What Your Internet Provider Can Still See

The company that connects your home sits on the path of every site you open. A padlock encrypts the page, and other clues about where you went can remain. This guide explains what your internet provider can still see, and how encrypted lookups, a VPN, or Tor Browser narrow that view.

Last checked October 28, 2026.

Quick answer

The padlock encrypts the page and the password. The site name and the server’s numbered address can still show.

Ordinary address lookups travel in the clear. Encrypted DNS hides them from the provider and shows them to the resolver you pick.

Encrypted Client Hello hides the site name only when that site and your browser both support it.

A VPN or Tor Browser moves the site list off the provider’s view. You then rely on the VPN company, or on Tor’s design.

Why what your internet provider can still see matters

The Tor Project compares internet traffic to postal mail. Every packet carries a sender address and a destination address, and routers along the way, including your provider, learn who is writing to whom. The project says that puts the provider in a position to build a profile of your internet use.⁴

HTTPS is encrypted web traffic.¹ Chrome and other browsers mark sites without it as not secure.¹ Plain HTTP is readable text. Cloudflare says a provider can insert ads into those pages, that HTTPS stops the insertion, and that sniffed packets come across as nonsense.¹

The site name can still sit beside the encrypted page. In the first message, the Client Hello, the browser gives the hostname through Server Name Indication (SNI).² Cloudflare’s Encrypted Client Hello notes say that, without that extra protection, networks in the middle can tell which site is opening.²

DNS is the address book that turns a name into a numbered IP address.³ The Internet Society says DNS is unencrypted by default, so anyone on the path can see it, and the resolver that answers can read the question.³ Even with encrypted DNS, the Society says the provider can still know the sites, because SNI and IP addresses stay unencrypted. Timing and traffic shape remain informative too.³

Your options for shrinking that view

Keep the padlock

HTTPS protects the page and what you type.¹

Pros: Page contents stay unreadable on the path.
Cons: SNI, the destination address, and plain DNS can still name the site.
Best for: every login and payment.

Encrypted DNS

DNS over TLS encrypts the lookup. DNS over HTTPS carries it inside encrypted web traffic.³ The resolver still sees the name. Choosing that resolver changes whom you trust. The Internet Society compares the choice to a VPN, which shields traffic from the local provider while the VPN operator can see it.³ See the Academy’s guide to encrypted DNS, and on a phone the private DNS on a mobile plan guide.

Pros: The path no longer gets a plain list of every name you look up.
Cons: SNI and IP addresses can still name the sites. A workplace may leave DNS unencrypted for troubleshooting.³
Best for: daily browsing, after you accept the resolver’s policy.

Encrypted Client Hello, where the site offers it

ECH encrypts the real site name inside the handshake. Cloudflare’s documentation, updated 17 April 2026, says a provider then sees a Cloudflare site, under the shared name cloudflare-ech.com, and not which site. Free zones use ECH by default.² Cloudflare says dropping that DNS data stops browsers such as Chrome, and a canary name stops browsers such as Firefox.²

Pros: On a supported site, the visible name is shared.
Cons: Other sites still send the real name. A network can turn ECH off.
Best for: a current browser, as a bonus on top of the padlock.

A VPN, using Mullvad

A VPN is an encrypted tunnel to a chosen server. Mullvad says traffic goes to one of its servers and then onward, so your provider sees visits to Mullvad and sites see a Mullvad address.⁶ Mullvad says the VPN company can still see that traffic, because you switch trust from the provider to the VPN.⁶

Mullvad’s no-logging policy, updated 17 June 2026, says it stores no activity logs for an account: no traffic, DNS requests, connection times, IP addresses, or bandwidth.⁷ The account is a random number, with no username, password, or email.⁷ You pay to add time.⁷ Card, PayPal, Swish, and bank-wire payments are not anonymous, Mullvad says.⁷

Packet size and timing stay visible, and Mullvad says the pattern can point to a site.⁸ DAITA, its cover traffic, adds dummy packets and constant sizes. It is in the apps on all platforms, and for now only on select servers in Amsterdam, London, Los Angeles, and New York.⁸ A browser fingerprint, a bundle of small browser details, can still recognise you. Mullvad built Mullvad Browser with the Tor Project for that gap.⁶

Pros: Mullvad says the device’s traffic takes that path, and it publishes a no-log policy.⁶⁷
Cons: The VPN operator can see the traffic. Patterns can remain. Card payments are not anonymous. DAITA is only on some servers.
Best for: everyday apps, after you read the logging policy.

Tor Browser

Tor Browser uses three relays.⁵ The Tor Project says your provider cannot track site names and addresses.⁵ It can see that you are talking to Tor nodes.⁴ No single relay can learn what you are doing.⁴ Sites see Tor unless you identify yourself, and the exit relay is the one that contacts them.⁵ Keep HTTPS, because plain HTTP is readable.¹ The project discourages using any browser except Tor Browser.⁵ On Android, Orbot covers selected apps.

Pros: The provider sees Tor, and trust is split across relays.
Cons: Tor use is visible. A personal login names you.
Best for: a session where the destination list is the sensitive part.

Step-by-step: narrow what the provider can see

Check the padlock before you type a password. Chrome and other browsers flag non-HTTPS sites as not secure.¹
Turn on encrypted DNS with the guides linked above. The resolver can still read the names.³
Update the browser. ECH applies only on sites that offer it, and a network can disable it for browsers such as Chrome and Firefox.²
Use Tor Browser from the Tor Project download page when the provider should not have the site list. Do not send another browser through Tor.⁵
Use Mullvad’s app when the whole device should share one tunnel. Create a numbered account at mullvad.net. No email is required.⁷ Match the payment to how private that payment needs to be. DAITA, if you want it, runs only on select servers in four cities.⁸
Stay logged out in Tor Browser when the visit should stay separate from your name.⁵

Common mistakes to avoid

Treating the padlock as a full hide. Contents are encrypted. SNI and the destination address can still name the site.²³
Stopping at encrypted DNS. The provider can still know the sites.³
Assuming the VPN company is blind. Mullvad says it can see the traffic.⁶
Forgetting packet patterns. Size and timing stay visible.⁸
Paying by card and calling the account anonymous. Mullvad says those payments are not anonymous.⁷

Frequently asked questions

Can my internet provider see the words I search?

With HTTPS, the words sit in the encrypted request, so sniffed packets are not readable text.¹ The provider can still learn the site, from SNI, plain DNS, or the IP address.²³

Does a VPN hide everything from my internet provider?

Mullvad says the provider sees Mullvad, and that the site name in the packets is hidden.⁶⁸ Size and timing remain.⁸ The VPN company can see the traffic you sent it.⁶

Does encrypted DNS stop my provider from seeing websites?

It hides the lookup on the way to the resolver.³ SNI and IP addresses can still name the sites.³

Is Tor Browser the same as a VPN?

A VPN uses one company’s server, and that company can see the traffic.⁶ Tor uses three relays.⁵ Your provider sees Tor nodes, and no single relay can learn what you are doing.⁴

What Your Internet Provider Can Still See

Why what your internet provider can still see matters