That little padlock icon in your browser doesn’t mean what most people think it means. HTTPS encrypts the content of what you’re doing on a website — so if you search something on Google, the actual words you typed stay hidden. But the fact that you visited Google? The domain you connected to? That’s completely visible to whoever runs the network you’re on.
Schools and employers can log every domain their network touches. So they can see you went to reddit.com at 2pm, or that you spent forty minutes on a gaming site during class. What they generally can’t see — thanks to HTTPS encryption — is the specific page or the exact search terms you entered. Your personal search queries typically stay private, but the sites you visited do not.
Network administrators have tools that log this stuff automatically. It doesn’t require anyone actively watching you — the records just build up. And if something ever gets flagged, those logs are sitting right there. This applies anywhere you’re using someone else’s network: school Wi-Fi, a work laptop connected to the office internet, even a public library.
One important exception: if you’re using a school-issued device, your school may have installed a security certificate that allows them to inspect HTTPS traffic more deeply — meaning even your search terms or specific pages could be visible on that device, regardless of which network you’re on. Switching to mobile data won’t fully protect you if the device itself is managed by your school.
A VPN can help on unmanaged devices. When you connect to one, it wraps your traffic so the network can only see that you’re using a VPN — not which sites you’re visiting. Some VPNs even disguise their traffic to look like regular HTTPS so it’s harder to detect. That said, many schools and workplaces block VPNs entirely, and using one against a network’s rules could get you in trouble depending on where you are. If you do use a VPN, stick to paid, reputable services — free VPNs sometimes collect and sell the very data you’re trying to protect.
The simple version: if you’re on their network, assume they can see the sites you visit. If you’re on a school-issued device, assume the monitoring may go even deeper. Save anything you’d rather keep private for your own device on your own data connection.