Mozilla is changing how Private Browsing handles downloaded files: instead of silently removing certain files when a private window closes, Firefox Nightly is now prompting users and offering a new setting to keep or delete downloads, a behavior expected to land in Firefox 143 if the experiment proceeds as reported.
For years Firefox’s Private Browsing mode has preserved the basic promise of privacy by clearing session traces — cookies, history, and certain cached data — after private windows are closed. But there’s been a long-running and occasionally confusing detail: files that Firefox opens automatically (not explicitly saved by the user) — especially PDFs rendered in the built‑in viewer — are sometimes treated as temporary and removed when the private session ends. That decision has repeatedly surprised users who find files in their Downloads folder disappear after closing Private Browsing windows.
The core technical background is straightforward. Firefox needs to write a file to disk to open it (for PDF rendering or to hand it to a helper app). Historically Firefox either wrote that content to the configured Downloads folder or to an OS temp directory. When the file was stored in a temporary location or flagged as an internally‑handled, ephemeral download, Firefox would — by design — remove it when the private session ended to avoid leaving artifacts behind. Changing download storage behavior (Downloads vs. temp) and how "open vs. save" is handled has been the subject of preferences, enterprise policy, bug reports and user workarounds for several releases. (searchfox.org, support.mozilla.org)
Note: that WindowsReport-style description is consistent with the types of UX experiments Mozilla often rolls out to Nightly/Beta channels. However, at the time of writing the change does not appear to be present in official stable release notes from Mozilla; until Mozilla publishes release notes or a tracking bug with a firm implementation date, the Nightly behavior is best described as experimental and subject to change.
That said, the Nightly experiment should be confirmed in stable release notes and tracked in Mozilla’s official communications before treating the change as final. Users who rely on Firefox for sensitive workflows should test the Nightly/Beta builds or await the stable release and then adjust Settings or about:config accordingly. The long-term success of the change hinges on a careful UX implementation that avoids prompt fatigue and gives defaults that reflect the majority of user expectations.
The change resolves a long-standing tension between privacy and predictability: Private Browsing should keep secrets, but it should not silently delete user files without a clear choice. Firefox’s Nightly experiment to ask users and expose a default is the right direction — provided Mozilla finalizes the wording, choice frequency, and default state with both privacy and usability in mind.
Source: Windows Report Firefox Will No Longer Auto-Delete Downloads in Private Browsing
For years Firefox’s Private Browsing mode has preserved the basic promise of privacy by clearing session traces — cookies, history, and certain cached data — after private windows are closed. But there’s been a long-running and occasionally confusing detail: files that Firefox opens automatically (not explicitly saved by the user) — especially PDFs rendered in the built‑in viewer — are sometimes treated as temporary and removed when the private session ends. That decision has repeatedly surprised users who find files in their Downloads folder disappear after closing Private Browsing windows. The core technical background is straightforward. Firefox needs to write a file to disk to open it (for PDF rendering or to hand it to a helper app). Historically Firefox either wrote that content to the configured Downloads folder or to an OS temp directory. When the file was stored in a temporary location or flagged as an internally‑handled, ephemeral download, Firefox would — by design — remove it when the private session ended to avoid leaving artifacts behind. Changing download storage behavior (Downloads vs. temp) and how "open vs. save" is handled has been the subject of preferences, enterprise policy, bug reports and user workarounds for several releases. (searchfox.org, support.mozilla.org)
What’s changing now (the WindowsReport scoop)
According to recent reporting, Firefox Nightly builds show a new prompt during Private Browsing downloads that reads roughly: “Files stay on your device. Anyone using this device can see downloads, even when you close all private windows.” The prompt gives users an immediate choice between keeping the item or choosing an automatic-delete behavior. The report also says a new toggle appears under Settings > General > Downloads: “Delete files downloaded in private browsing when all private windows are closed”, and that advanced users can adjust related flags in about:config. This UI and prompt are being trialed on Nightly and are slated for release in Firefox 143 if Mozilla adopts the change broadly. Readers should treat this item as a news report of an in-development Nightly change rather than a final documented behavior in a stable release.Note: that WindowsReport-style description is consistent with the types of UX experiments Mozilla often rolls out to Nightly/Beta channels. However, at the time of writing the change does not appear to be present in official stable release notes from Mozilla; until Mozilla publishes release notes or a tracking bug with a firm implementation date, the Nightly behavior is best described as experimental and subject to change.
