Protect

Most people reach for private browsing when they want to keep two things apart: a work account and a personal one, a shopping session and everything else, a client's dashboard and their own. Incognito is a poor tool for that job, because it hands you one blank slate at a time and throws it away when you close the window. Firefox has a separate feature built for exactly that need, and it is worth understanding because it is routinely confused with private browsing.

What Mozilla actually calls them

Mozilla's developer documentation calls them contextual identities. The interface calls them containers. The documentation describes the feature as one that lets users assume multiple identities when browsing the web, and maintain some separation between these identities. The example it gives is the ordinary one: someone who considers their work identity separate from their personal identity, and does not want to share cookies between these two contexts.

The mechanism is worth stating precisely, because precision is what separates this feature from the folklore around it. Internally, each identity gets a cookie store that is not shared with other tabs. That store carries its own identifier, the cookieStoreId, which is how an extension addresses one container rather than another. A site you are signed into inside one container cannot see the session you hold in a different one, for the simple reason that the cookies are not there to be read.

Why the colour is not decoration

Each contextual identity has a name, a colour and an icon, and those appear in the address bar while you browse inside it. New tabs can be assigned to an identity. The visual marking is not decoration. The failure mode of any separation scheme is losing track of which side of the wall you are standing on, and a coloured label in the address bar is the cheapest available fix for that.

• Each container gets its own cookie store, not shared with other tabs
• Each identity has a name, a colour and an icon shown in the address bar
• Separates cookies between contexts, but does NOT change your IP address
• Firefox only: not supported in any other browsers
• Available on Firefox for Android, but with no interface to use it there
• A different job from private browsing: what sites see, not what stays on your device

What containers do not do

Now the part that has to be said plainly, because it is where the feature gets oversold in every thread that mentions it. Containers separate cookies. They do not separate your connection. Every container on your machine reaches the internet from the same address, over the same network, through the same resolver. A site that recognises you by address, or an operator watching the connection itself, sees no difference whatsoever between your work container and your personal one.

That places containers and private browsing on two different halves of a problem people usually state as one. Private browsing governs what remains on your device after you close the window. Containers govern what different sites can learn about each other while you are still browsing. Neither of them governs what the network sees, and expecting either to do so is the misunderstanding that keeps being repeated.

The limits Mozilla documents

A few documented limits are worth knowing before you build a habit on this. Mozilla is direct that contextual identities are not supported in any other browsers, so this does not travel with you to Chrome or Safari. The documentation also describes them as an experimental feature enabled by default only in Firefox Nightly, which is a statement about the extension API rather than a promise about what you will find in a release build. And on Firefox for Android, it notes that although contextual identities are available, there is no interface to work with them in that version of the browser.

Who this is for, and who it is not

So who is this actually for? Anyone holding two accounts on the same service who is tired of signing out of one to reach the other. Anyone who would rather a shopping session did not feed the same cookie jar as the rest of their browsing. Anyone who administers something on behalf of someone else and would prefer that access never touched their own profile. These are ordinary needs, and the feature meets them without a subscription and without changing how you browse.

And who should look elsewhere? Anyone whose real concern is being observed by their network, their provider, or the sites themselves at the level of the connection. That is a different problem with different tools, and no amount of cookie separation reaches it.

The short version

The short version is that containers do the thing many people believe incognito does, which is keeping two lives on the web from reading each other's cookies. They do not do the other thing people believe incognito does, which is hiding those lives from the network. Knowing which half you are solving is most of the value.