joe12387 / detectincognito

JavaScript detection of Incognito & other private browsing modes on Chrome, Edge, Safari, Brave, Firefox, Opera and MSIE.

I'm a software developer specializing in information security, reverse engineering, browser fingerprinting & bot detection.

I maintain several open source repositories here on GitHub.

You can contact me at [email protected]. My PGP key is available here if for some reason you require increased confidentiality.

That's about it.

--

Here are my current active projects as of June 2024:

• detectIncognito - A TypeScript/JavaScript library for detecting the use of incognito mode or a similar private browsing mode when a browser visits a site. Works with all browsers with compatability for old browsers going back approximately 10 years.
• Browser Fingerprinting Resistance Research Repo - Documentation on the current state of browser fingerprinting, browsers' attempts at mitigating such techniques, and the current trackability of all browsers (hint: it's basically all of them).

These project(s) are currently stagnant or deprecated in favor of an unreleased replacement project:

• Overpowered Browser Fingerprinting Script (OPFS) - Released in 2022, this is a browser fingerprinting library that featured certain techniques that were non-public at the time of publishing such as [brave/brave-browser] Issue #24681. I am currently working on a replacement for this library that allows a certain level in change in the browser fingerprint while still being trackable, increasing the lifespans of fingerprint IDs from weeks or months to potentially multiple years. It also includes improved techniques including non-public ones. If you are a company that is interested in this technology and may be interested in purchasing licensing for commercial purposes, send me an email and if we make a deal I'll expedite development. There will also be an open source version of this library for non-commercial use only at some point, but some techniques will remain closed source in order to attempt to prevent Orwellian cross-site surveillance. Potential licencees may be required to sign a contract that requires user consent regardless of applicable privacy regulations prior to fingerprinting similar to a cookie dialog, so I can sleep at night knowing I haven't completely killed privacy.

--

Also, I don't have anywhere to put my list of reported security vulnerabilities, so here they are:

• Reported March 2024: Bugzilla 1885471 - addressed in Firefox 127
• Reported March 2024: CVE-2024-27830 - addressed in Safari 17.5
• Reported August 2022: [brave/brave-browser] Issue #24681 - addressed in Brave 1.47

detectincognito's Issues

False positives

From what I see, the Chrome detection is based on storage quota < physical memory from here, but this condition is not exclusive to incognito mode. It's also in:

• Guest mode
• Privacy and security settings
  • Clear cookies and site data when you close all windows
  • Sites that clear cookies when you close them
• Anytime storage quota < jsHeapSizeLimit. Example: 3.99GB quota and 4GB jsHeapSizeLimit would get detected as incognito

---

Firefox can also produce false positives if the user disables Service Workers and Push API

• dom.serviceWorkers.enabled
• dom.push.enabled

Add support for Chrome on IOS devices

Currently, detect-incognito is not detecting Chrome incognito on IOS devices. Do you have some ideas on how to achieve this?

Old npm package does not link to the new one

This package mentions moving to a differnet package: https://www.npmjs.com/package/detectincognitojs

But the old package has no such note: https://www.npmjs.com/package/detect-incognito

chrome/v8 106+ support

106's update comes with jsHeapSizeLimit matching incongnito and normal browsing. Arms race continues.. I will update if I find a new way... any ideas are welcome

Having this as a promise module

Do you plan making this a module using promises?

Or I can create a PR with this modification.

Can I create a NPM package that supports typescript out of this?

I would use this piece of code with a module bundler, and I use typescript with react.

Ublock Origin prevents loading of detectIncognito.js?

With the Ublock Origin Chrome plugin enabled, detectIncognito won't load on my machine. Any thoughts?

check error Chrome 107.0.5304.108

function storageQuotaChromePrivateTest() {
      navigator.webkitTemporaryStorage.queryUsageAndQuota(
        function (usage, quota) {
          console.log(quota, getQuotaLimit()); // 1119775232 1098907648
          _resolveFn(quota < getQuotaLimit());  // false
        },
        function (e) {
          reject(new Error("detectIncognito somehow failed to query storage quota: " + e.message));
        }
      );
    }

new/easier safari method

navigator.storage.getDirectory().then(ok => {
  console.log('not private')
}, err => {
  console.log('private')
})

Email broken?

Trying to send you an email, but...

