Is It Safe to Save Passwords in Your Browser? (Honest Answer)
By Ken Hollow, the man who discovered his fox spirit client’s password for everything was “VelvetQueen123” — and yes, she used the same one for…
Privacy & Security
What Can Your Internet Provider Actually See?
By Ken Hollow, who once tried to explain “your ISP sees the envelope, not the letter” and was asked why the internet involves so much stationery
“Ken. Who is my internet provider?”
“The company you pay every month.”
“And they can see everything I do?”
“Not everything. But more than anyone else in the chain.”
“That is a very lawyerly answer and I dislike it.”
The Short Answer
Your internet provider carries every byte you send, which puts them in a uniquely broad position: they can see which sites and services you connect to, when, how often, and how much data moves — across every device in your home, continuously. What they cannot see is the contents, because HTTPS encrypts it. Incognito mode changes none of this. The only consumer tool that meaningfully reduces ISP visibility is a VPN, which moves that visibility to the VPN provider instead.
Why Your ISP Sees More Than Anyone Else
Every network operator sees the traffic that crosses their network. A café sees what you do at the café. Your employer sees what you do at the office. Your ISP sees all of it — home, every device, every hour, for as long as you’re a customer.
They’re also the one party you cannot route around. You can leave a café network. You can turn off office WiFi. Your ISP is the road itself.
That position is why ISP data collection is a live policy issue. A 2021 FTC staff report examining major US internet providers found that many collect substantial personal data about their subscribers while offering limited meaningful control over it.
What They Can See
Every domain you connect to. Through DNS lookups and connection metadata, your ISP can build a list of the sites and services each device in your home contacts. Not just websites — app servers too. Your phone talking to a health app’s servers is visible even though you never opened a browser.
Precise timing and patterns. When devices wake, when you stream, when you sleep. Over weeks this becomes a detailed behavioural profile without a single page of content being read.
Data volumes. How much, to where. Enough to distinguish video streaming from browsing from a large upload.
Your IP address, tied to your identity. Unlike most parties online, your ISP knows exactly who you are — name, address, payment details — and can link that to the IP address your traffic carries.
Everything on your network, not just your laptop. Phones, TVs, consoles, smart speakers, doorbells.
What They Cannot See
HTTPS — the padlock in your address bar — encrypts the contents of your traffic between your device and the destination server. Your ISP is in the middle of that path and cannot read inside it. So they cannot see:
1. The specific pages you view. That you connected to a news site, yes. Which articles, no.
2. Your search terms. Search engines use HTTPS, so queries are inside the encrypted tunnel.
3. Passwords, payment details, or form contents.
4. Message contents in encrypted messaging apps.
5. What you watch, specifically. They see a large stream from a video service. They don’t get a title.
The mental model that actually works: your ISP sees the envelope — who you wrote to, when, how thick it was — and never the letter.
Nana’s Take:
“The envelope thing again.” — It’s a good metaphor, Nana. “It’s a metaphor about paper, Ken, for a system with no paper in it.” Would you prefer ‘they see the shape of the parcel’? “No. I’ve decided I hate that more.”
Incognito Mode Does Absolutely Nothing Here
This is the most persistent misconception about private browsing, so it’s worth being blunt.
Incognito mode is a local feature. It stops your browser from saving history, cookies, and form data on that device after you close the window. That is the entire scope. Google’s own Chrome documentation states plainly that your activity may still be visible to your internet service provider.
Your traffic still leaves your device, still crosses your ISP’s network, and still carries the same destination information. Opening a private window changes nothing about what the wire sees.
We covered the broader set of things incognito does and doesn’t do in what incognito mode actually hides. The ISP point is simply the one people get wrong most often.
What Actually Reduces ISP Visibility
A VPN is the only meaningful consumer option. It encrypts your traffic before it reaches your ISP and routes it through the VPN provider’s server. Your ISP then sees a single encrypted connection to that server — not the domains behind it.
The honest catch: this doesn’t eliminate the visibility, it relocates it. The VPN provider now occupies the position your ISP had. You have swapped a company you pay for internet for a company you pay for privacy, and the question becomes whether that company’s logging policy is trustworthy. Our guide on whether you actually need a VPN covers how to evaluate that — and it is genuinely worth reading before picking one, because a bad VPN is worse than none.
Encrypted DNS helps partially. DNS-over-HTTPS hides your domain lookups from your ISP. Both Chrome and Firefox support it, and it’s a reasonable default. It’s partial rather than complete, because connection metadata can still reveal destinations.
HTTPS everywhere is already doing the heavy lifting. The reason your ISP can’t read your content is that essentially the whole web moved to HTTPS. You don’t need to do anything for this — but it’s worth knowing that’s what’s protecting you.
Nana’s Take:
“So a VPN doesn’t hide me, it just changes who is looking.” — Yes. That’s the part the advertisements skip. “Then the entire question is which company I’d rather be watched by.” Now you’re thinking about it correctly, which is unfortunately less comforting than not thinking about it.
TL;DR
Your ISP carries all your traffic, so they can see every domain each device in your home connects to, when, how often, and how much data moves — linked to your real identity. They cannot see contents: specific pages, search terms, passwords, or messages, because HTTPS encrypts them. Think envelope, not letter. Incognito mode does nothing about any of this; it only clears local browser history. A VPN is the only meaningful consumer fix, but it relocates the visibility to the VPN provider rather than removing it, so the provider’s logging policy matters enormously. Encrypted DNS helps partially and is a sensible default.
Hi. I’m Ken. I run Two Second Solutions, a one-man agency that somehow landed a fox spirit influencer as a client. I drink too much coffee, blog when I need to vent, and regularly update my résumé just in case she sets the office on fire again. I’m not crying — it’s just spell residue.
