Incognito windows are a false sense of security. Your ISP can still see what you am doing, and the websites you visit still fingerprint your browser. Incognito clears your local history. That is it. There is one tool that solves the entire problem: Tails OS (a live Linux distribution that boots from a USB stick and routes every connection through the Tor network). You will be more secure than ever in Tails, but that security comes with a significant cost that most folks are not prepared for. After two months of running Tails as my daily driver for personal browsing, here is the candid version of what works, what does not, and what nobody tells you in the setup guides.
A short note before the breakdown. Tails stands for “The Amnesic Incognito Live System.” The “amnesic” part is the load-bearing word. Tails is built to forget everything when you shut down. No history, no cookies, no files, no trace left on the hardware you used. This is genuinely useful for journalists, activists, and anyone whose threat model includes the physical device being searched. It is overkill for most other people, and the usability cost is high enough that the typical user will quietly stop using it within a week.
What Tails actually does, and why it works
Tails is a full Linux operating system that boots from a USB stick. It does not install on your machine. You boot into it, use it, shut it down, and the operating system forgets everything: no history, no cookies, no files, no trace left on the hardware you used. Aside from the amnesia, Tails is packed with privacy features that would be tedious to set up by hand.
When you boot Tails up, all of your internet traffic is routed through the Tor network (a system of volunteer-operated relays that bounce your traffic through three encrypted hops before it reaches the destination, so your real IP address never appears in the destination’s logs). Your ISP knows you are using Tor, but not what you are doing inside it. Tor Browser is the default browser. VeraCrypt (an on-disk encryption tool) and GnuPG (an email and file encryption tool) come preinstalled. Your device’s MAC address (the unique hardware identifier your Wi-Fi and Ethernet adapters broadcast) is randomized on every boot, so the local network cannot fingerprint your machine.
Tails also has no telemetry. It never phones home, never connects to a server you did not explicitly ask it to, and never tracks anything. There is no analytics, no crash reporting, no update-notification nag. For most users this is a small detail. For anyone whose threat model includes the device being searched, it is the entire point.
The cost nobody mentions
I am not going to lie. Comparing the various incognito and private browsing modes to Tails is like comparing apples to concrete. They are different from the ground up, and they serve wildly different purposes. That said, Tails does solve the problem of Incognito Mode not actually being fit for privacy. It is just incredibly impractical for most folks.
Getting Tails running is a project. Before you even think about browsing, you need a USB stick of at least 8GB, a separate device to download and verify the image, and the patience to flash it correctly using Tails’ own installer. The verification step is not optional if you care about the integrity of what you are running. If your machine boots with Secure Boot enabled (a firmware setting that requires the bootloader to be cryptographically signed, which Tails’ installer does not currently do), you will need to go digging through your firmware settings before Tails will load at all. On Windows 10 it was common to have Secure Boot disabled. That changed with Windows 11, so the BIOS digging is back on the menu for most modern hardware.
Tails deletes everything when you shut down. Tails’ core feature is also the thing that makes it unusable as a daily driver. Every file you saved, every browser tab you had open, every chat window, every download, every saved password, gone. You can configure a “persistent volume” (an encrypted container on the USB stick that survives reboots) for a small number of things:
- Wi-Fi passwords. Stored encrypted, restored on next boot.
- Browser bookmarks. Synced across Tails sessions on the same USB stick.
- A small set of files. Anything in the persistent volume folder.
- A PGP key. For signing or decrypting email.
- SSH configuration. Useful if you are remoting into other systems.
It is opt-in, it is encrypted with a passphrase, and it is small. Most users will fill it within a week.
Tails is slow. All traffic goes through three Tor relays. Every page load, every video, every file download pays the latency tax. A 4K YouTube video is a non-starter. A Spotify stream is a non-starter. Cloud photo sync is a non-starter. Even basic web browsing feels noticeably slower than a regular browser session on the same network. For research, email, and text-based work, it is fine. For anything that involves streaming, real-time collaboration, or large downloads, it is miserable.
