🛡️ GANVAS VPN
RU Download
← All articles

How to actually encrypt your traffic: HTTPS, DNS, VPN and who sees what

“Encrypt your traffic” sounds like one button, but in practice it’s several distinct layers, each closing a different part of the picture. You can turn on HTTPS and feel safe — yet your provider still sees the list of sites you visit. You can turn on a VPN — and still leak your real IP through the browser. In this article we’ll go layer by layer through who sees what, and how to build your defenses so no holes are left.

The core idea is simple: privacy isn’t one tool, it’s several layers that complement each other. Let’s walk through them from the bottom up and assemble them at the end.

Who actually “sees” your traffic

Before encrypting anything, it helps to know whose hands your data passes through on the way from your device to a website:

  • Your ISP or the Wi-Fi owner. All your traffic physically flows through them. This is the “closest” observer, and it’s the one most methods defend against.
  • Intermediate networks. The backbone operators your data crosses to reach the server. They usually see less than your ISP, but they still see addresses.
  • The DNS server. The one you ask “what’s the IP of this domain?”. It learns every site you open — even if the traffic itself is encrypted.
  • The website itself (its server). Sees your IP, what you send, and how you behave.
  • Your VPN provider or Tor relays. If you use them, they become a new link you hand some trust to.

Now, here’s exactly what each of them sees at different levels of protection.

Layer 1. HTTP without encryption — everything is visible

The old http:// protocol (no “s”) sends data in plain text. This is the worst case:

  • Your ISP and the Wi-Fi owner see the domain, specific pages, the content — passwords, messages, forms.
  • Anyone on the same Wi-Fi can intercept the data if they want.
  • The site sees your real IP.

Most sites have moved to HTTPS today, but plain HTTP still shows up — especially on old pages and in app API calls. The rule is simple: avoid plain HTTP.

Layer 2. HTTPS/TLS — content is hidden, but not everything

https:// is HTTP inside an encrypted TLS channel. It’s a huge step forward and today’s standard. What changes:

  • The content is encrypted. Your provider no longer sees specific pages, passwords, message text or request bodies.
  • Wi-Fi interception is useless — an attacker sees only an encrypted stream.

But HTTPS doesn’t close everything. What still leaks:

  • The site’s IP address. It’s visible which server you connect to.
  • The domain name via SNI. At the start of a TLS connection the browser announces which domain it’s reaching (the SNI field — Server Name Indication), and that field has historically traveled in plain text. So your provider sees example.com, even if it can’t see what you do there.
  • Traffic volume and timing. Packet sizes and rhythm can sometimes hint at what you’re viewing.

ECH and encrypting SNI

To close HTTPS’s last big hole — the plaintext SNI — there’s ECH (Encrypted Client Hello). It’s a TLS extension that hides the domain name inside the encryption, so your provider only sees that you connected to some server (often a CDN), not which domain. ECH is gradually rolling out in browsers and at major CDNs, but it doesn’t work everywhere or for every site. So it’s too early to rely on it alone — a nice bonus, not full protection.

HTTPS bottom line: content is safe, but the list of domains you visit is still visible through SNI and DNS. That’s exactly the gap encrypted DNS and a VPN close.

Layer 3. DNS — the quiet leak of your site list

Before connecting to a site, your device asks a DNS server: “what’s the IP of this domain?”. Classic DNS works in plain text and by default goes to your provider’s server. The result:

  • Your ISP sees every domain you open — even if all the rest of your traffic is under HTTPS.
  • DNS makes it easy to build a profile of your interests and sell it to advertisers or pass it to anyone.
  • Your provider can tamper with the answer and keep you off a site — that’s how some blocking works.

So even perfect HTTPS doesn’t save you: without encrypted DNS, the list of your sites leaks in the open.

DoH and DoT — encrypted DNS

Two protocols were created to close this:

  • DNS-over-HTTPS (DoH) — DNS requests travel inside ordinary HTTPS, indistinguishable from web traffic. Your provider can’t see the request or easily single it out.
  • DNS-over-TLS (DoT) — DNS inside a separate TLS channel on a dedicated port. The same encryption, but the traffic is recognizable as DNS.

Both hide your DNS requests from your provider and make answer-tampering harder. Many browsers and OSes already support DoH out of the box — worth enabling.

DNS leaks even with a VPN

The trickiest part: DNS can leak even with a VPN on. The OS sometimes sends the request by a “fast path” around the tunnel, on Windows requests go out across several adapters at once (multi-homed), and a broken custom config may not set its own DNS server at all. The result: your traffic goes through the VPN, but the list of sites still slips to your provider.

We covered this in detail in what a DNS leak is. You can test yourself in a minute with our VPN check, and while you’re at it, look at the WebRTC leak test — the browser can reveal your real IP too.

Layer 4. VPN — everything in one encrypted tunnel

A VPN wraps all of your device’s traffic into a single encrypted tunnel to a server you pick. This changes the picture radically:

  • Your ISP only sees the fact that you connected to a VPN server: one IP, one encrypted stream. No domains, no SNI, no DNS requests — if everything is set up right.
  • Websites see the VPN server’s IP, not your real one.
  • Public Wi-Fi interception becomes pointless — everything is encrypted.

