Can VPN Extensions Work in Incognito Mode?

You open a private window to keep a quick search out of your history, and the little VPN icon in the toolbar has vanished or turned grey. Did the VPN stop working? Is your traffic now exposed? It is a common moment of confusion, because private windows and extensions are controlled by two different sets of rules that do not always agree.

This article answers one question: whether VPN extensions can work in incognito or private mode, and how to get a reliable result. It does not re-explain the difference between a VPN and incognito mode in general; for that, see VPN vs incognito mode. Here the focus is the practical side: the default behaviour, how to allow an extension, how to verify it, and the mistakes people make when they combine the two.

What "extensions are off in private windows" really means

Private windows, called Incognito in Chrome, Private Browsing in Firefox and Safari, and InPrivate in Edge, are designed to leave no local trail. When you close the window, the browser forgets the pages you visited, cookies set during that session, and form entries. The Chrome and Mozilla help pages describe exactly what is and is not saved.

Extensions complicate that promise. An extension can read the content of pages, see addresses, and keep its own storage. If every installed extension ran silently in every private window, the promise of "nothing remains" would be easy to break by accident. So browsers use an opt-in model:

• A new extension starts disabled in private windows.
• You open the extension's settings and allow it there. The wording is similar to "Allow in Incognito", "Run in Private Windows" or "Allow in InPrivate", depending on the browser.
• Even after you allow it, the browser usually shows a note that the extension may see your private browsing.

This is why the toolbar icon can disappear in a private window. It is not a crash. The browser has simply not loaded the extension in that window.

What happens to your connection in a private window

This is where people go wrong, because there are two separate questions.

Question 1: Is the extension running in this window? If you have not allowed it, no. The icon may be missing, and the extension's own switch, if it has one, cannot be reached.

Question 2: Is traffic from this window going through the VPN? That depends on how the extension works and what the browser does with its settings. Some tools change a browser-wide proxy setting that affects every window of that browser profile, including private ones. Others act per window or per tab. Browser developers have changed the details over time, which is why you should never assume. You test.

So there are three possible outcomes in a private window:

Outcome	What you see	What it means
Extension not allowed	No icon, or a greyed icon	The window is not using the extension; traffic goes the normal way
Extension allowed and connected	Icon active, shows connected	Traffic from the window should go through the extension's route; verify
Extension allowed but disconnected	Icon active, shows disconnected	Window uses the normal route; connect it first

Treat the first row as the default, and the second row as true only after a check.

How to allow an extension in a private window

Menu names change between versions, but the path is similar everywhere.

1. Open the extensions page of your browser. In Chromium-based browsers, this is the Extensions menu and then Manage extensions. In Firefox, open Add-ons and themes.
2. Open the details of the VPN extension.
3. Find the private-window switch. Chromium-based browsers call it "Allow in Incognito" or "Allow in InPrivate". Firefox offers "Run in Private Windows" on the extension's page.
4. Read the warning that the extension can read data in private windows. If you do not trust the extension with that, leave it off.
5. Open a private window and look for the toolbar icon. In some browsers you may need to pin the extension from the puzzle-piece menu to see it.
6. Connect inside the private window, not just in a normal one. The connected state in one window does not always carry over to another.

Safari and some mobile browsers handle extensions differently. On Safari, extensions are enabled per website and per browsing mode in the browser's settings. On phones, the extension model is more limited, and a system-level app often does the job a desktop extension would.

A 5-minute check that it actually works

A badge that says "connected" tells you the extension is happy, not that your private window is using it. Use a short test to be sure.

1. Note your public address in a normal window with the extension off. Search for "what is my IP" or use a site that shows your address. Write it down.
2. Connect the extension in a normal window and check again. The address should change to the VPN's address. If it does not, the extension is not working there either.
3. Open a private window and check the address without connecting. Compare it to step 1.
4. Connect in the private window and check once more. The address should now match step 2.
5. Run a DNS and WebRTC test while you are there, using a tool such as EFF's Cover Your Tracks, to see whether other details of your connection show up. Our article on what a WebRTC leak is explains one common surprise.
6. Close the private window and open a new one. Check again, because some extensions reset their state with each window.

