What Can Your ISP See?
Free privacy test of your own connection: site name (ECH), TLS, HTTP version, post-quantum encryption and WARP
What your ISP can always see: your IP address, the IP address you connect to, when, and how much data. It cannot see pages, searches or anything inside HTTPS.
The DNS catch: ECH hides the site name in the connection, but if your DNS lookups are unencrypted your ISP can still read the site name there. Check your DNS.
What a VPN changes: your ISP then sees only an encrypted connection to the VPN server, not the site or its IP. The VPN provider can see them instead.
Scope: this tests your connection to hackmyip.com only. ECH hides the site name only when both your browser and the website support it, so other sites can differ.
Frequently Asked Questions
Can my ISP see what websites I visit?
Usually, yes. Even on HTTPS, most connections send the website name (the SNI) unencrypted at the start of the connection, and unencrypted DNS lookups reveal it too. Your ISP cannot see the pages, searches or content inside HTTPS. Encrypted Client Hello (ECH) hides the site name, but only when both your browser and the website support it, and it works best with encrypted DNS.
What can my ISP always see?
Your own IP address, the IP address you connect to, when you connect, and roughly how much data you send and receive. For a site behind a shared network such as Cloudflare, the destination IP is shared by many sites, so it does not pin down the exact site on its own.
What is Encrypted Client Hello (ECH)?
ECH is a TLS 1.3 extension that encrypts the part of the connection setup that names the website. On Cloudflare, an observer sees the shared name cloudflare-ech.com instead of the real site. The website has to publish ECH keys in DNS, and your browser has to support and use them.
Does ECH hide sites if my DNS is not encrypted?
Not fully. If your browser looks up the site with ordinary unencrypted DNS, your ISP can read the site name in that DNS query, even when the connection itself uses ECH. Mozilla recommends using DNS over HTTPS alongside ECH for this reason. Check yours with the DNS leak test.
What does post-quantum (quantum-safe) mean here?
It means the key exchange used a hybrid post-quantum algorithm such as X25519MLKEM768. It protects against "harvest now, decrypt later": someone recording your encrypted traffic today and decrypting it with a future quantum computer. Chrome and Edge 131+, Firefox 132+ on desktop and Safari 26+ support it by default.
Does a VPN hide websites from my ISP?
A VPN hides both the site name and the destination IP from your ISP, which then sees only an encrypted connection to the VPN server. The VPN provider can see that information instead, so it only moves the trust to a company you choose.
What is TLS?
TLS (Transport Layer Security) encrypts communication between your browser and websites. It is the successor to SSL. TLS 1.3 is the latest version, with faster handshakes and stronger security than older versions.
Why does TLS version matter?
Older TLS versions (1.0 and 1.1) have known weaknesses and are deprecated by major browsers. TLS 1.2 is considered secure, and TLS 1.3 offers the best security and performance. ECH also requires TLS 1.3.
What is HTTP/2 vs HTTP/3?
HTTP/2 adds multiplexing and header compression over HTTP/1.1. HTTP/3 runs over QUIC (UDP) for faster, more reliable connections on unreliable networks. Both are used over encrypted connections in browsers.