Yes, your internet provider can see that you’re using a VPN. It sees the VPN server’s IP address, when you connect and for how long, and how much data moves back and forth. It can’t see which websites you visit, what you search for, or the content of anything you send or download, provided your DNS lookups also go through the VPN. If you don’t want your provider to know you use a VPN at all, that takes obfuscation, which is a separate feature.
Last updated 31 October 2026.
What your ISP still sees with a VPN on
NordVPN answers this question directly on its own blog. Its article Can your ISP see your VPN? (dated 4 February 2026) opens with: “Yes, your ISP can tell when you’re using a VPN.” It then lists what stays visible, and adds a line worth remembering: “When you turn on a VPN, your ISP doesn’t suddenly go blind.”
| Your ISP can see | Your ISP can’t see |
|---|---|
| That you’re connected to a VPN server | The websites you visit |
| The VPN server’s IP address | Your browsing activity across a session |
| When the connection starts, stops and how long it lasts | The specific pages you open |
| How much data travels in each direction | The contents of uploads and downloads |
Each item on the left is metadata, not content. Your provider has to route your traffic, so it always knows where the packets go. With a VPN, every packet goes to one place: the VPN server. That address replaces the hundreds of sites you’d otherwise be seen reaching.
There’s one more thing on the left side that most people miss. NordVPN’s article says that in many cases “the ISP can identify the VPN protocol based on traffic patterns and connection characteristics.” So your provider may know not only that you use a VPN, but roughly which kind. It also says that even with deep packet inspection, “this visibility does not extend to reading the data itself.”
What changes compared with no VPN
Without a VPN, your provider’s view is much wider. The same NordVPN article says your ISP can then see the domains you connect to, read DNS requests “unless you’re using encrypted DNS,” and view the full contents of any page loaded over plain HTTP. It adds that providers may keep that record “for months or even years.”
HTTPS helps, but less than people think. The EFF’s Surveillance Self-Defense guide, Choosing the VPN That’s Right for You (last reviewed 28 July 2026), says HTTPS “only protects the content of your communications, not the metadata.” Anyone along the path, starting with your provider, “can usually see their domain names (e.g. wikipedia.org) and when you visit them,” plus the sizes of pages and files.
Why should you care? In practice, a list of domains with timestamps says a lot. A visit to a clinic’s site at 2am, a job board during work hours, a benefits portal every Monday. The US Federal Trade Commission’s October 2021 staff report found that many providers “collect and share far more data about their customers than many consumers may expect.” A VPN is the simplest way to take your browsing out of that record.
A worked example: one evening on home broadband
Say you’re working from home. Between 7:00pm and 8:30pm you check your bank, read three news sites, download a 2 GB project file from a client’s file-sharing site, and join a 40-minute video call.
Without a VPN, your provider’s log could read something like: your bank’s domain at 7:02, three news domains between 7:10 and 7:35, the file-sharing domain at 7:40 with roughly 2 GB coming in, a video-call service from 7:50 to 8:30. HTTPS hides what you read on each site. It doesn’t hide the list.
With a VPN on, the same evening reads: one encrypted connection to a single VPN server address, from 7:00 to 8:30, with a bit over 2 GB received. That’s all. The provider can guess you did something data-heavy around 7:40. It can’t tell whether that was a work file, a software update or a backup.
That’s the honest picture. Not invisibility. A long, readable diary reduced to one line. Honestly, for most households that’s the whole point.
DNS leaks: the gap that undoes the VPN
DNS is the internet’s phone book: your device asks a DNS server for a site’s address before it connects. If those lookups bypass the VPN, your provider sees every domain you look up, even though the traffic itself is encrypted. That’s a DNS leak.
Proton VPN’s support article on DNS leaks explains the risk plainly: DNS lookups are handled by servers “which by default are operated by your internet service provider (ISP),” and “almost all ISPs in the world keep logs of DNS queries made by their customers.” Its fix is to run its own DNS servers, so lookups travel “through the VPN tunnel to be resolved on our servers.” NordVPN’s article on being tracked with a VPN says the same of its own service, routing “DNS requests through its own DNS servers by default.”
Turns out the most common cause of a leak is something you set up yourself. Proton says manually configuring a third-party DNS service, such as Google Public DNS or Cloudflare, “increases the chance of something going wrong,” because custom settings can override its leak protection. The same goes for DNS over HTTPS switched on inside your browser.
