Safari bug saves Web page URLs in Private mode

NewSafariIconXPrivate Browsing mode should prevent most Web browsers from saving loaded content in any way. Any such information such as that in your browser’s cache, its history, or cookie information should be stored temporarily for the current session, and then discarded when you close your browser window. However, in Safari your pages might be logged by a small but overlooked aspect of how Safari handles Web pages.

As described by MacIssues reader Tyler C.:

“I was troubleshooting some issues with Safari and opened up ~/Library/Safari/WebpageIcons.db, and in that file, I was surprised to find all the URLs of sites (stored in plain text) that I and others using my Mac visited in “private windows” in Safari. The URLs seem to stay in there basically forever unless you clear out all your browsing data (which defeats the entire purpose of using a “private window”).”

This Webpageicon database is the location in which Safari stores the small associated “favicon” image for the visited address (such as the small crossed tools for MacIssues, or the Apple icon for Apple’s sites). This image can be loaded from the Web server each time you access it, but as with many fairly static features of Web pages, Safari will cache this in a small database so it can be used in features like your browser history and bookmarks, among others.

Unfortunately, it appears that even when in Private Browsing mode, Safari will store this favicon information. While this is normal behavior and is not at all a security risk, it may be considered a privacy issue as pages you might not want a trace of on your system will be logged to this database, which is a simply SQLite database commonly used in OS X, and which can be opened with a number of SQLite readers (including the built-in “sqlite3” Terminal utility). Since the database is not encrypted, if your Mac is not using FileVault, then someone can technically access the file and even open it in a text editor to see the visited URLs.

Webpageicon.db file in OS X

Safari’s Webpageicon.db file can be opened in any SQLite database reader, where a list of all visited sites can be seen.

Of course Private Browsing features are sometimes associated with underground and illicit activities, but in addition, can be used to help protect one from prying eyes. For instance, when on a break at a workplace, one might wish to visit a personal or social media site, or a messaging service like Gmail, and not be at risk of storing information from this site on the local system. Private Browsing features ought to allow for that; however, with this bug, an employer can see exactly what sites were visited.

Safari does not contain any settings for managing how this database is handled, so for now, if you are concerned about this as a privacy issue, then you have the following choices:

1. Use another browser

While other browsers may have their problems as well, this specific issue so far does not occur in Firefox or Chrome, so you can download and use one of those browsers in Private Mode and avoid Safari.

2. Use a private and encrypted system

If you are worried about the retrieval of such files, then use a personal system for your browsing needs and avoid shared or public ones. Also ensure this system uses FileVault to encrypt all drive contents and make retrieval impossible without your Mac’s administrative password.

3. Manually delete the icon database

After using Safari, you can manually remove the Webpageicon.db file that holds all of this information:

  1. Open the Go menu in the Finder, and hold the Option key to reveal the Library
  2. In the Library, go to the Safari folder
  3. Delete the file called “Webpageicon.db”

An alternative to this is to use the following Terminal command to delete the file (copy and paste this entire line into the Terminal utility, and then press Enter):

rm -f ~/Library/Safari/WebpageIcons.db

Unfortunately this will be required each time you wish to hide visited pages in Safari, so it may not be a practical solution. Additionally, it is a somewhat crude approach that will remove all of your stored Web page icons and not just those for the current private session. These will load again when you next visit your Web sites, but until then, lists such as history and bookmarks will have generic blue sphere icons to represent them.

16 thoughts on “Safari bug saves Web page URLs in Private mode

  1. Andy (@dwor)

    Yikes. I just looked at mine and there was 45 MB of website URLs… Going back *years*.

    Embarrassing for Apple to say the least… but, this is going to be pretty funny once I get my hands on my buddies macs 😉

    Reply
  2. Jesse

    Just tried this, and it’s not the case for me. OS X 10.9.5, Safari 7.1.3. No URLs from private browsing were saved to that file.

    Reply
  3. justtemp

    Just tested on 10.10.3 (14D105g), and Safari 8.0.5 – no data from from my Private windows were saved in there.

    Reply
  4. Chris

    I just checked as well and when in Private Browsing nothing is stored in the Webpageicons.db.
    running 10.10.3 with Safari 8.0.5. So it looks like they have fixed the issue.

    Reply
  5. Chris

    Well I stand corrected. After playing around a little I was able to see my websites in the Webpageicons.db under Private mode running Safari 8.0.5. So not good at all. I guess I will send a report to Apple and see what they will say.

    Reply
    1. justtemp

      Yup, after further testing is seems that this is a bug, as the data was not cleared after opening a new private browsing window, visiting a few sites, closing it, and the checking the db. I even quit Safari and reopened it to test if that cleared it out, but nope – it was still there. For now the only way around this seems to be either manually delete the db file, or clear all history via selecting “Clear History and Website Data” under Safari -> History.

      Reply
    1. chris

      Was able to do that and it seems to have worked after I also changed the read/write permission to read only. After locking the Webpageicons.db no webpages are written to the file even after a restart of safari. So good. At least that is a work around for now. I guess you loose favicons but that is a trade off I am willing to except. Thanks

      Reply
  6. Lee

    I’m using Safari 7.1.3, did some browsing in private mode, opened with sqlitebrowser and nothing showed up. Only thing I am able to see is what was browsed in regular mode.

    Reply
  7. Manny

    I can’t find the file to save my life on my Macbook air 10.8.5. Would be v grateful of any advice. I have downloaded SQLite applications etc. but can’t figure out how to find it…

    Reply
  8. Giselle

    Is not working anymore. If you erased your safari search and open up webpageicons.db it wont show what you erased. I NEED IT TO SHOWWWW HELPPPPPP :(

    Reply

Leave a Reply to justtemp Cancel reply