What Can Your ISP See With and Without a VPN?

What your ISP can see without a VPN

Your ISP carries every packet between your router and the rest of the internet, so it sits in a good spot to observe the outside of your traffic. The "outside" is more revealing than most people expect.

• Which servers you contact. Every connection goes to an IP address, and the ISP can see it.
• Which domain names you look up. Unless you have switched on encrypted DNS, your lookups for names like example.com travel in a form your ISP can read, and it usually runs the DNS server you are using by default.
• The site name in the connection handshake. When your browser starts an HTTPS session, the name of the site is traditionally sent in a part of the handshake that is not encrypted. Newer protections for this are rolling out unevenly, so do not count on them.
• When, how long and how much. Timestamps, session length and data volume are visible even when everything else is hidden.
• Who you are. The ISP assigned your IP address to your account, so it already knows which household the traffic belongs to.

What it generally cannot see on an HTTPS site is the specific page you read, the text you type, the files you upload or your login details. That is the job of the encryption between your browser and the website.

What your ISP can see with a VPN on

A VPN wraps your traffic in an encrypted tunnel to a server run by the VPN company. From the ISP's side of the wire, all your activity now looks like one long conversation with that single server.

• It can see that you connect to a VPN server, and usually which provider, because VPN server addresses are well known.
• It can see when the tunnel is up and how much data goes through it.
• It can no longer see the individual sites behind the tunnel, nor your DNS lookups, as long as the app routes them through the tunnel.

HTTPS and DNS: what protects you and what leaks

HTTPS is the padlock on most sites today. It encrypts the conversation between your browser and the website, so an ISP or a stranger on café WiFi cannot read it. For ordinary browsing, this is the layer that protects passwords and card numbers. A VPN is not what keeps your bank login private, and any article that says otherwise is overselling.

What HTTPS does not do is hide the fact that you talked to a particular site. That is the gap a VPN narrows. If you want a fuller picture of whether that gap matters for your life, read our honest assessment of whether a VPN is worth it and the basics in our beginner's guide to VPNs.

DNS is the quiet leak in the middle. DNS is the phone book step that turns a name into an address. By default it goes to a server chosen by your ISP, in a form the ISP can read. A good VPN app sends DNS through the tunnel and uses its own resolvers. A misconfigured setup can send those lookups outside the tunnel, which means your ISP still sees your site list even though the VPN shows "connected." We cover how to test for this in DNS leaks explained: how to test for one and fix it.

A VPN moves trust, it does not delete it

The data your ISP loses, your VPN provider gains. Inside the tunnel the provider is in the same position your ISP used to be in, able to see destinations and timing even though it cannot read HTTPS contents. The privacy gain therefore depends on whether you trust the provider more than your ISP, and on what the provider's logging policy says and whether anyone independent has checked it.

That is why we keep returning to evidence rather than slogans. See what a no-logs policy actually means and which audits mean something before you hand a company your traffic. Also check who owns your VPN, because the parent company matters.

What ISPs do with the data varies a lot by country, by state and by company. Some ISPs use browsing-related data for advertising or analytics, some only for running the network, and some offer an opt-out. Legal limits differ by place and change over time. We are not going to summarize them here in a sentence that might be out of date next year. The practical step is to read your ISP's privacy policy, look for an opt-out setting in your account, and decide how much that matters to you.

What a VPN still cannot hide from your ISP

• That you are using a VPN. Some providers offer disguised traffic modes for networks that block VPNs, which we explain in our guide to VPN obfuscation.
• How much you use it, and when. Patterns of volume and timing can still say something about your habits.
• Your identity at the website. If you log in to an account, the site knows who you are no matter what your ISP sees. Our piece on incognito mode versus a VPN goes through this confusion.

So should you use one?

If you do not want your provider to hold a record of the sites you visit, and you are comfortable trusting a VPN company in its place, a VPN is a reasonable tool. If your threat is a stranger on public WiFi, it helps there too. If your worry is someone breaking into your accounts, a password manager and two-factor sign-in do far more. Pick based on your actual concern.

Frequently Asked Questions