Before you change anything
If you’re on a network you don’t control — a partner’s, a family member’s, a landlord’s — read this first: installing a VPN app, or a sudden drop in domains showing up in a router’s log, can be noticed by whoever administers it. If a change in your online behavior could prompt a reaction from someone in the home, read Safety first: before you remove anything before changing settings or switching to mobile data.
The short version
Whoever controls a Wi-Fi network — a partner, a roommate, a landlord, an employer, a café — can typically see which devices are connected, when they connect and disconnect, and, often, which domains those devices talk to (netflix.com, yourbank.com, a specific clinic’s website). On HTTPS sites, they generally can’t see the pages you load, what you typed, your passwords, or your messages. Domain visibility is the common baseline, but not universal: newer encryption can hide the domain too, depending on browser and site support. Employer networks and some parental-control setups are a further exception, worth knowing why.
Why domains often leak even over HTTPS
HTTPS encrypts the content of a connection, but it was never designed to hide which site you’re connecting to. Two mechanisms can leak the domain: DNS lookups, where your device asks a resolver — often the router or ISP’s — to translate a domain name into an IP address, often in the clear; and SNI, where your browser has traditionally sent the domain name in an early, unencrypted part of the HTTPS handshake so the server knows which certificate to present.
EFF’s Surveillance Self-Defense guide puts it plainly: “HTTPS only protects the content of your communications, not the metadata. So when you visit HTTPS sites, anyone along the communication path… can usually see their domain names (e.g. wikipedia.org) and when you visit them.” The same page adds the limit: “these parties can’t see the pages you visit on those sites (e.g. wikipedia.org/controversial-topic), your login name, or messages you send.” They can also see roughly how much data moved, which is why traffic patterns can sometimes be revealing even without content.
Both leak points can now be closed, but only when both ends support it. Encrypting DNS lookups (DNS over HTTPS or DNS over TLS) prevents “anyone along the path from your network to your DNS resolver” from reading which sites you look up (EFF). Separately, a TLS extension called Encrypted Client Hello (ECH) can mask the SNI itself: on a site with ECH enabled, Cloudflare explains that intermediaries can see a user is visiting a website on Cloudflare, but not which one. ECH depends on both browser and site support — it isn’t universal, and some networks can disable it. So domain visibility is still the common baseline today, but honestly: “often,” depending on support, not “always.”
What a home router owner sees in practice
Consumer routers and mesh systems vary in what their apps show. As one example, eero’s Activity tab displays “live data usage” updating every five seconds and weekly totals per device, plus — for its paid tier — a “searchable historic log of recent network activity” (eero support). Many routers also offer domain-level filtering: eero’s paid Content Filters, for instance, block categories like adult content or social media per profile (eero support). Category-based, often DNS-based, filtering is a long-standing feature on other router lines too, though exact capabilities depend on the router and subscription.
This kind of visibility is typically built in and marketed as a parenting or security feature, and it works the same way whether the person setting it up is a parent, a partner, or a landlord.
The employer exception
Company networks and company-managed devices work differently, and this is where the “just domains” rule breaks down further. Many organizations use HTTPS interception (TLS inspection): a device sits in the middle of the connection, decrypts traffic, inspects it, then re-encrypts it. CISA’s technical alert on this — an archived 2017 page — explains: “In order to perform HTTPS inspection without presenting client warnings, administrators must install trusted certificates on client devices” (CISA). Once that certificate is installed — usually while setting up a company laptop — the interception product decrypts the connection to inspect it, so the organization running it can potentially see traffic content, not just the domain.
A work-issued laptop or employer-managed phone profile is a different threat model than your home router: it isn’t about being on the Wi-Fi, it’s about a certificate trusted by the device itself. If you’re checking for this on your phone, see Configuration profiles and MDM. A personal phone on a company’s guest Wi-Fi, with no company certificate installed, is generally back to the same domains-often-visible baseline as any other network — no worse, but not guaranteed private, for the same ECH/encrypted-DNS reasons above.
What a VPN changes, honestly
A VPN routes your traffic through an encrypted tunnel to the VPN provider before it goes anywhere else. EFF summarizes the trade plainly: “A VPN also hides your outgoing traffic from your ISP and the local network owner (like a coffee shop or hotel)… A VPN would potentially protect this metadata from someone listening in on a local network, but the VPN provider itself would see it all” (EFF). A VPN doesn’t erase visibility, it moves it: the Wi-Fi owner loses the ability to see your domains, and the VPN company gains it. EFF is direct that a VPN “is not a tool for anonymity,” and that on a corporate VPN, “whoever runs the corporate network will see your traffic.”
A VPN helps against a nosy router owner or café network, but does nothing against an employer that manages the device itself, or against stalkerware, which runs on the phone and can see the screen regardless of encryption. Remember the note above: installing one is itself an action that can be visible to whoever administers the network.
What actually helps in a shared home
If you need to look something up without it appearing in a domain log, mobile data instead of the Wi-Fi is the most reliable option, since your carrier’s connection doesn’t route through that router and doesn’t depend on trusting a VPN provider. Don’t rely on private or incognito windows for this — they only affect what’s stored on the device, changing nothing about what the router or ISP sees; What private browsing actually hides covers this in more detail.
Whatever you choose, revisit the note above: changes in network behavior can be noticed by whoever runs it.