It sounds like this“With HTTPS, nobody on the way, my internet provider or the Wi-Fi owner included, can see anything about where I go.”
Thinking HTTPS hides everything you do
Why it feels right
A padlock and the word 'secure' make it sound as if the whole visit is invisible. If nobody can read the page, it seems nobody can know you went there at all, so a private connection feels like a private browsing history.
Why it’s wrong
HTTPS hides what you send and receive: the pages, the forms, the cookies. It doesn't hide who you connect to. The network can still see the site's address, usually its name, roughly when you connected and how much you transferred.
A worked example
HTTPS wraps the contents of the conversation, and the contents are what it hides: the page you asked for, the form you filled in, the cookies, the words on screen. Someone watching the line sees only scrambled data.
But the machines carrying your data still need to know where to send it, so they see the destination. Your provider sees the address of the server you are connecting to. The name of the site is usually visible too, because it is sent in the clear at the start of the connection, though newer standards are starting to hide it. They can also see when you connected and roughly how much data moved.
So the person running the cafe Wi-Fi can't read your emails, but can tell you visited a particular news site at 3pm and downloaded a lot. For hiding the destination too, you need extra tools such as a VPN, which only moves the visibility to the VPN company. HTTPS is about the content, not about who you talk to.
How to catch yourself
- You think a provider or an employer can't tell which sites you visit on HTTPS.
- You call HTTPS 'anonymous'.
- You don't know why a VPN is a different thing.
What to hold instead
HTTPS hides what you send but not who you talk to. The pages and forms are scrambled, while the destination, the timing and the amount of data are still visible to the networks in between.
Where you’ll meet it
- Using a work or school network.
- Deciding whether you need a VPN.
- Reading what your provider can learn about your browsing.
Questions people ask
- Can my internet provider see what sites I visit on HTTPS?
- It can see which servers you connect to, and usually the site's name, but not the pages you read or what you type. A VPN changes who can see the destination, not whether someone can.
- Does HTTPS make me anonymous?
- No. It keeps the content private between you and the site. The site still knows who you are if you log in or are identified by cookies, and the networks on the way can see where you connected.