Network
What a Wi-Fi owner can actually see: HTTP vs HTTPS vs DNS vs SNI
Flatmate with Wireshark, hotel gateway, office admin — three watchers, very different powers. Here is the exact table.
The short version. Without a VPN, the network sees your DNS lookups, the SNI hostname of every TLS connection, and metadata (addresses, sizes, timing) — but not HTTPS content. With a full-tunnel VPN plus in-tunnel DNS and a kill switch, all of that collapses to “uses a VPN, this much, at these hours”. Nothing here requires believing us: every claim is checkable with a packet capture and a leak test.
The table: who sees what
| Layer | Curious flatmate (sniffing) | Router owner / admin (logs) | With full-tunnel VPN |
|---|---|---|---|
| Plain HTTP | Everything: URLs, forms, cookies | Everything, plus history | Blind: encrypted in tunnel |
| HTTPS content | No — opaque TLS | No, unless corporate TLS inspection with an installed certificate | No (doubly blind) |
| DNS lookups | Yes, if in clear UDP/53 (the default) | Yes, loggable per device and hour | No, when DNS goes through the tunnel |
| SNI hostname | Yes, first TLS packet | Yes | Not visible locally (only the VPN server's address) |
| Metadata | Addresses, sizes, timing, duration | Same, per device, historic | Only “VPN tunnel, X GB, these hours” |
DNS in the clear
Most devices ask the router for names over unencrypted UDP on port 53. Anyone on the same network with basic tools can watch those questions go by — every domain, live. Router firmwares and tools like Pi-hole or filtered-DNS services can log them per device and hour, which is exactly how “parental visibility” products work. Typing 8.8.8.8 into your settings does not reliably fix this on hostile networks: a gateway in the path can answer before Google ever sees the question.
SNI: the hostname before the encryption
To open an HTTPS connection your device first announces, in the clear, which hostname it wants — the Server Name Indication. The page content that follows is encrypted; the announcement is not. So even with perfect HTTPS everywhere, the network keeps an exact list of domains. Encrypted ClientHello will eventually seal this too, but adoption is still partial — today, SNI is visible, and any honest explanation says so.
Do encrypted DNS settings change the table?
Partly. DNS-over-HTTPS in your browser encrypts lookups to a chosen resolver, hiding them from the local network — but the SNI hostname, destination IPs and metadata stay exactly as visible, and a hostile gateway can block the DoH endpoint to force a silent fallback to plaintext. Worse, a browser DoH setting can bypass the VPN's own DNS, splitting lookups outside the tunnel the VPN just built. Rule of thumb: on a network you trust, browser DoH is a fine upgrade; on one you tunnel through, let the tunnel carry DNS and verify with a leak test instead of stacking two half-solutions.
Metadata: the part nobody encrypts
Encryption hides content, never context: which addresses you talk to, how many bytes, for how long, at what hours, over TCP or QUIC. From that alone an observer infers video evenings, work hours, which apps (by their content networks), even the operating system. Metadata is why “but it's all HTTPS” is not a complete answer — and why a VPN's first job is shrinking this table to one row.
The captive-portal window
One honest gap: the VPN cannot be up before you join the network, and captive portals (hotel, airport, campus) demand 60–90 seconds of cleartext interaction first — login pages, DNS, redirects. During that window you are exposed by construction. Minimize it: join from a secondary device or mobile data if you can, check certificates, authenticate, connect the VPN immediately, and only then open anything sensitive. Real hotel-gateway attacks in 2026 worked exactly in this window, redirecting logins before any tunnel existed.
Questions we hear
Can the hotel see my passwords with a VPN on?
Does incognito mode hide me from the Wi-Fi owner?
Can my employer see through a personal VPN?
How do I verify all of this myself?
Reviewed by Mara Vidal · 22 September 2026