Your workflow has to change. You cannot install apps. You cannot drag files from your regular desktop into Tails. You cannot copy a screenshot into Slack. You can download a file, work with it in Tails, save it to the persistent volume, and then reboot back into your regular OS to do anything with it elsewhere. The cognitive overhead of “I have to reboot to do that” adds up fast.
When Tails is the right call
Tails is the right call when the threat model justifies the cost. If you are a journalist handling source material, an activist in a country with active internet surveillance, a researcher working with leaked datasets, or a private individual whose online activity is being actively monitored by a state-level adversary, Tails is one of the best options available. The amnesia is a feature, not a bug, because the most common way a privacy tool fails is that the local device is searched after the session ends.
Tails is also the right call for one specific defensive use case: browsing from a device you do not trust. Library computers, hotel business centers, conference Wi-Fi, borrowed laptops. Tails on a personal USB stick gives you a clean, ephemeral, network-anonymous environment on any hardware, and leaves nothing behind. The fact that you can carry the entire operating system in your pocket is genuinely useful for this case.
When Tails is the wrong tool
Tails is the wrong tool if your goal is “I just do not want Chrome tracking me across every site I visit.” A standard Firefox install with uBlock Origin (a content blocker that stops most ads and trackers from loading in the first place) and a reputable VPN (a service that encrypts your traffic and routes it through a different IP address) gets you 80 percent of the way there for 5 percent of the usability cost. Tails is for the last 20 percent, and the last 20 percent is not where most readers are.
Tails is also the wrong tool if you are trying to use it as a “private daily driver.” The amnesia makes the persistent experience painful, the slowness makes real work miserable, and the boot-from-USB requirement means you cannot use it on a machine you cannot physically access. The setup guides will tell you it is possible to use Tails as your primary OS. The setup guides are written by people who do not have to send 50 emails a day or join video calls.
Trade-offs
Tails is not free in time. The first time I set it up it took about 90 minutes, most of which was reading the verification instructions and rebooting into my firmware settings. The persistent volume configuration is the part most guides skip, and it is the part you will actually need to use it for more than a single session. Expect to spend a Saturday afternoon getting it to a state where it is genuinely useful.
Tails is also not free in cognitive overhead. Every task becomes “is this something I do in Tails, or do I reboot back into my regular OS?” The list of things I do in Tails got shorter over time, not longer, because the friction of switching contexts adds up. After two months I was using Tails for about 15 percent of my browsing, and that was enough to matter for the cases I cared about (sensitive logins, account creation, anything tied to a real identity), but not enough to call it a “private OS.”
If your threat model is the typical one (advertisers, data brokers, the occasional breached database), Tails is overkill. A reputable VPN, uBlock Origin, and Firefox’s built-in cookie isolation will get you most of the way there. If your threat model is more serious than that, Tails is one of the best options you can set up in a weekend, and the cost is worth paying.
The honest summary is that Tails is a specialized tool that is genuinely good at the job it was designed for, and genuinely bad at everything else. Most users should not be using it as a daily driver. Some users absolutely should be using it, and the ones who should are the ones who can articulate why.
Bottom line
If you only do one thing from this article, do not install Tails. Install Firefox, install uBlock Origin, and sign up for a reputable VPN. That is the right starting point for 95 percent of readers. If you finish that work and find that you still have a specific need that the standard setup cannot meet, come back to Tails. The cost of Tails is high enough that it should be the answer to a real problem, not a default.
Anyone who travels with a personal device they cannot fully trust, anyone doing sensitive research on hardware they do not own, and anyone whose threat model includes state-level surveillance should read the Tails setup guide end to end this weekend. The first session will be slow. The second will be slower because you will be configuring the persistent volume. The third will start to feel normal, and you will know within a month whether it is worth keeping in your toolkit.