What can the Wi-Fi owner see? At home, at work and in a hotel, with and without a VPN

"Can the person who runs this Wi-Fi see what I'm doing?" It's one of the most common privacy questions, and the honest answer is: more than most people think, less than some fear. Below is exactly what they see, how, and what actually changes it.

What they see, and what they don't

The table covers the usual case: a phone on someone else's Wi-Fi, opening ordinary sites and apps. Almost every site now uses HTTPS, which encrypts the page itself but not where you're going.

Incognito mode doesn't change a single row. A private window only decides what your own browser keeps once you close it. The traffic leaves your phone exactly as it would from a normal tab. We compare the two in incognito mode vs. a VPN.

To see these rows filled in with your own visit, try our free Wi-Fi privacy test. It runs in your browser and sends nothing anywhere.

Who the "owner" is: home, work, hotel, campus

The same technology gives different people the same view, so it helps to know who is on the other end:

• At home, it's whoever manages the router: you, a parent, a flatmate or a landlord. Most routers list connected devices, and some offer "parental controls" that keep a history of the sites each device visits.
• At work, it's the IT department. Company networks often filter and log traffic for security, and on a phone the company manages, they can see far more from the device itself.
• In a hotel, café or airport, it's the business or the company it pays to run the hotspot. The login page may ask for an email, a room number or a social media account, which links your visit to a name.
• At a university, it's the campus IT service, bound by its own acceptable use policy.

How they see it

No one needs special skills for this. The information comes from four places:

1. The router's device list. It shows each connected device and often its name, such as "Ana's Galaxy". Android uses a random hardware (MAC) address for each network by default, so your phone isn't recognizable from one network to the next by that address, but the name you gave it may still show.
2. DNS lookups. Before your phone opens a site, it asks for the site's address. Unless those lookups are encrypted (with DNS over TLS or HTTPS, which is what Android's Private DNS setting uses), the network's DNS server sees every name, with the time.
3. The site name in secure connections. When an HTTPS connection starts, your phone usually sends the site's name in plain text so the server knows which certificate to present. A newer standard, Encrypted Client Hello, hides it, but only when both the browser and the site support it, and that isn't the norm yet.
4. Addresses and volume. Many services can be recognized from the addresses your phone connects to, and the size and timing of traffic tell a video call from a download.

What they don't get, on HTTPS sites, is the content: the article you read, the product you look at, the password you type.

What a VPN changes

With a VPN on, your phone builds an encrypted tunnel to the VPN server before anything else goes out, and every app's traffic travels inside it, lookups included. The Wi-Fi owner now sees one encrypted connection to a server: when it's active and how much data passes. The sites, the names and the lookups disappear from their view.

In PryVPN, the lookups are answered by our own resolver inside the tunnel, which keeps no query logs. You can confirm it with the leak test in the app. And if you turn on auto-connect for untrusted Wi-Fi, the tunnel is up the moment you join a network you haven't marked as yours, so there's nothing to remember.

One thing moves rather than disappears: the VPN provider is now in the position the network was in. That's why it matters what a VPN keeps, which we explain in what "no logs" really means.

What a VPN doesn't hide

A VPN protects the path between your phone and the internet. It doesn't make you invisible:

• Sites and apps you sign in to know it's you, VPN or not.
• Your device is still on the network. The owner can see it's connected and how much it sends, just not what.
• A managed phone is a different story. If your employer or school manages the device, or you use a work profile, the organization can see a lot from the device itself, and it may not let you use your own VPN at all. See another VPN or a work profile.
• The network can still block you. Some hotels and offices block VPNs. We cover why, and what gets through, in hotel Wi-Fi blocking your VPN.

Work and university networks: an honest note

If the network or the phone belongs to your employer or your university, their rules apply to it. A VPN is for keeping your browsing private on networks you don't control, not for getting around rules you agreed to. On a device an organization manages, assume it can see what the device does, and keep personal things on your own phone.

Quick answers

Can the Wi-Fi owner see my history if I use incognito mode? Yes. They see the same list of sites as with a normal tab. Incognito only stops your browser from saving the history on your phone.

Can they read my WhatsApp or Signal messages? No. Those apps encrypt messages end to end. The network can see that you use the app and roughly how much, not what you write.

Can they see what I search for on Google? Not the words, because the search is encrypted with HTTPS. Without a VPN, they can see that you used Google.

Does a VPN hide my browsing from my mobile carrier too? Yes. On mobile data your carrier is in the same position as the Wi-Fi owner, and with a VPN it sees one encrypted connection. For home internet, see what your internet provider can see.

Spotted a mistake? Write to support@pryvpn.com and we'll fix it and update the date.