This question attracts extremes: some believe encryption hides everything, others that the provider reads their messages. Neither is right, and the distinction between “what” and “where” is the key to it.
What encryption hides, and what it does not
| What | Visible to the provider |
|---|---|
| Message text, passwords, page contents | No — that is exactly what encryption does |
| Which specific pages you opened | No — the path after the domain is encrypted |
| The name of the site you connected to | Yes — via the DNS lookup and the connection address |
| When you were there and for how long | Yes |
| How much data was transferred | Yes — and volume sometimes hints at the nature |
| What you watched on a video service | Not directly, but volume and duration say a lot |
A work network is a separate case
Here everything is different, and not because of technology but because of permissions. A work device may carry a corporate certificate, and with it the employer can see the contents of connections — lawfully and with the consent you gave when you were hired.
- A work laptop. Assume everything is visible: addresses, contents and what you typed.
- Work Wi-Fi, personal device. Addresses and volumes are visible; contents are not, unless you installed their certificate.
- Personal internet on a work laptop. Changing networks changes nothing: the observation happens on the device itself.
The practical conclusion is simple and dull: personal matters on a personal device. Not out of paranoia, but because separation saves both sides trouble.
What this changes in practice
- Private browsing — hides history on the device, nothing more
- Changing DNS without encrypting it
- “Privacy” extensions with broad permissions
- Turning off location while signed in to an account
- An HTTPS connection — today the default almost everywhere
- Encrypted DNS in the browser settings
- Personal matters on a personal device
- Understanding that contents are hidden, the fact is not
One thing is worth keeping in mind: for an ordinary person, the provider and the employer are not the main threat. Money and accounts are lost for the reasons set out in how passwords are cracked, where password reuse comes first by a wide margin.