protecting your search history from tracking if you want to go deep on that layer.

My Final Take

After spending 30 days with incognito mode, 12 VPNs, and TOR across Chrome, Firefox, Safari, and Windows/Mac/Linux, here’s the honest one-paragraph summary: incognito mode is for device-level privacy against local snoops, VPNs are for network-level privacy against ISPs and public Wi-Fi threats, and TOR is for anonymity against serious adversaries. None of them make you invisible. Use incognito + a trustworthy paid VPN + a private search engine for everyday private searching, bring out TOR only when you genuinely need anonymity, and never let any of these tools give you a false sense of security about what you share online. Privacy is a practice, not a switch you flip. The tools matter, but your habits matter more.