Can Wi-Fi Owners See What Sites I Visited Incognito? Here‘s the Truth

As a MacOS and software expert with over a decade of experience in computer science and cybersecurity, I‘m often asked about the privacy implications of using incognito mode on public or untrusted wifi networks. Many people assume that opening an incognito window shields their browsing from the prying eyes of wifi owners. But is this really true?

The short answer is no. Incognito mode does not hide your internet traffic from the wifi network you‘re connected to. The owner of that network can absolutely see the sites you visit, even if you‘re using Chrome‘s Incognito Mode, Firefox‘s Private Browsing, Microsoft Edge‘s InPrivate, or Safari‘s Private Browsing.

In this in-depth guide, I‘ll walk you through exactly what incognito mode does and doesn‘t do, explore the technical details of how wifi owners can see your browsing, and most importantly, provide you with concrete, actionable steps to protect your privacy on any network. Let‘s get started!

The Hard Truth About Incognito Mode

First, let‘s dispel a pervasive myth. According to a 2018 study by researchers at the University of Chicago and Leibniz University of Hanover, 56% of American adults mistakenly believe that incognito mode or private browsing prevents their internet service provider (ISP) from seeing their online activities. 46% think it hides browsing from employers. And a shocking 39% are under the impression that it makes them completely anonymous online.

I hate to be the bearer of bad news, but none of this is true. Here‘s what incognito mode actually does:

• Prevents your browsing history, search history, and cookies from being saved on your device after you close the incognito session.
• Disables browser extensions by default (though you can re-enable them).
• Doesn‘t send a "Do Not Track" signal to websites.

That‘s it. When you close your incognito window, your device discards all records of that browsing session. But that doesn‘t mean the data wasn‘t seen and potentially logged by your ISP, the wifi router, the websites themselves, or any number of networking intermediaries in between. Let‘s take a closer look at how this works.

Following Your Traffic: IP Addresses, Encryption, and Wifi Logs

To understand why incognito mode doesn‘t hide you from wifi observers, we need to dive into the basics of internet communication. Every time you visit a website, your device (laptop, phone, tablet) sends a request to the web server hosting that site. That request contains information including:

• The full URL of the webpage you‘re visiting (e.g. https://www.example.com/some-page)
• The IP address of your device (like 192.0.2.1)
• Headers specifying your browser, operating system, and other technical details

Assuming the website uses HTTPS (as most do in 2023), the actual content of your communication with the site will be encrypted. The wifi router, your ISP, and other intermediaries can‘t see exactly which subpages you visited on a domain, what you typed into forms, etc. But they can see the hostname (like www.example.com).

Why? Because even with HTTPS, the hostname itself is sent in plaintext in the initial request so the server knows which certificate to present. This is necessary for the encryption to be set up in the first place. While there are some emerging technologies to encrypt the entire initial exchange (namely eSNI), they aren‘t yet widely deployed.

Moreover, the source and destination IP addresses for each packet of web traffic are never encrypted. They can‘t be, or the data wouldn‘t reach its intended destination. So at minimum, a wifi eavesdropper can see a list of IP addresses you‘ve communicated with and when.

With a little extra work, they can easily turn those IP addresses into human-readable domains. They just have to do a reverse DNS lookup, querying the domain name system to find the hostname associated with each IP address. Most wifi routers have built-in traffic monitoring that does this automatically and presents it in a user-friendly interface.

For example, the popular ASUS RT-AC5300 router comes with an included traffic analyzer. In the admin panel, you get a nice pie chart of the most visited sites by devices on your network. Many mesh systems like Eero and Nest Wifi have similar features.

Even on routers without this user-friendly functionality, the owner can always log into the admin panel and check the list of DHCP clients to see the local IP, hostname, and MAC address of every connected device. They can cross-reference that with the router‘s traffic logs to easily figure out who visited what.

On corporate and school networks, traffic monitoring is often mandatory and automated. Network administrators have access to sophisticated equipment like packet sniffers that let them drill down into extremely granular details about traffic to and from each device. Online activity is routinely logged for years and can be subpoenaed by law enforcement.

In short, incognito mode does nothing to hide your browsing from any router between you and the web server. Your traffic is fully visible to the wifi owner, your ISP, and potentially other adversaries. Assuming otherwise is a recipe for disaster.

VPNs and Tor: Real Solutions for Wifi Privacy

Okay, you might be thinking, if incognito mode is useless for privacy on untrusted networks, what actually works? The two most powerful tools at your disposal are virtual private networks (VPNs) and Tor. Let‘s look at each in detail.

How VPNs Protect Your Browsing

When you use a VPN, you establish an encrypted "tunnel" between your device and a server operated by the VPN company. All your internet traffic is routed through this tunnel, then exits to the public internet from the VPN server. Crucially, this hides the contents and destination of your traffic from the wifi router and your ISP. All they can see is that you‘ve connected to the VPN server.

