Partly. The network owner can usually see which websites you visit and when, but not the specific pages, searches or what you type on HTTPS sites. It also can't read your browser's saved history on your device; it only sees traffic while you're connected.
Here's the split for an HTTPS site, which is almost every site now:
| Visible to the Wi-Fi operator | Hidden from the Wi-Fi operator |
|---|---|
| Domain names (e.g. reddit.com) | Full URLs and individual pages |
| Time and duration of connections | Search terms |
| Amount of data transferred | Passwords, messages, form entries |
| Your device's network address | Content of what you read or watch |
The EFF confirms that anyone along the path can generally see domain names and timing but not page content, login names or messages. Domains leak mainly through DNS lookups, which travel unencrypted by default on many devices. If a site still uses plain HTTP, everything on it is visible.
Ways to shrink what the operator sees:
- Encrypted DNS. Android's Private DNS setting and Firefox's DNS over HTTPS keep lookups away from the network. Domains can still leak through other parts of the connection, so this isn't complete.
- iCloud Private Relay. For Safari users with iCloud+, Apple says Private Relay uses encrypted DNS to hide the sites you visit from the network provider, though it isn't offered in every country.
- A VPN. With a VPN such as NordVPN, the hotspot sees only a connection to the VPN server. The VPN provider then takes over that visibility, so pick one with an audited no-logs policy.
Incognito mode doesn't help here. It only stops your own device from saving history.