How to check for a DNS leak, step by step
Proton’s support page gives a simple test. These are its steps and menu names.
- Connect to a VPN server in another country. A distant server makes a leak easier to spot.
- Open DNSleaktest.com and run the Extended test.
- Read the results. If any server listed belongs to your real internet provider, you have a leak. A data-centre company you don’t recognise is normal.
- Remove custom DNS if you find one. On macOS, Proton’s path is Settings → Network → your network → Details… → DNS tab, then remove any third-party entries. On Windows 10, it’s the adapter’s Internet Protocol Version 4 (TCP/IPv4) properties, with “Obtain DNS server addresses automatically” selected.
- Check your browser’s secure DNS. In Firefox, Proton points to Settings → Privacy & Security → DNS over HTTPS. In Chrome, Settings → Privacy and security → Security → Advanced, with the DNS provider set to OS default.
- Turn on the kill switch. Proton notes that if the VPN connection drops, DNS queries “might be sent to your system’s default DNS server (which is probably run by your ISP).” A kill switch blocks that. Our guide on what a VPN kill switch is covers the settings.
Don’t forget to repeat the test after big changes: a new router, a new phone, or a browser update that resets privacy settings.
When you don’t want your ISP to know you use a VPN
For most people at home, the provider knowing you use a VPN is harmless. It just sees a busy, encrypted connection. There are cases where it matters: a hotel or office network that blocks VPN traffic, or a country where VPN use draws attention.
NordVPN’s article says a provider can “block specific VPN servers, refuse certain VPN protocols, or slow down traffic patterns that resemble VPN use,” all from metadata, without reading anything. Its suggested fixes are switching servers, switching protocols, or using obfuscated servers, which “make VPN tunnels resemble regular HTTPS browsing.” NordVPN’s tracking article adds a caution that runs the other way: some restrictive networks use deep packet inspection to recognise or block VPN connections, so if you’re travelling somewhere VPN use may be restricted, “check the local rules before connecting.” A journalist or a traveller crossing borders should do that before packing, not at the hotel.
We explain how disguised connections work, and which providers offer them, in our guide to what obfuscated servers are.
Common mistakes
Assuming “encrypted” means “invisible.” Your provider still sees the connection, the server and the volume. Skip the idea that a VPN erases you from your provider’s records; it shrinks what’s in them.
Adding a “faster” DNS on top of the VPN. This is the classic self-made leak. If you’ve changed DNS settings in the past for speed, check them before you rely on the VPN.
Forgetting the phone. A phone that drops from Wi-Fi to mobile data can reconnect outside the tunnel for a moment. Set the app to connect automatically, with the kill switch on.
Trusting a VPN nobody has checked. When you use a VPN, the provider takes over your ISP’s view. Choose one with independent no-logs audits; our Proton VPN review explains its five annual audits, and what a VPN can and can’t hide walks through every other party in the chain.
FAQ: can my ISP see my VPN questions
Can my ISP see my browsing history if I use a VPN?
No, not the sites you visit, as long as DNS also goes through the VPN. It sees one encrypted connection to a VPN server, when it starts and stops, and how much data moves. Run a DNS leak test once to make sure.
Does my ISP know I’m using a VPN?
Usually, yes. It can see the VPN server’s address and, in many cases, recognise the protocol from traffic patterns. Obfuscated or “stealth” connections exist to make VPN traffic look like ordinary HTTPS.
Can my ISP see what I download with a VPN?
It sees the amount of data, not the content or the file names. A 2 GB download shows up as 2 GB of encrypted traffic to the VPN server, with no clue what it was.
Can my ISP slow down my VPN?
It can. NordVPN’s article says providers can throttle traffic patterns that resemble VPN use or block specific servers and protocols. Switching server or protocol often helps, and obfuscation helps on networks that filter VPNs.
The short version
- Your ISP can see that you use a VPN, the server’s IP, when you connect and how much data moves.
- It can’t see the sites you visit, your searches or the content you send and receive.
- DNS leaks undo the benefit; test once at DNSleaktest.com and remove custom DNS settings.
- Turn on the kill switch so a dropped connection doesn’t fall back to your ISP.
- To hide that you use a VPN at all, you need obfuscation, not just encryption.