What Your Internet Provider Can See
Not a general explainer - this reads your own connection and reports, channel by channel, what the company carrying your traffic can observe right now. Each row says whether it was measured or derived.
🧪 Establish the rest
Two rows above are honest about their limits: DNS cannot be established from a page like this one, and the destination row is a consequence of the tunnel state rather than an observation. These tests settle both.
How your provider sees your traffic
Every packet you send passes through the company that sells you the connection. That position is unavoidable - it is what carrying traffic means - and it is why the question is never whether your provider can see something, but which parts of “something” encryption has already covered.
HTTPS covers a lot. The contents of pages, the messages you send, the passwords you type: none of it is readable in transit. What HTTPS does not cover is the envelope. Addresses have to stay readable or the packet cannot be routed, and on most connections the site name is announced in the clear at the start of the handshake so the server knows which certificate to present. That is enough to reconstruct where you went without decrypting a single byte.
What a VPN changes
A tunnel wraps the envelope as well as the contents. Your provider then sees one destination - the VPN server - and a stream of encrypted traffic going to it. Destinations, hostnames and, when DNS goes through the tunnel, lookups all leave their view.
What it does not do is remove an observer. Everything your provider used to see, the VPN operator now sees instead, from a position just as complete. A VPN is a decision about who holds that view, not a way of ensuring nobody holds it - which is why an operator's jurisdiction, logging policy and audit history decide whether the trade was worth making. And timing and volume stay visible to your provider either way: a tunnel hides where traffic goes, not that it exists or how much of it there is.
Where these results stop
- The handshake result describes the connection that was measured, not every site you visit - Encrypted Client Hello support is still uneven.
- Rows marked derived follow from whether a tunnel is up. They are reasoning, not observation, and are labelled that way.
- DNS is not established here at all. It needs the dedicated test.
- None of this covers what the sites themselves record, which is a separate question from what the network sees.
What your ISP can see - FAQ
Straight answers about what the company carrying your traffic can and cannot observe.
Can my ISP see my browsing history?
It can see which sites you visit, but not what you did on them. Two channels give the site names away: DNS lookups, if they go to your provider's own resolver, and the hostname announced in the clear during the TLS handshake on connections without Encrypted Client Hello. Page contents, messages and passwords are encrypted and stay unreadable. So the accurate description is a list of sites and timings rather than a history of your browsing.
Does HTTPS hide the sites I visit from my ISP?
Not by itself. HTTPS encrypts what travels inside the connection, but the address of the server has to stay readable for the packet to be delivered, and on most connections the hostname is sent in plaintext at the start of the handshake so the server knows which certificate to present. Encrypted Client Hello closes that second gap, and this page measures whether it was active on the connection it tested. The destination address remains visible in every case.
Does a VPN stop my ISP from seeing anything?
It stops your provider from seeing where you go, not that you are online. With a tunnel up, your provider sees encrypted traffic to a single address and nothing about the destinations behind it - but it still sees when you are connected, for how long, and how much data moves, which is enough to distinguish a video stream from ordinary browsing. It also still knows who you are, because the subscriber account behind the line does not change.
If a VPN hides my traffic from my ISP, who can see it instead?
The VPN operator, from a position just as complete as your provider's. Traffic has to be decrypted somewhere before it reaches the wider internet, and that somewhere is the operator's server. Using a VPN is therefore a decision about which company holds that view, not a way of ensuring no company holds it. Whether the trade is worth making depends on the operator's jurisdiction, what it records, and whether independent auditors have checked the claim.
Does incognito mode hide anything from my ISP?
No. Private browsing controls what your own browser keeps on your own device - history, cookies, form entries. It changes nothing about the packets leaving your machine, so every channel described on this page reads exactly the same with it on or off. It is a local housekeeping feature, not a network privacy one.
How does this page know what my provider can see?
Partly by measurement and partly by reasoning, and each row says which. Your address and its operator come from our own endpoint, which resolves them server-side. The handshake row is a live measurement of whether the hostname travelled encrypted. The destination and traffic-pattern rows are consequences of whether a tunnel is in use rather than separate observations, and are labelled as derived. DNS is not established here at all, because a page like this one cannot see which resolver answered - the dedicated DNS leak test can.
🧰 Go deeper
Every test runs entirely in your browser - nothing is stored unless you choose to share the result.