Why Firefox behaved this way — the privacy vs. surprise tradeoff
- Privacy-first rationale: The automatic deletion of files that Firefox internally opened from private sessions was designed to minimize remnants of private browsing activity on a device. If a PDF is opened automatically and never explicitly saved, deleting the temporary file protects users who expect Private Browsing to leave no traces. This is consistent with private‑mode goals: prevent session artifacts from remaining.
- Usability problem: The tradeoff is clear: files that appear in the Downloads view and in the Downloads folder look identical whether they were opened temporarily or saved permanently. Users expect that a visible file in Downloads is persistent until they remove it, and automatic deletion feels like data loss. That mismatch — between the visual affordance (file appears in Downloads) and the actual lifecycle (file may be removed when the private window closes) — generated complaints across support forums and social channels.
- Technical complexity: A number of preferences and policies control whether Firefox uses the system Temp directory or the Downloads folder for files that are “opened.” The preference browser.download.start_downloads_in_tmp_dir and related flags (and enterprise policy StartDownloadsInTempDirectory) allow admins and advanced users to restore or alter previous behavior where opened files would go into a temp folder rather than Downloads. Firefox also exposes preferences such as browser.download.force_save_internally_handled_attachments to influence whether internally-handled attachments are forced to be saved rather than opened. These knobs exist because there is no single correct behavior for all users and environments. (searchfox.org, support.mozilla.org)
What the new behavior does — practical details
According to the Nightly report (the behavior described in the WindowsReport piece), the change introduces two user-facing elements:- A one-time (or per-download) prompt in Private Browsing whenever a user downloads or opens a file, warning that the file will remain on the device unless the user opts for automatic deletion. The prompt offers at least two choices such as “Got it” (keep file) and “Delete files automatically” (mark to delete when all private windows close).
- A persistent Settings toggle under Settings > General > Downloads labeled “Delete files downloaded in private browsing when all private windows are closed” to control the default behavior. For advanced adjustments the relevant about:config flags would still be available.
Evidence and verification
- Mozilla’s official support pages document that files opened rather than saved from Private Browsing can be treated as temporary and may be removed at the end of the session; community moderators have recommended saving files explicitly or toggling the temp-folder preference to avoid surprises. This makes the underlying problem and the earlier rationale clear.
- Firefox’s source and preference list include the download-related preferences mentioned earlier — including browser.download.start_downloads_in_tmp_dir and browser.download.force_save_internally_handled_attachments — demonstrating the browser already exposes the configuration surface to alter default behavior. That source-level visibility corroborates both the existence of prior workarounds and the feasibility of adding a UI setting.
- Community reporting — on support forums and threads such as Reddit — documents repeated incidents where PDFs and other files disappeared after closing private windows, including specific troubleshooting steps and recommended about:config tweaks. Those community reports add a user-impact dimension supporting why Mozilla would consider a visible choice.
- Independent write-ups and guides (community blogs and tutorials) show how users can change preferences to restore prior behaviour (use the OS temp directory for “open” flows), and they document the existence of enterprise policies and the exact about:config keys to change, further corroborating technical details. (askvg.com, support.mozilla.org)
Strengths of the change
- Restores user control and clarity. A prompt and a clear toggle will prevent accidental data loss and reduce the surprise factor for non-technical users who expect downloaded files to persist. Explicit language that “files stay on your device” aligns user expectations with behavior.
- Flexible defaults for different users. Power users and enterprises who want strict auto-deletion (for shared kiosk machines, for example) can keep automatic deletion enabled; privacy-minded users who still want downloads to persist can choose to keep files. The settings + about:config options maintain flexibility.
- Better security posture with clearer consent. By warning users that downloads remain visible to anyone with device access, Firefox nudges users to consider device-level protections (full-disk encryption, separate accounts) and to avoid storing sensitive documents on shared machines.
- Reduced support churn. Historically, disappearing files have generated repeated support cases and threads. A transparent UI reduces the need for users to hunt for obscure about:config fixes and for support documentation to explain the nuance. (support.mozilla.org, reddit.com)
Risks and shortcomings
- Prompt fatigue and misuse. Any new prompt risks being clicked away or ignored. If the prompt is not implemented thoughtfully (for example, if it appears for every trivial download), users may disable it or choose the wrong default, recreating confusion.
- Legal compliance implications. In some regulated environments, explicit deletion of downloaded artifacts may be required (for example, on public kiosks). New defaults that preserve files could require additional guidance for enterprise admins to ensure compliance with local policies.
