Incognito mode in the browser is a great feature when you surf personal things on a shared or work computer, but not when it’s your child who uses it to hide something from you. That’s when you really want to know how to see their incognito history.
The truth is that you can retrieve the incognito browsing history on phone or PC: through DNS cache, router logs and third-party apps and extensions.
In this article, we dug deeper into the topic to understand how this incognito mode works and how it can be circumvented. See our guide and testing further.
How Does Incognito Mode in Browser Work?
Incognito mode, in its most basic form, is a feature that does not record visited websites in the browser history.
Incognito mode enhances private web browsing by creating a temporary session separate from the main session and user data. All the local data created from that session is deleted after the session ends. Hence, someone using the same device will not see your internet history.
Nonetheless, private browsing does not mean that your history is entirely invisible. Your internet service provider, the websites you visit, and other third-party apps can see your incognito history.
Not to mention, there are various tactics that you can employ to view incognito history on any device, which we’ll cover in the next section.
We tested several methods described everywhere online for viewing incognito history in the browser. The effectiveness of some depended on the model of the device, while others were not effective at all.
However, during the testing, we have found methods that do work and can help parents to view incognito history.

the author
How to View Incognito History on Android or iOS
Android and iOS phones do not store incognito history on the device. It seems like good for teens and bad for parents. However, there are still a couple of reliable methods you can use to view any private session.
Use mSpy to Check Private Browsing History on Any Phone
Effectiveness: it works
mSpy is one of the most popular parental control apps that can see a private browsing session on Android or iOS.
We love it because it can track web searches, domain names, and the timestamps for private browsing. In addition, mSpy indicates which web searches were made on a normal tab and which ones were done in incognito mode.

To use mSpy you need to install it on the target Android or iOS device. Then, access the Internet Usage feature on your mSpy online dashboard to see the browsing history and bookmarks.
I like that mSpy lists all the URLs, which makes it easy to not only have a clear picture of their internet activities but also know which web address to block.
Now, you need not worry about which websites your child is visiting. The mSpy web tracking feature will always keep you posted.
Check Router Logs to See Incognito History of Any Connected Device
Effectiveness: depends on the router model
If your child accesses the internet over your home Wi-Fi, you can check the router logs to see private browsing history on any connected device they use: phone, tablet or PC.
Note that not all consumer-grade routers log website URLs. Among those that do: Asus — RT-AX86U, RT-AX88U, GT-AX11000, Netgear Nighthawk R7000, R8000, RAX120, TP-Link Archer AX73 and AX90, etc.
Most routers log activities from a few minutes to a few hours. Therefore, you may need to check the logs every other day to keep track of incognito history.
To check your router logs, you need to log in to your router’s web interface.
- Open a web browser and type in the router’s IP address. You can find it at the back of the router. Still, you can access your router through these IP addresses: 192.168.1.1, 192.168.2.1, 192.168.1.100, 192.168.0.1, or 10.0.0.1. Others require an app.
- Enter the login information. Most routers username is admin, but your router could have a different, so check this too. You will find the username and password at the bottom of the router.
- Go to your system logs under the Advanced or Admin Settings. Then, look through the list to see incognito history on a certain device.
However, during my test with the TP-Link Dual-Band Wi-Fi 6 router, I couldn’t find the history of the incognito mode. You could try contacting your operator to check your router’s capabilities.
How to Check Chrome Incognito History on PC for Beginners
Effectiveness: it works
If your child uses Google Chrome, the easiest way to track incognito history is by using a browser extension.
While researching the best Chrome extensions to see the incognito history, I found one reliable option; the Off the Record History extension.
The Off the Record History extension keeps incognito history for up to seven days. Installation and configuration are pretty simple.
- Search “Off the Record History” browser extension on Google Chrome.
- Install the extension from the Chrome Web Store by clicking the “Add to Chrome” button.
- Open the extensions list, click the three dots beside the extension and click “Manage Extension.”
- A new tab will open with the extension’s permissions. To turn it blue, click the grey button next to “Allow in Incognito.”
- Click extensions and click the pin option. Then click on the extension to edit how long to keep the browsing history. I chose 7 days because you would want the history recorded for as long as possible.
- To see incognito history, open Google Chrome and the incognito window and click on the extension. It will show you the browsing history in incognito mode.
Checking an incognito session using a browser extension is a good starting point if you’re not particularly tech-savvy.
How to See Incognito History on PC for Geeks
Effectiveness: questionable
If you worry that your teen see and delete that Chrome extension, there is another way to see their incognito history on PC: via accessing the DNS cache. However, this method requires you to be more technically inclined.
DNS stands for Domain Name System. It maps and translates readable domain names in browsers into an IP address. For example, a typical domain name like nike.com could be translated into 142.250.65.238.
Here’s how to access DNS cache on a PC:
- Click the Windows key to open the search bar.
- Type
cmdto open the command prompt, then select “Run as Administrator.” - Enter the command
ipconfig/displaydnsin the command prompt window and click enter. - You will see a list of all the domains visited on all browsers, including those accessed in incognito mode.
- You can then enter an IP address on a browser to view the websites visited.
However, during my test, none of the web or IP addresses listed via the Windows command prompt led to any real web pages being visited. There were no specific domains in the list, let alone full links to the pages.
There could be several reasons for this:
- cached domains have been reset;
- browsers using DNS-over-HTTPS (DoH);
- a VPN or proxy has been used;
- the Windows DNS cache does not store all requests.
How Can I View Incognito Search History on Mac
Effectiveness: questionable
If your child uses a Mac, you can do an incognito history check by viewing its DNS directory using the next steps. I tested this on macOS Sequoia Version 15.2 (24C101).
- Open the Applications folder by opening Go > Applications and click Utilities. Double-click Console.
- Select your device, choose any from the drop-down menu, and type
mdnsresponderin the search bar. - Click the Start/Play button in the toolbar.
- Go back to Utilities and click Terminal.
- Enter the command:
sudo killall -INFO mDNSResponderand press Enter. You will be asked to enter your password for the laptop, then press Enter.
This command instructs macOS to write the current DNS cache to the system logs (log show or Console.app). It does not disable or stop mDNSResponder, but only collects information. - Go back to the Console window. Here you should see the entire browsing history, including incognito.
However, I couldn’t see specific domains, but only mask.hash.