In effect a VPN closes at once what HTTPS and encrypted DNS close piece by piece: the list of domains (SNI is no longer visible to your provider), DNS (when it goes inside the tunnel), and your IP.

Kill switch and leak protection

A tunnel is only as useful as it is airtight. Two mechanisms make it that way:

  • Kill switch. If the VPN drops, the kill switch instantly blocks all traffic so it doesn’t go directly around the tunnel. Without it, a one-second outage exposes your real IP.
  • DNS and IP leak protection. A good client routes DNS inside the tunnel and closes multi-homed resolving on Windows on the app side.

You can confirm a VPN actually hides you with the VPN check and the My IP tool — see whether it’s your address or the VPN server’s. For why you need a VPN at all, there’s a separate article.

Layer 5. WebRTC and IPv6 — holes around the tunnel

Even with a VPN on, two classic ways to leak remain:

  • WebRTC leak. The technology behind in-browser video and voice calls can learn your local and public IP directly — around the VPN. A site can quietly request those addresses via JavaScript.
  • IPv6 leak. If the VPN only wraps IPv4 while your provider hands out IPv6, part of your traffic goes out in the open over IPv6 with your real address.

Good clients block both vectors (carry IPv6 inside the tunnel and suppress the WebRTC leak), but it’s worth checking yourself. Do it with the WebRTC leak test: if your real IP shows up there, the tunnel is leaky.

Layer 6. Tor — maximum anonymity

If a VPN is one encrypted hop, Tor routes your traffic through a chain of three random relays run by different people. No single relay knows both who you are and where you’re going.

  • Plus: maximum anonymity. Even compromising one relay doesn’t reveal the full picture.
  • Minus: noticeably slower, many sites block exit nodes, and the fact you’re using Tor can be visible to your provider (unless you use bridges).

The best real-world setup is VPN first, then Tor: your provider can’t see you’re using Tor, and the Tor entry node can’t see your real IP. For a full comparison, see Tor vs VPN.

Layer 7. Email and messaging — end-to-end encryption

Transport encryption (HTTPS, VPN) protects data in transit, but not on the service’s servers. For messaging, something else matters — end-to-end (E2E) encryption: the message is encrypted on your device and decrypted only at the recipient’s, so even the service itself can’t read it.

  • E2E messengers (Signal and similar) — not even the operator sees your conversation.
  • Ordinary email is mostly protected by transport only: messages sit on servers in the clear. True E2E for email (PGP/S-MIME) exists but is hard to set up.
  • Metadata remains. Even with E2E, it’s visible who talks to whom and when, even if the content isn’t. Metadata is an underrated leak channel.

Takeaway: for sensitive conversations choose services with end-to-end encryption, and remember it doesn’t hide metadata.

Layer 8. Passwords — the weak link

You can encrypt every layer perfectly and still lose an account if your password is weak or leaked. Encryption protects the channel, but it won’t save you if an attacker simply knows your password.

  • Check whether your password has leaked in known breaches with the password breach check.
  • Assess the strength of what you use with the password strength check.
  • Basics: a unique password per service, a password manager, two-factor authentication everywhere you can.

A strong, unique password plus 2FA closes the most common cause of account takeover — far more common than traffic interception.

Putting it together: defense in depth

No single layer closes everything. The strength is in combining them (“defense in depth”). Here’s a working minimum:

  1. HTTPS everywhere. Don’t open sites over plain HTTP. It’s the default almost everywhere now.
  2. Encrypted DNS (DoH/DoT). Enable it in the browser or OS so your provider can’t see the list of domains.
  3. A VPN with a kill switch and leak protection. Wraps everything in a tunnel, hides SNI and DNS from your provider, and masks your real IP.
  4. Leak testing. Regularly check WebRTC, DNS and IP with the WebRTC test and the VPN check.
  5. Tor — when you need maximum anonymity and speed isn’t critical.
  6. End-to-end encryption for sensitive conversations.
  7. Strong, unique passwords + 2FA — to close the weak link.

To gauge how protected you are right now, use our privacy score — it rolls the checks into one number and points to where the hole is.

Where GANVAS fits

GANVAS VPN closes several of the layers above at once:

  • An encrypted tunnel for all traffic — your provider only sees a VPN connection.
  • DNS inside the tunnel and protection against multi-homed leaks on Windows — your site list doesn’t leak.
  • VLESS + Reality — a transport that disguises itself as ordinary HTTPS, so it works even where a regular VPN is blocked.
  • Tor mode with one toggle — all traffic through the VPN and then through the Tor network, no separate browser.
  • Kill switch and DNS/IP leak protection out of the box.

You can start for free — check out the free VPN, and if you’re on desktop there’s a dedicated VPN for Windows build. To weigh it against other options, see the comparison page.

Bottom line

“Encrypt your traffic” isn’t one button — it’s several layers: HTTPS hides the content, encrypted DNS hides the list of sites, a VPN wraps everything in a tunnel and masks your IP, leak protection closes the back doors, and Tor adds anonymity. Passwords and end-to-end encryption cover what transport can’t protect.

You don’t need to do it all at once. Turn on HTTPS and encrypted DNS, install a VPN with leak protection, test yourself for leaks, and tighten up your passwords — and you’ll be in a far more private internet than most users. Try GANVAS VPN — an encrypted tunnel, DNS inside the tunnel, a Tor mode and leak protection without holes.