From the perspective of websites you visit, the request appears to originate from the VPN server‘s IP address, not your real IP. It‘s kind of like using a post office box as your mailing address – it provides a layer of indirection between your real location and your online activity.

There are a few key things to consider when choosing a VPN provider:

• Logging policy: The VPN can still see your real IP and browsing activity, so it‘s critical that they have a strict policy against logging and sharing this information. Stick with reputable "no-log" providers.
• Jurisdiction: Where is the VPN company headquartered, and what are the data retention laws in that country? Pro-privacy jurisdictions include Panama, the British Virgin Islands, and Switzerland.
• Protocol: OpenVPN and WireGuard are open source VPN protocols that use strong encryption. Avoid obsolete protocols like PPTP.
• Leak protection: Choose a VPN that has built-in protections against DNS leaks, IPv6 leaks, and WebRTC leaks which can reveal your true IP even when the VPN is connected.

According to a 2018 GlobalWebIndex report, 31% of internet users worldwide have used a VPN. This number is much higher in countries with internet censorship and surveillance, like Indonesia (55%), India (43%) and Turkey (41%). VPNs are a crucial tool for privacy and free speech in such contexts.

How Tor Anonymizes Your Browsing

Tor (short for The Onion Router) takes the concept of proxying your traffic a step further. Instead of routing through a single VPN server, Tor bounces your traffic through multiple nodes around the globe. At each hop, a layer of encryption is peeled off (hence the onion metaphor) to reveal the next destination.

The clever cryptography of Tor ensures that each relay only knows the immediately previous and next node – no single server ever has the complete picture of your traffic. The wifi snooper just sees encrypted Tor traffic. The exit relay just sees the destination site, not your IP. And no relay in the middle can connect the two.

According to the Tor Project‘s metrics, there are currently about 2 million daily users of the Tor network worldwide. Usage tends to spike during political upheavals, like the 2013 Egyptian Revolution and the 2020 Belarusian protests, highlighting Tor‘s importance for activists and journalists.

To get started with Tor, just download and install the free Tor Browser. Under the hood, it‘s a modified version of Firefox that comes preconfigured to route all your browsing through the Tor network. There are also Android and iOS apps to let you use Tor on mobile.

While Tor provides a very high degree of anonymity, it comes with some tradeoffs. The multi-hop routing can slow down your browsing quite a bit. And some websites block known Tor exit relays, though you can sometimes get around this by using new Tor bridges.

There‘s also an ironic attack where an adversary can correlate the timings of Tor traffic flows to deanonymize users. The solution to this is to use a VPN and Tor together – connect to your VPN, then open Tor browser. This is the gold standard for privacy – one 2013 NSA slide described Tor and VPNs as "catastrophic" to their surveillance efforts when combined.

Practical Recommendations for Private Browsing on Untrusted Networks

To recap, incognito mode does not in any way prevent wifi owners from seeing what you do online. Your traffic is still visible to the router, ISP, and websites themselves. The only things incognito hides are traces left on your local device. If network snooping is a concern, you need to encrypt your traffic with a VPN and/or Tor.

Here are my recommendations for maximizing your privacy when browsing on an untrusted wifi network:

1. Connect to a reputable VPN with a strict no-logging policy before doing anything else. Make sure the VPN uses a secure protocol like OpenVPN or WireGuard and isn‘t leaking your IP address.
2. If you need maximum anonymity, use the Tor Browser instead of or in addition to a VPN. Just be aware that Tor may break some websites and will slow down your browsing experience.
3. Favor websites that support HTTPS encryption. Install the HTTPS Everywhere browser extension to force the use of encryption on sites that offer it.
4. Be wary of entering sensitive information like passwords or credit card details on untrusted networks, even with a VPN active. On public computers, use a virtual keyboard to thwart keyloggers.
5. Disable sharing services like network file sharing, remote access, screen sharing, printers, smart home devices, etc. when on public wifi. These can leak information.
6. Consider using a privacy-focused DNS resolver like Cloudflare‘s 1.1.1.1, which supports encrypted DNS lookups, rather than your ISP‘s default resolver.

Even with a VPN or Tor in place, incognito mode still provides a marginal privacy benefit. It prevents your browsing history from being saved to disk and protects you against some forms of tracking like persistent cookies. So I still recommend using it in tandem with a VPN on untrusted networks. Just don‘t rely on it as your only line of defense.

Conclusion: Incognito Mode Is Not a Privacy Panacea

To sum up, while incognito mode serves a purpose, it‘s far from a complete privacy solution. Its benefits are strictly limited to preventing traces from being left on your local machine. It does not hide your activity from the websites you visit, your ISP, or the owner of the wifi network you‘re using.

If you want to browse privately on an untrusted network, you need to encrypt your traffic from end to end. The two most powerful tools for this are virtual private networks (VPNs) and Tor. A VPN will hide your traffic from wifi observers and your ISP, while Tor provides even stronger anonymity. For maximum protection, use them together.

No privacy tool is perfect, but by understanding their strengths and limitations, you can make informed choices about how to protect your data. Stay safe out there!