If steps 3 and 4 give the same address as step 1 even after you connect, the extension is not covering that window. Stop and fix the setting, or use the VPN app instead.

Three everyday situations

The shared family computer. Lina uses a private window to buy a surprise gift without leaving a trail in the browser history. She also wants her traffic hidden on the café's Wi-Fi. She allowed the extension in private windows once and checked the address. She now knows the two layers do different jobs: the private window keeps the history off the computer, and the extension hides the destination from the café network. Neither hides her from the shop she is buying from.

The traveller on a hotel network. Somchai opens a private window to check his bank on the hotel Wi-Fi. The VPN icon is grey. He realises the extension was not allowed there, so his bank session was not going through the VPN. He allows the extension, connects within the private window, runs the address check and then logs in. For other hotel-specific advice, read using a VPN on hotel Wi-Fi.

The researcher testing two accounts. Chen needs to log into two accounts of the same service at once. He uses a normal window for one account and a private window for the other. Both windows go through the same extension route, so the service sees the same network address for both. If he needs that to be different he must not rely on incognito for it, and he should check the service's rules first, since some services do not permit multiple accounts.

What incognito still leaves visible

Private windows and VPN extensions are often described as a privacy pair, but they leave plenty uncovered.

• The websites you log in to. A login ties the session to you in any window. Incognito does not stop a site from knowing who you are once you sign in.
• Your browser fingerprint. The mix of screen size, fonts, language and browser version can still identify your browser across windows. See VPN and browser fingerprinting for what that means.
• Cookies during the session. Within the window, cookies work normally and are thrown away when you close it. For how cookies interact with a VPN, see VPN and tracking cookies.
• Your employer, school or network administrator. If you use a managed device or network, your administrator may have tools that private windows do not switch off.
• Downloads and bookmarks. Files you download and bookmarks you create usually stay on the computer.
• The VPN provider. Traffic that goes through the tunnel is visible to the VPN provider at its end, which is why the provider's terms matter.

For a wider look at what remains trackable, can you be tracked with a VPN goes through the main routes.

A short checklist before you rely on it

Keep this list next to the browser for the first week, until the steps feel automatic.

• The extension is allowed in private windows, and you have read the browser's warning about what that permission means.
• You pinned the toolbar icon, so the connected state is visible without hunting for it.
• You connect inside each new private window, because the state may not carry over.
• You compared your public address before and after connecting, in the same window type you will really use.
• You know which other extensions are also allowed in that window, and you removed those you do not need.
• You will recheck after every major browser update, since updates can reset permissions or change behaviour.

Do not treat this checklist as a guarantee. It is a way to replace an assumption with evidence, which is the most useful habit when two privacy features overlap.

Troubleshooting: the extension will not work in a private window

1. Check the permission switch again. Browser updates sometimes reset it.
2. Restart the browser after changing the permission, then open a fresh private window.
3. Connect inside the private window and wait for the connected state.
4. Disable other extensions in that window. Ad blockers and script managers can interfere, and you can allow only the VPN one.
5. Update the extension and the browser.
6. Try a normal window with the same extension. If it fails there too, the problem is not private mode.
7. Switch to the VPN app if the extension remains unreliable. The app protects the whole device, including every browser window, whether private or not. XPASS passes work with the free VPNclient app; the download page lists the supported platforms.

Common mistakes

• Assuming a grey icon means the VPN is on.
• Allowing every installed extension in private mode "just in case".
• Believing that incognito hides your activity from your network, employer or internet provider.
• Testing once, in a normal window, and assuming the private window behaves the same.
• Logging in to personal accounts in a private window and still expecting anonymity.
• Forgetting to check after a browser update.
• Using incognito alone on a public Wi-Fi network, then wondering why the network still sees where you connect.

Summary

VPN extensions are normally disabled in private windows until you allow them in the extension settings, and even then you should confirm that the window really uses the extension by checking your public address before and after connecting. Incognito mode keeps local history off your device; a VPN extension hides browser traffic from the local network; neither makes you anonymous to the sites you log in to. Allow only the extensions you trust, test in the window you actually use, and choose the app if you want protection beyond a single browser.

If you want a pass you can use with an app rather than an extension, the pricing page shows the options at your own pace.