What HTTPS Hides From Your ISP

HTTPS encrypts the content of your web traffic, so your internet service provider (ISP) cannot see the pages you visit, the text you type, or the files you download. However, your ISP can still see the domain names of the websites you connect to (e.g., example.com), the IP addresses, and the amount of data transferred. This article explains exactly what HTTPS protects, what it doesn’t, and what you can do if you want more privacy.

How HTTPS Encryption Works

HTTPS (Hypertext Transfer Protocol Secure) combines the standard HTTP protocol with TLS (Transport Layer Security). When you visit a site using HTTPS, your browser and the server perform a handshake to agree on encryption keys. After that, all data exchanged is encrypted with a session key—usually AES-256 or similar. This means that anyone who intercepts the traffic between your device and the server sees only gibberish.

The encryption is end-to-end between your browser and the website’s server. That’s a crucial point: it does not encrypt traffic between the server and other services, and it does not hide the destination address from network operators. The TLS handshake itself reveals the server’s hostname (e.g., en.wikipedia.org) because the client sends the domain in plaintext as part of the SNI (Server Name Indication) extension. This is necessary so the server can present the correct certificate.

What Your ISP Can Still See

Even with HTTPS, your ISP can observe:

• Domain names – via DNS queries and SNI. When you type example.com, your device sends a DNS request to resolve it to an IP address. That DNS query is usually unencrypted, so your ISP sees the domain.
• IP addresses – The destination IP address is visible in the IP packet headers. Even if you use a VPN, the ISP sees the VPN server’s IP.
• Traffic volume – The size and timing of data packets reveal how much you download or upload, and the pattern of activity.
• Connection metadata – When you connect, for how long, and how often.

So, while the ISP cannot read the content of your messages or the pages you view, it can build a detailed log of the websites you visit and when.

What HTTPS Fully Protects

HTTPS ensures that the actual payload—the HTML, images, scripts, cookies, and form data—is encrypted. This means:

• Your ISP cannot see the specific page path (e.g., /products/shoes) or query parameters (?id=123).
• Your login credentials, credit card numbers, and personal messages are unreadable to anyone eavesdropping.
• Your search queries are hidden from the ISP (though the search engine itself may see them).
• Downloaded file contents are hidden, although the file size is visible.

This protection extends to any intermediary, such as a Wi-Fi hotspot operator or a malicious actor on the same network.

DNS and SNI: The Leaky Parts

Two technologies often leak domain information despite HTTPS:

DNS (Domain Name System) – Most ISPs run their own DNS servers. When you type a domain, your device asks the ISP’s DNS server for the IP address. That query is sent in plaintext by default. To mitigate this, you can use DNS over HTTPS (DoH) or DNS over TLS (DoT), which encrypt the DNS query itself. However, the ISP still sees the IP address you connect to, and sometimes the SNI still leaks.

SNI (Server Name Indication) – During the TLS handshake, the client sends the hostname in plaintext. This is how the server knows which certificate to present. Encrypted Client Hello (ECH) is a newer extension that encrypts the SNI, but it is not yet widely deployed. As of 2024, most major browsers support ECH, but many websites do not.

How to Hide More From Your ISP

If you want to hide even the domain names and IP addresses from your ISP, you have several options:

• Use a VPN – A virtual private network encrypts all your traffic and sends it to a VPN server. Your ISP sees only that you are connected to the VPN server’s IP address, not the websites you visit. The VPN provider, however, can see everything unless they have a strict no-logs policy.
• Use Tor – The Tor network routes your traffic through three relays, encrypting it at each hop. Your ISP sees that you are connecting to a Tor entry node, but not the destination.
• Use encrypted DNS – Configure your device to use DoH or DoT with a trusted resolver like Cloudflare or Google. This prevents your ISP from seeing DNS queries, but they still see the IP addresses.
• Use a proxy – A proxy server forwards your requests, but it only works for specific protocols and does not encrypt traffic between you and the proxy unless it’s an HTTPS proxy.

Each method has trade-offs in speed, cost, and trust. A VPN is the most common for everyday privacy, but you must trust the VPN provider not to log your activity.

Common Misconceptions About HTTPS

One common misconception is that HTTPS means a website is safe from malware or phishing. HTTPS only guarantees that the connection is encrypted and that the server has a valid certificate for the domain. It does not verify the site’s content or legitimacy. A phishing site can also have HTTPS.

Another misconception is that HTTPS hides the fact that you are visiting a site. As explained, your ISP still sees the domain. For example, if you visit healthforum.example, your ISP knows you visited that domain, even though it cannot see which pages you read.

Finally, some people think that using incognito mode in a browser hides activity from the ISP. Incognito only prevents local browsing history from being saved; it does not affect what the ISP sees.

Frequently Asked Questions

Can my ISP see my search history if I use HTTPS?

Your ISP cannot see the search queries you type into a search engine if the connection is HTTPS, because the query is part of the encrypted payload. However, they can see that you visited the search engine’s domain (e.g., google.com) and the amount of data exchanged.

Does HTTPS hide the websites I visit from my ISP?

No, HTTPS does not hide the domain names. Your ISP can see the domain via DNS and SNI. It only hides the specific pages and content within that domain.

Is it legal to use a VPN to hide traffic from my ISP?

In most countries, using a VPN is legal, but there are exceptions. Some countries restrict or ban VPN usage. Always check your local laws. Using a VPN to hide illegal activity is still illegal.

What is the difference between HTTPS and VPN?

HTTPS encrypts only the data between your browser and a specific website. A VPN encrypts all traffic from your device to the VPN server, which then forwards it to any website. A VPN hides your IP address and the websites you visit from your ISP, while HTTPS does not.

Can my ISP see my WhatsApp messages if I use HTTPS?

WhatsApp messages are end-to-end encrypted, and the connection to WhatsApp servers uses HTTPS. Your ISP can see that you are connecting to WhatsApp servers and the amount of data, but not the content of your messages.

Does HTTPS protect against malware?

No. HTTPS only encrypts the connection. Malware can be delivered over HTTPS just as easily as over HTTP. Always use antivirus software and be cautious about downloading files.

Related

• Clipboard Access Denied: Error Explained
• Cheap Mechanical Keyboards: What to Know Before Buying
• 1Password vs Keeper: Which Password Manager Wins?