Without a VPN, your internet service provider can see every domain you connect to, when you connect, how much data goes back and forth, and which devices in your home are online. It cannot read the content of pages on HTTPS sites, which today is nearly all of them, and it cannot see your Google searches or your messages. With a VPN, the ISP sees one encrypted connection to one server and the amount of data, and nothing else. What it stops seeing, the VPN provider starts seeing, so the honest question is not "how do I hide" but "who do I want to trust with the list."

What the ISP sees without a VPN

Domains, not pages. Two things reveal the site you are visiting even on HTTPS. First, the DNS query: before your browser opens a site, it asks a DNS server, usually the ISP's, for the site's address, in plain text. Second, the server name in the TLS handshake, a field called SNI, which is sent unencrypted at the start of most HTTPS connections. So the ISP sees that you opened a news site, a bank, a medical site or a dating app. It does not see which article, which account or which profile.

Timing and volume. When you were online, for how long, how much data each connection moved. A video call and a file download have different shapes, and traffic shapes can be classified even when they are encrypted.

Your devices. The ISP-supplied router reports connected devices, and each device's traffic patterns identify it as a phone, a TV, a console.

Plain-text traffic. Old apps, some smart-home devices and any site still on plain HTTP send content readable by anyone in the path.

Not visible: page content on HTTPS, form data, passwords, search terms, message content in end-to-end encrypted apps. Encryption in transit is the default now, and it works.

What changes with a VPN

The VPN app wraps everything your device sends, DNS included, into an encrypted tunnel to the VPN server. From the ISP's side:

  • The only destination is the VPN server's IP address.
  • DNS queries are inside the tunnel, so no domain list.
  • SNI is inside the tunnel, so no server names.
  • Volume and timing are still visible: the ISP knows you moved 3 GB tonight, not what it was.
  • The fact that you use a VPN is visible, and with some protocols the type of VPN is obvious. Protocols such as VLESS are built to look like ordinary HTTPS traffic to a normal website, which makes even that less obvious.

Two conditions for this to hold. DNS must actually go through the tunnel; if it does not, the ISP still gets the domain list, and you should check with the steps in is my DNS leaking. And the tunnel must stay up; a kill switch keeps traffic blocked during reconnects instead of letting it fall back to the ISP.

What the VPN provider sees instead

This is the part most articles skip. Once the tunnel is up, the VPN server is where your traffic is decrypted and sent on to websites. So the VPN provider is in exactly the position the ISP was in: it can see the domains, the timing and the volume, and it cannot see HTTPS content. Whether it records any of that is a policy question, and the only way to evaluate a policy is to read it.

A useful test is to look for specifics. "No logs" alone is marketing. A policy that lists what is stored and what is not is something you can check. For example, 404 VPN's privacy policy states that it does not store browsing history, DNS queries, traffic content or metadata, or your source IP after the connection is established, and that it does store your email, subscription status, and aggregated technical statistics such as data volume per period and the date of last connection. That last part matters: a provider that claims to store nothing at all is either not running a service or not telling you everything.

What websites see

Without a VPN, a website sees your real IP address, from which it derives a rough location and your ISP's name. With a VPN it sees the server's address. Everything else a site learns about you, cookies, logins, browser fingerprint, screen size, installed fonts, is unaffected by the VPN, because it comes from the browser rather than the network. The Privacy Checker shows what your browser reveals on its own, without the IP address, and it is usually more than people expect.

What about encrypted DNS and ECH?

You can close part of the gap without a VPN. Encrypted DNS, over HTTPS or TLS, hides the DNS queries from the ISP, though not from the DNS provider. Encrypted Client Hello, a newer TLS extension, hides the SNI as well, but only on sites and networks that support it, and support is still partial. Together they shrink what the ISP sees to IP addresses and traffic shapes. A VPN covers all of it at once, for every app, and adds the IP change on top. Use encrypted DNS regardless; it is free and improves things even with a VPN as a fallback.

Practical summary

  • The ISP sees domains, timing, volume and devices. Not content, not searches, not messages.
  • A VPN reduces that to "one encrypted connection and some volume," provided DNS goes through the tunnel and the kill switch is on.
  • The VPN provider then sees what the ISP used to. Read its policy for specifics, not slogans.
  • Websites still see your browser. A VPN changes the address, not the fingerprint.

404 VPN's apps route DNS inside the VLESS or WireGuard tunnel, include a kill switch, and the privacy policy lists exactly what is and is not kept. Details on the security page; get started here.