Open beta: PryVPN and Plus are €0. Pro is out of stock.

HomeBlogNetwork

Network

What a Wi-Fi owner can actually see: HTTP vs HTTPS vs DNS vs SNI

Flatmate with Wireshark, hotel gateway, office admin — three watchers, very different powers. Here is the exact table.

The short version. Without a VPN, the network sees your DNS lookups, the SNI hostname of every TLS connection, and metadata (addresses, sizes, timing) — but not HTTPS content. With a full-tunnel VPN plus in-tunnel DNS and a kill switch, all of that collapses to “uses a VPN, this much, at these hours”. Nothing here requires believing us: every claim is checkable with a packet capture and a leak test.

The table: who sees what

LayerCurious flatmate (sniffing)Router owner / admin (logs)With full-tunnel VPN
Plain HTTPEverything: URLs, forms, cookiesEverything, plus historyBlind: encrypted in tunnel
HTTPS contentNo — opaque TLSNo, unless corporate TLS inspection with an installed certificateNo (doubly blind)
DNS lookupsYes, if in clear UDP/53 (the default)Yes, loggable per device and hourNo, when DNS goes through the tunnel
SNI hostnameYes, first TLS packetYesNot visible locally (only the VPN server's address)
MetadataAddresses, sizes, timing, durationSame, per device, historicOnly “VPN tunnel, X GB, these hours”

DNS in the clear

Most devices ask the router for names over unencrypted UDP on port 53. Anyone on the same network with basic tools can watch those questions go by — every domain, live. Router firmwares and tools like Pi-hole or filtered-DNS services can log them per device and hour, which is exactly how “parental visibility” products work. Typing 8.8.8.8 into your settings does not reliably fix this on hostile networks: a gateway in the path can answer before Google ever sees the question.

SNI: the hostname before the encryption

To open an HTTPS connection your device first announces, in the clear, which hostname it wants — the Server Name Indication. The page content that follows is encrypted; the announcement is not. So even with perfect HTTPS everywhere, the network keeps an exact list of domains. Encrypted ClientHello will eventually seal this too, but adoption is still partial — today, SNI is visible, and any honest explanation says so.

Do encrypted DNS settings change the table?

Partly. DNS-over-HTTPS in your browser encrypts lookups to a chosen resolver, hiding them from the local network — but the SNI hostname, destination IPs and metadata stay exactly as visible, and a hostile gateway can block the DoH endpoint to force a silent fallback to plaintext. Worse, a browser DoH setting can bypass the VPN's own DNS, splitting lookups outside the tunnel the VPN just built. Rule of thumb: on a network you trust, browser DoH is a fine upgrade; on one you tunnel through, let the tunnel carry DNS and verify with a leak test instead of stacking two half-solutions.

Metadata: the part nobody encrypts

Encryption hides content, never context: which addresses you talk to, how many bytes, for how long, at what hours, over TCP or QUIC. From that alone an observer infers video evenings, work hours, which apps (by their content networks), even the operating system. Metadata is why “but it's all HTTPS” is not a complete answer — and why a VPN's first job is shrinking this table to one row.

The captive-portal window

One honest gap: the VPN cannot be up before you join the network, and captive portals (hotel, airport, campus) demand 60–90 seconds of cleartext interaction first — login pages, DNS, redirects. During that window you are exposed by construction. Minimize it: join from a secondary device or mobile data if you can, check certificates, authenticate, connect the VPN immediately, and only then open anything sensitive. Real hotel-gateway attacks in 2026 worked exactly in this window, redirecting logins before any tunnel existed.

Questions we hear

Can the hotel see my passwords with a VPN on?
No — HTTPS content stays encrypted end to end, and the hotel cannot even see which domains you visit once DNS and SNI travel inside the tunnel. What it sees: a VPN connection, how much data, and when. Log in through the captive portal first, then connect before anything else.
Does incognito mode hide me from the Wi-Fi owner?
Not at all — it only cleans your own device afterwards. DNS, SNI and metadata leave the machine identically. Our companion post on the incognito myth covers this in full.
Can my employer see through a personal VPN?
On your own device over office Wi-Fi without inspection certificates: they see VPN usage, not content. On a company-managed device with MDM or an installed corporate certificate: assume everything is visible, VPN or not — monitoring happens above the tunnel. Never mix the two.
How do I verify all of this myself?
Two tools: a packet capture on your own network (watch DNS and SNI with the VPN off, watch them vanish with it on) and a leak test for DNS, WebRTC and IPv6. If any test names your ISP where it should name the tunnel, fix that one setting and re-run.

Jonas KellerSecurity Researcher

Jonas tests what the apps promise: leak checks, kill-switch behavior, and everything on the never-logged list.

Reviewed by Mara Vidal · 22 September 2026

Take a lane.

PryVPN and Plus are €0 during the beta. A profile takes one click.