Does your ISP see incognito? Yes, every bit of it. Incognito, private browsing, InPrivate, whatever your browser calls it, does exactly one job: it stops your own device from keeping history, cookies and form data after you close the window. It does nothing to the network. Your internet provider sees the same DNS lookups and the same server names it sees in a normal window, at the same times, with the same volumes. The purple mask is for the person who borrows your laptop, not for anyone upstream.
That is the short version. The longer version is more useful, because "the ISP sees everything" is also wrong: it sees which sites, not which pages, and it cannot read your searches or your messages. Below, what exactly the provider gets, what it does not, whether Tor helps, and which tools change the picture for real.
What incognito actually does
It opens a session with empty storage and throws that storage away at the end. No history entry, no cookies left behind, no autofill. Sites you log into still know it is you, because you logged in. Your employer's network, the café's router, your ISP and the sites themselves are all unaffected, and the browser's own warning screen says as much in small print. Your browser fingerprint, the set of traits a site can read without cookies, is the same in incognito too; how that works is in Browser fingerprinting explained.
What the ISP sees, incognito or not
Domains. Two things give away the site even on HTTPS. The DNS lookup your device sends before connecting, usually to the ISP's own resolver, in plain text. And the server name in the first packet of a TLS connection, a field called SNI, which is sent unencrypted on most connections today. So the ISP knows you opened a news site, a bank, a clinic's site or a dating app.
Timing and volume. When you were online, how long, how much data each connection moved. A video call and a large download look different even when encrypted.
Devices. The ISP-supplied router reports what is connected, and traffic patterns separate a phone from a TV from a console.
The full breakdown, with and without a tunnel, is in What can my ISP see.
What the ISP does not see
Page content on HTTPS sites, which today is nearly all of them. Your Google searches: the query lives inside the encrypted request, so the provider sees that you went to the search engine, not what you typed. Passwords, form data, messages in end-to-end encrypted apps. Encryption in transit works; it just does not cover the address label on the outside of the envelope.
Does the ISP see Tor?
It sees that you connected to the Tor network, because the entry node's address is known, and it sees the timing and volume of that connection. It does not see which sites you reach through Tor, and it cannot read the content. So Tor hides the destination list from the provider, at the cost of speed and of the provider knowing you use Tor. Where Tor sits next to a VPN and a proxy is in VPN vs Tor vs proxy.
Does the ISP see a VPN?
It sees an encrypted connection to one address, and the volume. DNS goes inside the tunnel, so no domain list; SNI is inside too, so no server names. The fact that you use a VPN is visible, and with classic protocols the type is obvious; protocols like VLESS with Reality look like ordinary HTTPS to the network. The list of sites does not vanish, though: it moves from the ISP to the VPN provider, whose policy is now the document that matters. What "no logs" should actually say is in What does no-logs VPN mean.
Two conditions for that to hold. DNS must really go through the tunnel, which you can verify on What Is My IP and the IPv6 leak test. And the tunnel must stay up; a kill switch keeps traffic from falling back to the ISP during reconnects.
Can you shrink what the ISP sees without a VPN?
Partly. Encrypted DNS, over HTTPS or TLS, hides the lookups from the ISP, though the DNS provider now sees them instead. Encrypted Client Hello, a newer TLS extension, hides the server name too, but only on sites and networks that support it, and support is still patchy. Together they reduce the ISP's view to IP addresses and traffic shapes. It is free and worth turning on regardless, and it keeps working as a fallback if a tunnel drops.
Who else "incognito" does not fool
The Wi-Fi owner at the café or hotel: same view as the ISP, domains and timing. Your employer on a work network or a managed device. Any site you log into. Ad networks that recognize your fingerprint. And, obviously, anyone who takes a screenshot of your screen. Incognito protects against one thing: the next person to open your browser.
So what hides browsing from the ISP?
- A VPN with DNS inside the tunnel and a kill switch on: the ISP sees one encrypted connection.
- Tor, for the destinations, at the price of speed and of the ISP knowing you use Tor.
- Encrypted DNS and, where available, Encrypted Client Hello: a partial fix that costs nothing.
- Incognito: nothing, as far as the ISP is concerned. Keep using it for shared computers; just do not expect more.
404 VPN puts DNS inside a VLESS or WireGuard tunnel, includes a kill switch, and states in its privacy policy what it does and does not keep: no browsing history, no DNS queries, no traffic content, no source IP after the connection is established. That is the honest replacement for what incognito never did. Start on the home page.