We capture traffic on a mirrored switch port as part of our leak testing, which means we can answer this question with observation rather than theory. Here is what is visible from the network side.

Without a VPN

  • Every domain you connect to, from DNS lookups and the TLS handshake. Not page content, but the full list of sites.
  • Timing and volume of every connection — when you were active, for how long, and how much you transferred.
  • The fact that you are using a particular protocol, including BitTorrent, which is trivially identifiable.
  • Anything sent over plain HTTP, in full. Rare now, but not gone.

What is not visible on an HTTPS connection is the content: the pages, the messages, the form data. That has been true for years and it is why "your ISP can read your emails" is outdated.

With a VPN

Your ISP sees a single encrypted connection to one IP address, sustained for as long as you are connected. Volume and timing remain visible — they can see you transferred 40 GB this evening — but not to where, or of what.

Networking hardware in a data centre rack
The domain list is the part people underestimate. It is highly identifying on its own.

What you are actually doing is moving trust

This is the honest framing. A VPN does not make your traffic unobservable; it moves who can observe it from your ISP to your VPN provider. That is an improvement only if the provider is more trustworthy than the ISP, which is exactly why audits, jurisdiction and logging policy matter so much.

A VPN does not delete the observer. It replaces your ISP with a company you chose — so choose one that has invited people to check.

How to judge whether the swap is worth it

  • Has the provider published a full independent audit, not a summary page?
  • Are the clients open source, so behaviour can be checked against the code?
  • What jurisdiction are they in, and does it compel data retention?
  • Who ultimately owns the company?

On those four questions Mullvad answers best of anything we test: repeated audits, open source with reproducible builds, Swedish jurisdiction, and an account system that never learns who you are in the first place. It fails every streaming test, deliberately, so it is a specialist tool — but if this article is your reason for wanting a VPN, it is the right one.

If you want most of that with a product that also works for everyday use, Proton VPN is the more practical answer and finished first overall in our cycle.