<[[email protected]](mailto:[email protected])>: host aspmx.l.google.com[142.250.27.27] said: 550-5.1.1 The
    email account that you tried to reach does not exist. Please try 550-5.1.1
    double-checking the recipient's email address for typos or 550-5.1.1
    unnecessary spaces. Learn more at 550 5.1.1
    https://support.google.com/mail/?p=NoSuchUser
    gb41-20020a170907962900b0078db6f56d51si11074896ejc.808 - gsmtp (in reply to
    RCPT TO command)

Awesome Script But not working for Firefox

I'm using firefox 93.0 on macOS and the script is not working on it

Doesn't work in Brave browser

I use Brave in macOS

Version 1.51.114 Chromium: 113.0.5672.92 (Official Build) (arm64)

It doesn't detect incognito nor regular

detectIncognito v1.1.2 exports is not defined at detectIncognito.min.js:6:36

detectIncognito v1.1.2
Console:
detectIncognito.min.js:6 Uncaught ReferenceError: exports is not defined
at detectIncognito.min.js:6:36
(anonymous) @ detectIncognito.min.js:6

https://cdn.jsdelivr.net/gh/Joe12387/detectIncognito\@main/detectIncognito.min.js

Error: File '/node_modules/detectincognitojs/dist/detectIncognito.d.ts' is not a module.ts(2306)

I install the package, I follow the instructions and I try to import it

import { detectIncognito } from "detectincognitojs";

And I get an error:

File '/node_modules/detectincognitojs/dist/detectIncognito.d.ts' is not a module.ts(2306)

I am using create-react-app with the TypeScript template

I have also created a minimal reproducible example, an empty test project and when I tried to import it, I had the exact same problem.

The previous version (1.1.2) works fine, the error only occurs in the latest version (1.2.0).

Version: 1.2.0
Browsers: All

Always returning true on Chrome 95.0.4638.69 (Official Build) (64-bit)

Checking on console, jsHeapSizeLimit is exactly the same for both private and normal tabs

Firefox displays incorrect isPrivate value when the site URL is HTTP

OS:- MacOs ventura(13.2.1)
Browser: Firefox(113.0.1)

When the site URL is HTTP, the isPrivate value is incorrectly displayed as true instead of false in normal mode.

Solution:

const firefoxPrivateTest = () => {
  const db = indexedDB.open('test');

    db.onerror = function () {
      __callback(true);
    };
    db.onsuccess = function () {
      __callback(false);
    };
};

Vivaldi always shows as isPrivate

I use Vivaldi and it is a Major boon to my workflow, However, we need to stop incognito in browsers for most of our pages. Unfortunately this also throws Vivaldi users under the bus. We have tried several of the work-arounds that no longer work with the current version of Vivaldi.

This is probably a know issue, but would appreciate feedback.

iPhone QR Code scanner

Hi,
Thanks for your great work.

There is one case I'm not sure how you see it, but would help me and possibly many others a LOT:
When opening an URL from the camera app, it will open in normal Safari, either in normal or private mode (whatever was last opened). But when scanning a QR code from the quick access menu (Control Center) shortcut, it will open some single browser window without a URL bar. And this window will not share it's session with Safari, meaning that if someone is authenticated in Safari, he will not be authenticated in this session, which seems to me to be very similar like being in Incognito mode.
Is this something your script could detect as well?
Thank you

(0 , detectincognitojs__WEBPACK_IMPORTED_MODULE_11__.detectIncognito) is not a function

Got this issue
(0 , detectincognitojs__WEBPACK_IMPORTED_MODULE_11__.detectIncognito) is not a function

firefox 108.0 is not correct when http access

my firefox is not in private mode, but i access web page with http, when i get navigator.serviceWorker, it is undefined, and it will be judged to be private mode.

the firefox version is 108.0

Is it safe to use eval?

Hi, thank you for the great work! I wonder if it's safe to use eval in this package?

Doesn't work on Safari 16.0 on MacOS and Mobile

Hello and thank you for your job! But the last update of safari crashes everything. On 1.1.1 it doesn't work and even doesn't throw any errors on safari 16.0. Do you have some thoughts about it? Can you fix it?

TypeError: undefined is not an object (evaluating 'iframe.contentWindow.applicationCache.addEventListener') on iOS 16

error

code

try {
    const result = await detectIncognito();

    if (result.isPrivate) {
      alert(
        'using private mode',
      );
      window.addEventListener('beforeunload', (e) => {
        e.preventDefault();
        e.returnValue =
          'using private mode';
      });
    }
  } catch (error) {
    console.error(error);
  }

environment

safari 16
iOS 16
iPhone 14 on Xcode simulator

code base

ESbuild
react
typescript

---

btw awesome package ! work well on chrome and iOS 15

Do we plan to release v1.1.0 to npm?

I see we have a v1.1.0 release on Github. Do we plan to release it on npm too?

macOs Safari 15 automated tests detected as Private Mode

Hello,
thank's for your job. It is currently the only library that works on all versions of all major vendors.

In my job I have to integrate the control on the verification of the private mode through automated tests using webdriver.io and selenium-standalone.
While testing with Safari 15 on macOS I found that the library detects the browser as private mode even though it is not.
For other browsers such as Chrome, Firefox and Edge / IE the detection occurs correctly.

No detection on recent firefox

Chrome works fine, the demo on firefox gives no output: