What the Wi-Fi owner can see, with and without a VPN

Without a VPN, whoever runs the Wi-Fi can see the name of every site you visit, the address of every server you talk to, and the contents of anything not encrypted, because all of it passes through their router. With a VPN connected they see one encrypted stream from your device to one address. They can still see that your device is on the network, its name, how much data it moves, and that it is using a VPN.

"The owner" here means anyone with access to the router or the network behind it: a hotel's IT contractor, a café owner, a landlord, a campus network team, or the housemate who set up the home router.

What a router records by default

Most consumer routers keep a device list and little else, but "little else" still includes a lot, and a network with any management behind it usually logs more. Here is what is visible at the router without any special effort:

• Your device's presence. When it joined, when it left, its hardware address and the hostname it announced. Android has randomised the hardware address per network since Android 10, but the hostname is often the phone's model name or one you chose.
• DNS lookups. Unless you have changed it, your phone asks the network's own resolver for the address of every site, in plain text. That is a running list of site names with timestamps.
• The site name in each HTTPS connection. The TLS handshake carries the server's name unencrypted, so even fully encrypted sites reveal their name to the network.
• Every server address and port. The IP address of each service you use, which identifies most of them on its own.
• Volume and timing. How much you sent and received, and when.
• Plain HTTP contents. Uncommon now, but any page or app still using unencrypted HTTP is fully readable.

None of this requires the owner to be hostile. Logging is a default on managed networks, and the person reading the log may be a support technician rather than anyone who knows you. The public Wi-Fi risks post covers who else on the same network can see the same things.

What changes with a VPN

A VPN takes every packet your phone would have sent, DNS included, and wraps it inside an encrypted connection to the VPN server. The router carries that one connection and can read nothing inside it.

The pattern is the same as for your ISP, and the ISP post explains the mechanics of DNS and the handshake in more depth. The difference on Wi-Fi is that the owner is close by, the network is small enough to read by hand, and the router's device list has your phone's name in it.

What a VPN does not hide from the Wi-Fi owner

Being on the network at all. You joined it, your phone announced itself, and the router logged the time. If the network requires a login, a room number or an email at a captive portal, that identity is attached to your device for the session. A VPN cannot come up until the portal is accepted, which is why it seems to fail on hotel Wi-Fi for the first minute; the captive portal post explains the sequence.

How much you use. A network that limits or throttles heavy users does it on volume, and the tunnel does not change the volume.

That it is a VPN. One long, steady, encrypted connection to a single address is a recognisable shape. Some restrictive networks filter the ports VPN protocols use or block the protocols outright; a well-built app tries several connection methods and keeps the one that works.

Before the VPN connects

There is a short window between joining a Wi-Fi network and the tunnel coming up, and in that window your phone behaves as if there were no VPN: apps refresh, DNS lookups go out, and the router sees them. Android's Always-on VPN with "Block connections without VPN" closes this window by refusing to send anything until the tunnel is established. It is the setting to turn on if the point of the VPN is that the network never sees your traffic, and the Always-on VPN post shows where it is.

Where the view moves to

A VPN does not remove the party that can see your traffic; it moves that role from the Wi-Fi owner to the VPN provider, whose server sees exactly what the router used to. The right question about any VPN is therefore what it records. Culvert VPN does not log the websites you visit, your DNS queries or the contents of your traffic; its servers see only an opaque connection id, and it keeps your client IP address for up to 30 days for abuse handling, as described in its privacy policy.

If you want the network you are on to see one encrypted stream and nothing else, Culvert VPN connects with one tap to free servers in the Netherlands, France and Germany, and is on Google Play.