Use Firefox Containers to Keep Work and Personal Logins Separate in One Window

One browser, two identities on the same site

You need to check a work inbox and a personal inbox on the same webmail site at the same time. Firefox normally keeps one cookie jar—the browser's stored cookies for a site—per profile, so signing into the second account signs out of the first. Creating a second Firefox profile works, but it means separate windows, separate bookmarks, and extra setup just to keep two logins alive.

Firefox Multi-Account Containers split storage inside a single profile. Each container tab gets its own cookie jar, localStorage, IndexedDB, and cache namespace, identified by a container ID. You can open work mail in a "Work" container and personal mail in a "Personal" container, side by side in the same window, and both sessions stay active.

What a container actually isolates

Containers are built into Firefox through the contextualIdentities WebExtension API, shipped since Firefox 53. When you open a tab in a container, Firefox tags that tab's network and storage requests with the container ID. The browser then keys cookies, localStorage, IndexedDB, and cache by site plus container ID, not by site alone.

Firefox 86 added Total Cookie Protection, which separates cookies by the top-level site you are visiting. Containers add a second partitioning dimension. The result is double-keyed isolation: a site in the Work container cannot read cookies that the same site set in the Personal container.

Container definitions live in your profile's containers.json and persist across restarts. If you enable Firefox Sync for add-ons, container names, colors, and icons sync to other devices.

Worked example: separate work and personal sessions

1. Open about:preferences#containers and confirm "Enable Multi-Account Containers" is checked.
2. Create a container named "Work" with a color and icon.
3. Open a new tab in that container and sign into your work account.
4. Open a second tab in the Default container for the same site and sign into your personal account.

To verify the partition, open the Storage Inspector (Shift+F9), go to Cookies, and check the Container column. The cookie from the Work tab should list "Work"; the cookie from the Default tab should be absent or show "Default". Restart Firefox, reopen the container tab, and confirm the cookie persists. That shows the state is stored at the profile level, not only in memory.

To undo this change, remove the container from about:preferences#containers. Its tabs close and its cookies are cleared. If Firefox Sync is enabled, the deletion also propagates to other synced devices.

Where container isolation stops

Containers isolate browser storage, not your network identity. All containers in the same profile share the same IP address, DNS resolver, TLS client certificates, and HTTP Auth credentials. A website can still see that both tabs come from the same machine and network.

Some web APIs also bypass or weaken container boundaries. SharedWorker and WebRTC can leak across containers if a site uses them carelessly. Service workers and the Cache API are scoped to top-level site plus container, but test carefully if your application relies on them.

Firefox Sync merges container definitions across devices. Deleting a container on one laptop removes its tabs on other synced devices after the next sync. Containers are unavailable in Firefox for Android (Fenix); mobile users need separate profiles or Firefox Focus for similar isolation.

Practical recommendation

Use containers when you need parallel identities on the same website inside one Firefox profile. Use separate Firefox profiles when you need fully separate bookmarks, history, extensions, or network settings. On a managed desktop, check enterprise policies such as ExtensionSettings and ContainerTabs, because an administrator can disable or pre-configure containers.

Start with one container for your most sensitive context—banking or work—and verify with the Storage Inspector that cookies appear under the correct container name before moving more sites into it.