Work

Your employer can read your HTTPS: how to check in 1 minute

On a company-managed device, no padlock protects you from your own IT department. How inspection works, the one-minute check, and the setup that actually separates work from life.

6 October 2026 · 5 min read

The short version. Companies install their own root certificate on managed devices, letting a proxy decrypt, inspect and re-encrypt your HTTPS — padlock included. A personal VPN cannot help there: monitoring happens above the tunnel, on the device itself. The check takes a minute (look at who issued the certificate); the fix is structural (personal life on personal hardware), not another app.

How TLS inspection works

HTTPS protects traffic between two endpoints — but on a managed device, your employer owns one of the endpoints. IT installs a company root certificate through device management; a proxy then terminates your TLS connections, inspects the plaintext (for malware, data loss, policy), and re-encrypts towards the real site with a certificate minted on the fly. Your browser shows the green padlock because, as far as it knows, the chain is valid: the company is its own certificate authority.

This is not a hack or a vulnerability. It is standard enterprise security tooling, deployed openly, usually disclosed somewhere in the acceptable-use policy nobody reads. Alongside it typically ride screenshots, keystroke logging, browsing history at the OS level and remote wipe — all running above any VPN you could install.

The one-minute check

Open any HTTPS site and click the padlock, then the certificate details.
Look at the certification path / issued-by chain. A public site should chain to a public authority (Let's Encrypt, DigiCert, Sectigo and friends).
If the root is your company's name — or anything that is not a public CA — your traffic is being inspected. Compare with the same site on mobile data: different issuer, confirmed.

Bonus signal: apps with certificate pinning (banking apps, some messengers) mysteriously failing only on the office network. Pinning refuses the forged certificate where browsers silently accept it.

The matrix: whose device, whose network

Four combinations, four answers:

Personal device + personal network: your business. A VPN hides metadata from the ISP; nobody inspects anything.
Personal device + office Wi-Fi, no inspection certs: the admin sees VPN usage (or domains, without one) but not content. The safest “borrowed network” case.
Company device + any network: assume everything is visible — HTTPS, passwords, personal webmail opened “just for a second”, AI prompts. A personal VPN changes nothing here.
Personal device + office Wi-Fi with inspection certs installed on it: do not install those certificates on personal hardware. That prompt is asking for full access; declining is the whole defense.

What MDM sees beyond the network

Mobile-device management reaches past traffic into the device itself: installed app inventory, OS version and patch level, location history, encryption status, and remote lock or wipe. It can push certificates (enabling the inspection above), restrict store logins, and log every managed-app event. None of this needs the network at all — it syncs whenever the device is online, VPN or not. This is why the matrix has no middle ground: a managed device is an observed device, and privacy on it is a policy question for your employer, not a software problem you can fix with downloads.

Never mix: the only setup that works

Personal life on personal hardware on networks you trust (or tunnel yourself). Work on work hardware, accepting it is observed. No incognito, no VPN, no DNS trick evades endpoint monitoring — those tools protect traffic in transit, and on a managed device the watchers live before transit begins. For anything that must survive even inspection, use end-to-end encrypted messengers: the proxy then sees only ciphertext it cannot open.

Questions we hear

Will a personal VPN hide me from my employer?

Only on your own unmanaged device, and only from network-level watchers (they see VPN usage, not content). On a company-managed device with monitoring software or an installed root certificate, no — the observation happens on the device, above any tunnel.

Is it legal for them to read my personal Gmail?

Generally yes on their equipment and network, within policy and local law — which is exactly why the answer is structural, not technical. Check your acceptable-use policy and local regulations; this post is information, not legal advice. And keep personal accounts off work hardware regardless.

Does incognito help on a work laptop?

Not at all against endpoint monitoring or inspection — it only cleans local traces afterwards. The proxy, the keylogger and the screenshots do not care which mode the window was in.

What about DNS over HTTPS at work?

Same story: it hides lookups from passive network sniffers, but an inspecting proxy terminates the connections themselves, and endpoint agents see everything anyway. Useful on untrusted networks you do not manage; irrelevant against your own IT department.

Jonas KellerSecurity Researcher

Jonas tests what the apps promise: leak checks, kill-switch behavior, and everything on the never-logged list.

Reviewed by Elena Marín · 6 October 2026