- Complexity for non-technical users. Although a settings toggle helps, non-technical users may still be uncertain whether a downloaded PDF will be deleted later. The UX must make the default and the implications obvious.
- Edge-case behaviors remain. The root of the confusion often lies in how different servers present files (MIME types, content-disposition headers) and whether files are opened or saved by Firefox. Some server responses may result in inconsistent behavior across file types; the UI change doesn’t eliminate those protocol-level complexities. Community threads indicate the browser’s decision sometimes depends on server headers and internal handling, meaning users may still need to know how to force a save. (reddit.com, support.mozilla.org)
Practical guidance: How to control Firefox’s private-download behavior today
- Use Settings (when present)
- If your Nightly or Beta build shows the new option, open Settings > General > Downloads and choose the toggle “Delete files downloaded in private browsing when all private windows are closed” to suit your preference. If unchecked, files will remain until you delete them; if checked, files saved or opened during private sessions will be removed when the last private window closes.
- Use the about:config preferences (advanced)
- Open about:config (type about:config in the address bar and accept the risk).
- To force opened, internally-handled attachments to be saved rather than opened and then deleted, set:
- browser.download.force_save_internally_handled_attachments = true.
- To send “open” downloads to the OS temp directory (reducing Downloads clutter and making ephemeral files easier to auto-clean), set:
- browser.download.start_downloads_in_tmp_dir = true.
- To control inline PDF opening behavior:
- browser.download.open_pdf_attachments_inline = false/true depending on whether you want PDFs rendered inline or saved/opened externally. (Check the preference value available in your build).
- Enterprise policies
- Organizations can set enterprise policy StartDownloadsInTempDirectory to push ephemeral behavior across managed devices, or configure default download locations and deletion rules via Group Policy/Enterprise policies deployed by Mozilla. Consult enterprise documentation and your IT policy for specifics.
- User workflow tips
- If you want to keep a file opened in Private Browsing, explicitly use the Save or Save As dialog instead of trusting an “open” flow.
- Use separate Windows user accounts or BitLocker/Vault solutions on Windows for sensitive files rather than relying only on browser-level deletion.
What this means for Windows users (specifics for the Windows audience)
- On Windows, Downloads is a persistent folder by default and many users assume it contains permanent files until they delete them. The new prompt addresses a Windows‑specific UX mismatch: a file that looks like it’s in Downloads may actually have a temporary lifecycle. Making the choice explicit avoids accidental Windows-level data loss.
- Windows-specific management tools (OneDrive and Files On‑Demand) can complicate matters: a downloaded file may appear in the Downloads list but be a stub or sync placeholder; clarifying browser behavior reduces the risk of sync-related confusion.
- If you manage shared Windows machines (library kiosks, lab PCs), enable automatic deletion in the browser settings or enforce it via enterprise policy to keep local storage clean and compliant.
Verdict: a sensible course correction — with caveats
Mozilla’s move to surface the private-download lifecycle as an explicit choice is a sensible UX correction. It replaces an obscure, automatic behavior that caused real data loss for users with a visible, consent-driven flow. The presence of about:config flags and enterprise policies means power users and admins retain granular control, while casual users benefit from a clearer default.That said, the Nightly experiment should be confirmed in stable release notes and tracked in Mozilla’s official communications before treating the change as final. Users who rely on Firefox for sensitive workflows should test the Nightly/Beta builds or await the stable release and then adjust Settings or about:config accordingly. The long-term success of the change hinges on a careful UX implementation that avoids prompt fatigue and gives defaults that reflect the majority of user expectations.
Next steps for readers and administrators
- If you run Firefox Nightly and see the new prompt: test it, choose the option that matches your workflow, and consider reporting any confusing wording or missing edge cases through Mozilla’s feedback channels so the UI can be improved before release.
- If you use Firefox Release or Beta and want immediate control: apply the about:config toggles noted above to force open-handled files into temp or force save behavior until the official UI lands. (support.mozilla.org, searchfox.org)
- Administrators should evaluate enterprise policy settings to ensure managed devices follow the organization’s retention and privacy rules, and update internal guidance accordingly.
The change resolves a long-standing tension between privacy and predictability: Private Browsing should keep secrets, but it should not silently delete user files without a clear choice. Firefox’s Nightly experiment to ask users and expose a default is the right direction — provided Mozilla finalizes the wording, choice frequency, and default state with both privacy and usability in mind.
Source: Windows Report Firefox Will No Longer Auto-Delete Downloads in Private Browsing