What Your ISP Can See When You Use HTTPS

HTTPS protects the contents of a web connection. Your internet provider generally cannot read the page, password, form data, or URL path inside properly configured TLS. It can still observe connection metadata, and in common configurations it can see or infer the destination domain.

The exact answer now depends on more than the padlock. Encrypted DNS can hide the DNS query from the access provider. Encrypted Client Hello can hide the real server name in the TLS handshake. A VPN can hide destinations from the ISP while moving that visibility and trust to the VPN provider.

The short version: With HTTPS, an ISP can see destination IP addresses, connection timing, duration, and traffic volume. It may also see the domain through plaintext DNS or conventional plaintext SNI. DNS over HTTPS or DNS over TLS hides the DNS query from the ISP when the encrypted resolver is outside the ISP. ECH hides the real server name in the TLS ClientHello when both the client and site support it. Shared hosting makes an IP address less conclusive, but metadata can still support inference. Retention practices vary by provider and jurisdiction, so do not assume that every observed destination is stored or that none is.

What HTTPS hides from your ISP

TLS encrypts the HTTP request and response. That usually protects the specific path, query parameters, cookies, form contents, page text, and files in transit. The provider sees encrypted packets rather than readable application data.

This protection depends on correct certificate validation and secure endpoints. HTTPS does not protect information intentionally sent outside the encrypted request, compromised devices, browser extensions, account providers, or the website itself.

How an ISP can still learn the destination

The first signal is DNS. A device commonly asks a resolver to translate a domain into an IP address. If that query is plaintext and crosses the provider’s network, the provider can observe it. If the ISP operates the resolver, it receives the query directly.

Encrypted DNS changes that path. DNS over HTTPS and DNS over TLS encrypt the query between the device and the selected resolver. The ISP may then see a connection to that resolver but not the domain inside the query. The resolver becomes the party trusted with the lookup.

The second signal is the TLS ClientHello. Conventional TLS exposes the Server Name Indication field because a shared server needs to select the correct certificate. Mozilla’s explanation of Encrypted Client Hello describes how ECH encrypts that identifying part of the handshake and works with DNS over HTTPS to improve destination privacy.

ECH only helps when the browser, network path, DNS configuration, and destination support it. Cloudflare’s ECH documentation also notes that ECH depends on encrypted DNS because its configuration is published through DNS records.

The destination IP remains visible to the local network and ISP unless traffic is tunneled. One IP may host many domains behind a content delivery network, which makes a direct domain mapping uncertain. A dedicated IP may be more revealing. Timing, traffic shape, and other observations can support additional inference, but they do not automatically prove the exact page or action.

Setup	Content and URL path	DNS query	TLS server name	Destination IP and traffic metadata
HTTPS with plaintext DNS and SNI	Encrypted	Often visible	Often visible	Visible
HTTPS with encrypted DNS	Encrypted	Hidden from ISP if resolver is elsewhere	Often visible without ECH	Visible
HTTPS with encrypted DNS and ECH	Encrypted	Hidden from ISP if resolver is elsewhere	Real name hidden when ECH succeeds	Visible
Trustworthy VPN tunnel	Encrypted inside tunnel	Hidden from ISP when routed through VPN	Hidden from ISP	ISP sees the VPN endpoint and tunnel metadata

Does your ISP keep a browsing history?

Network visibility and data retention are separate questions. A provider may log DNS queries, connection metadata, security events, or operational records, but the scope and retention period vary with service design, policy, contract, and law. The safe statement is that an ISP can observe certain signals. A universal claim that every provider stores a timestamped domain history would need provider-specific evidence.

The same applies to encrypted DNS and VPN services. They can receive data the access provider no longer sees. Review their logging policy, jurisdiction, technical design, and independent assessments. “No logs” is a claim to verify, not a feature to assume.

How to reduce destination visibility

Enable secure DNS in the operating system or browser, and confirm which resolver receives the queries. Use a current browser with ECH support and understand that site support still varies. For stronger separation from the access provider, use a reputable VPN or another approved tunnel, then evaluate the new provider with the same care.

For sensitive work, minimize the data each layer receives. That principle also guides on-device transcription and data-minimized document workflows. Privacy improves when the architecture narrows both visibility and retention.

Frequently asked questions

Can my ISP see which websites I visit over HTTPS?

Often it can see or infer the domain through plaintext DNS, conventional SNI, or destination IP information. Encrypted DNS and ECH can hide the first two signals when configured and supported. HTTPS still protects the page contents and URL path.

What does HTTPS hide from an ISP?

It normally hides HTTP content such as the exact page path, query string, cookies, passwords, form data, and response body. The ISP still sees network metadata including IP addresses, timing, duration, and traffic volume.

Does encrypted DNS make browsing private?

It hides DNS queries from the ISP when the query goes through an encrypted connection to a different resolver. It does not hide the destination IP, and without ECH the TLS server name may remain visible.

What is Encrypted Client Hello?

ECH encrypts the sensitive part of the TLS ClientHello, including the real server name, when the browser and website support it. It works with encrypted DNS and does not hide destination IP addresses or traffic metadata.

Does a VPN hide browsing from an ISP?

A correctly configured VPN generally hides destination domains and IPs from the access provider. The ISP sees the VPN endpoint and tunnel metadata. The VPN provider may gain visibility into destinations, so its logging and privacy practices matter.