mask.hash in the mDNSResponder logs means that macOS is masking or hashing DNS queries instead of displaying the real domains. This is done for security and privacy reasons.
Websites that describe this method, such as Avast, have not shown a valid result, so we cannot be sure that it works. During further investigation, we found out that there are additional recommendations to bypass hashing protection, but we do NOT recommend doing this if you are not familiar with it.
Alternative: Check Active DNS Queries in Real Time
If you got the same results as ours and do not see the browsing history in the form of domains, then you can use another method to monitor the history in real time.
Go to Applications folder > Applications and double-click Terminal in the Utilities folder.

In Terminal, write sudo tcpdump -i any -n port 53, enter the password and tap Enter. Minimize the window and let your child use the Mac.
In the process of visiting pages, feeds with various data will be added. Then you will be able to see all the sites your child has visited since running this command.

The result can be as following:
12:28:18.625555 IP 192.168.10.1.56370 > 192.168.10.9.53: 28272+ A? heylocate.mobi. (32)
Which means:
| Part | Meaning |
|---|---|
| 12:28:18.625555 | The time when the query was sent (hour:minute:second.milliseconds) |
| IP | IPv4-query (Internet Protocol) |
| 192.168.10.1.56370 | Source of the query: Device IP address 192.168.10.1, port 56370 |
| > | The > symbol indicates that this device is sending a query |
| 192.168.10.9.53 | Recipient (DNS server): IP 192.168.10.9, port 53 (DNS) |
| 28272+ | Unique identifier of the DNS query |
| A? heylocate.mobi. | DNS record of type A (record for heylocate.mobi domain IPv4 address) |
| (32) | DNS query size in bytes |
Is this command safe?
Yes, this command is safe because it does not disable the Internet or change the system configuration. It only writes the DNS query cache to the system logs for analysis.
Comparison of Incognito History Viewing Methods
To summarize all our technical experiments, let’s see what methods actually work to view the incognito history in the browser.
| Method | View Incognito History | Condition |
|---|---|---|
| Router logs | ⚠️ Possible | Works if the router registers DNS queries. |
| DNS cache on Windows | ⚠️ Possible | Works if the cache is not cleared. Did not display direct domains during the test. |
| DNS cache on Mac | ⚠️ Possible | Works if the cache is not cleared. There were no results by type of domain, only those in real time. |
| Checking active DNS queries in real time | ⚠️ Possible | Works if DNS query window is opened/minimized. |
| Parental control software | ✅ Yes | Stores incognito activity when installed on the target device. |
Conclusion
Worrying about what your child might be exposed to online is perfectly understandable. With these methods, you can now discover your child’s incognito history on any device.
Chrome extensions are the easiest for controlling an incognito browsing on Windows. Meanwhile, any professional parental control app like mSpy helps to see incognito history on phone and monitor all device activities secretly.
So if your teen thinks they can outsmart you and hide something on their phone, you’ll still be one step ahead.
Frequently Asked Questions (FAQs)
Incognito mode is not truly private. While it keeps your local browsing private, third parties like your school and internet service provider can still see your incognito history.
You can recover incognito history using tools like DNS cache or professional data recovery tools that can access deleted browsing data including incognito history.
You can tell if someone is using incognito mode by the color of the browser screen, or by using a third-party tool to view browsing history.
To permanently delete incognito history, clear the device’s DNS cache.
You cannot see incognito history directly on Wi-Fi. Instead, look at the router logs to see browsing activity.












Leave a Comment