Private Browsing mode should prevent most Web browsers from saving loaded content in any way. Any such information such as that in your browser’s cache, its history, or cookie information should be stored temporarily for the current session, and then discarded when you close your browser window. However, in Safari your pages might be logged by a small but overlooked aspect of how Safari handles Web pages.
As described by MacIssues reader Tyler C.:
“I was troubleshooting some issues with Safari and opened up ~/Library/Safari/WebpageIcons.db, and in that file, I was surprised to find all the URLs of sites (stored in plain text) that I and others using my Mac visited in “private windows” in Safari. The URLs seem to stay in there basically forever unless you clear out all your browsing data (which defeats the entire purpose of using a “private window”).”
Unfortunately, it appears that even when in Private Browsing mode, Safari will store this favicon information. While this is normal behavior and is not at all a security risk, it may be considered a privacy issue as pages you might not want a trace of on your system will be logged to this database, which is a simply SQLite database commonly used in OS X, and which can be opened with a number of SQLite readers (including the built-in “sqlite3” Terminal utility). Since the database is not encrypted, if your Mac is not using FileVault, then someone can technically access the file and even open it in a text editor to see the visited URLs.
Safari’s Webpageicon.db file can be opened in any SQLite database reader, where a list of all visited sites can be seen.
Of course Private Browsing features are sometimes associated with underground and illicit activities, but in addition, can be used to help protect one from prying eyes. For instance, when on a break at a workplace, one might wish to visit a personal or social media site, or a messaging service like Gmail, and not be at risk of storing information from this site on the local system. Private Browsing features ought to allow for that; however, with this bug, an employer can see exactly what sites were visited.
Safari does not contain any settings for managing how this database is handled, so for now, if you are concerned about this as a privacy issue, then you have the following choices:
1. Use another browser
While other browsers may have their problems as well, this specific issue so far does not occur in Firefox or Chrome, so you can download and use one of those browsers in Private Mode and avoid Safari.
2. Use a private and encrypted system
If you are worried about the retrieval of such files, then use a personal system for your browsing needs and avoid shared or public ones. Also ensure this system uses FileVault to encrypt all drive contents and make retrieval impossible without your Mac’s administrative password.
3. Manually delete the icon database
After using Safari, you can manually remove the Webpageicon.db file that holds all of this information:
- Open the Go menu in the Finder, and hold the Option key to reveal the Library
- In the Library, go to the Safari folder
- Delete the file called “Webpageicon.db”
An alternative to this is to use the following Terminal command to delete the file (copy and paste this entire line into the Terminal utility, and then press Enter):
rm -f ~/Library/Safari/WebpageIcons.db
Unfortunately this will be required each time you wish to hide visited pages in Safari, so it may not be a practical solution. Additionally, it is a somewhat crude approach that will remove all of your stored Web page icons and not just those for the current private session. These will load again when you next visit your Web sites, but until then, lists such as history and bookmarks will have generic blue sphere icons to represent them.
Yikes. I just looked at mine and there was 45 MB of website URLs… Going back *years*.
Embarrassing for Apple to say the least… but, this is going to be pretty funny once I get my hands on my buddies macs 😉
Just tried this, and it’s not the case for me. OS X 10.9.5, Safari 7.1.3. No URLs from private browsing were saved to that file.
Tested on Safari 8.0.3 OSX 10.10.2 and this bug exists.
Author, have you reported to Apple?
Running Safari 8.04 on OS X 10.10.2 and I don’t have a Safari folder in my Library.
User’s Library. ~/Library/Safari
Just tested on 10.10.3 (14D105g), and Safari 8.0.5 – no data from from my Private windows were saved in there.
I just checked as well and when in Private Browsing nothing is stored in the Webpageicons.db.
running 10.10.3 with Safari 8.0.5. So it looks like they have fixed the issue.
Well I stand corrected. After playing around a little I was able to see my websites in the Webpageicons.db under Private mode running Safari 8.0.5. So not good at all. I guess I will send a report to Apple and see what they will say.
Yup, after further testing is seems that this is a bug, as the data was not cleared after opening a new private browsing window, visiting a few sites, closing it, and the checking the db. I even quit Safari and reopened it to test if that cleared it out, but nope – it was still there. For now the only way around this seems to be either manually delete the db file, or clear all history via selecting “Clear History and Website Data” under Safari -> History.
Why not lock the file from the get info window. That way, it can’t be modified. Right?
Was able to do that and it seems to have worked after I also changed the read/write permission to read only. After locking the Webpageicons.db no webpages are written to the file even after a restart of safari. So good. At least that is a work around for now. I guess you loose favicons but that is a trade off I am willing to except. Thanks
I’m using Safari 7.1.3, did some browsing in private mode, opened with sqlitebrowser and nothing showed up. Only thing I am able to see is what was browsed in regular mode.
Does anyone know how i view the private browsing history on an ipad air?
I can’t find the file to save my life on my Macbook air 10.8.5. Would be v grateful of any advice. I have downloaded SQLite applications etc. but can’t figure out how to find it…
Como faço para acessar esta pasta (bibliotecas) no Ipad
Is not working anymore. If you erased your safari search and open up webpageicons.db it wont show what you erased. I NEED IT TO SHOWWWW HELPPPPPP