Can my VPN provider see my browsing history? What it sees

Short answer: your VPN provider can see which websites you connect to, when, and how much data moves, plus your real IP address. It cannot see your search terms, the pages you read or what you type on HTTPS sites, unless the site uses plain HTTP, you installed its certificate, or it is a browser extension that reads pages.

So the VPN takes over the view your internet provider used to have. Whether it records that view is a policy decision, which is why two VPNs built on the same technology can be very different things to trust.

What can a VPN provider see, item by item?

What you do	Can the VPN provider see it on an HTTPS site?	On a plain HTTP site?
The words you type into Google or any search box	No	Yes
The full page address (for example /search?q=...)	No	Yes
What you type into forms, passwords, messages	No	Yes
The site's name (google.com, reddit.com)	Usually yes	Yes
The IP address of the server you reach	Yes	Yes
When you connect, for how long, how much data	Yes	Yes
Your real IP address, and so roughly where you are	Yes	Yes
Your account email and how you paid	Yes, if you gave them	Yes

The top three rows are what people usually mean by "search history," and HTTPS covers them. Nearly every major site, every search engine included, uses HTTPS.

Can my VPN provider see what I search?

No, not the words. When you search on Google, your browser and Google's server set up an encrypted connection before the query is sent. The VPN carries that encrypted connection without the key to open it. What it can tell is that you connected to Google, and how big the exchange was.

The same goes for searching inside Reddit, Amazon, YouTube or any app. If the app talks to its server over HTTPS, the VPN sees the server, not the query.

How does a VPN see the sites you visit?

Three ways, and they stack.

The destination IP address. Every packet you send through the tunnel comes out at the VPN server and has to be addressed to the real site. The VPN routes it, so it knows where it went. Many big sites share IP addresses through cloud providers, so the IP alone does not always name the site.

DNS lookups. Before your device can connect to a site, it asks a DNS server for the site's address. With most VPN apps, those lookups go to a DNS server the VPN runs. Each lookup names the site.

The site name in the TLS handshake. At the start of an HTTPS connection your browser usually sends the site's name in plain text, in a field called Server Name Indication, so the server knows which certificate to answer with. Anyone carrying the traffic can read it, including the VPN.

The fix for that last one is Encrypted Client Hello, now an IETF standard (RFC 9849), which encrypts the site name inside the handshake. It works when both your browser and the site support it. When it does, and your DNS is encrypted, the VPN is left with the IP address and the timing.

You can check whether your browser does its part. Open tls-ech.dev, a test page that tells you whether your browser used ECH to reach it. If it did, sites that also support ECH keep their names out of the handshake, and the VPN in the middle sees one fewer thing. Cloudflare documents how it turns ECH on for sites on its network (Cloudflare).

When can a VPN see more than site names?

This is the part most guides skip. There are three situations where a VPN can see your actual pages and searches.

1. The site uses plain HTTP

Without HTTPS, nothing is encrypted between you and the site except the VPN tunnel itself, and the VPN server is the end of that tunnel. The page, the address and anything you type are readable there. Chrome marks such pages "Not secure" in the address bar (Chrome Help). Treat that label as a warning about the VPN as well as the Wi-Fi.

2. You were asked to trust a root certificate

HTTPS works because your device trusts a set of certificate authorities. If a VPN app gets you to install its own root certificate and trust it, it can open your HTTPS connections, read them, and pass them on. Some filtering, ad-blocking and "security" apps do this on purpose. A normal consumer VPN has no reason to.

Check your phone:

iPhone or iPad. Apple notes that a manually installed certificate is not trusted for SSL until you turn trust on, and that the switch lives under Settings > General > About > Certificate Trust Settings. If "Enable full trust for root certificates" does not appear there, you have not installed any additional certificates (Apple Support).
Android. Open Settings > Security & privacy > More security settings > Encryption & credentials and tap User credentials to see certificates you installed (Android Help). Menu names vary by phone maker.

If you find a certificate from a VPN or an app you do not recognize, remove it, and consider removing the app.

3. The "VPN" is a browser extension

Many VPN-branded browser extensions are really proxies that run inside the browser. To work on every site, an extension needs host permissions, and Chrome shows the warning "Read and change all your data on all websites" for that kind of access. An extension with the history permission gets the warning "Read and change your browsing history on all signed-in devices" (Chrome for Developers). That is a much bigger view than a VPN app has, because the extension sits inside the page, after decryption.

Open your browser's extensions page and look at what each VPN or proxy extension is allowed to do. If you want a VPN, an app that runs at the system level is the safer shape.

What does the VPN app itself have access to on my phone?

On Android, a VPN app is built on the system's VpnService. Google's own reference is blunt about it: each read from the VPN interface "retrieves an outgoing packet," and "Letting applications intercept packets raises huge security concerns." That is why Android asks for your approval the first time an app creates a VPN, allows one VPN at a time, and shows a system notification while it is connected (Android Developers).

So the VPN app sees every packet your phone sends, encrypted or not. It still cannot read HTTPS contents without a certificate you trusted. The question is what it does with the rest, which brings us back to logging.

Does my VPN keep a record of what it sees?

Being able to see something and keeping it are separate. A VPN must handle the site names and IP addresses to route your traffic. It does not have to write them down. Read the provider's privacy policy for four specific answers:

Does it record the sites, IP addresses or DNS queries you reach?
What does it record about each session (start time, server, your IP address), and when is that deleted?
Who runs the DNS servers your lookups go to?
What does it collect inside the app itself, such as analytics or crash reports?

"No logs" with no detail does not answer those questions. A policy that names what is recorded and what is not gives you something to hold the company to. Free VPN apps deserve extra suspicion here, since the business model has to come from somewhere; we went through a study of hundreds of them in are free VPNs safe.

Who else can still see my browsing with a VPN on?

The VPN changes who sees the site names on the network. It does not change what the sites see. If you are signed in to Google, Google still has your searches. The websites still see your visit, from the VPN's IP address instead of yours, and their trackers still work through cookies. For the full map of who sees what once the tunnel is up, see what a VPN hides, and from whom.

How Secria VPN handles this

Secria VPN keeps no activity logs: we do not record browsing, DNS queries or traffic contents. It runs on RAM-only servers, is post-quantum on every connection, on by default, works on 5 devices at once, and costs $7.99 a month or comes included with Pro.

FAQ

Can my VPN provider see my passwords? Not on HTTPS sites, which covers almost every login page. A password typed into a plain HTTP page, or into any site while a VPN certificate you trusted is installed, is a different story.

Can my VPN see my incognito history? Incognito mode only stops your browser from saving history on the device. The VPN sees the same site names whether the window is private or not.

Can my VPN provider see my history on mobile apps too? Yes, at the same level. Apps connect to servers, and the VPN sees which servers, when and how much data, but not the contents of their HTTPS traffic.

Can my VPN see what I download? It sees the server you download from and roughly how big the file is. On HTTPS it does not see the file name or contents.

Is my VPN provider safer than my internet provider? It depends on the company and what it records. You are moving the same view from one company to another, so the policy of the one you choose is the whole question.

A VPN is a decision about who carries your traffic. Pick the one whose answers about what it records you have actually read.