Can My Employer See My Browsing If I Use a VPN? It Depends Whose

It depends whose VPN it is and whose computer you use. A personal VPN on your own phone or laptop hides the sites you visit from the office network: the network sees only an encrypted connection to a VPN server. On a work laptop, a personal VPN hides almost nothing, because monitoring software, a managed browser and device management read your activity on the laptop itself, before the VPN encrypts it. The company VPN works the other way round: it carries your traffic through your employer's servers, so your employer can log the name of every site it carries.

In every case your employer can usually tell that a VPN is in use. We tested both halves of that on 3 October 2026.

What the office network sees, with and without a VPN

We built a small office in Docker: a "laptop" container, a WireGuard VPN server container, and a packet capture on the laptop's network card, which is the view a company network has. The laptop opened https://www.reddit.com/ twice, once directly and once through the VPN.

Without the VPN, the capture showed the site by name twice:

--- DNS questions seen on eth0:
      1 A? www.reddit.com.
      1 AAAA? www.reddit.com.
port 443 packets with reddit: 1      (the server name in the TLS hello)

HTTPS hid the pages and their contents, but not the name of the site. With the VPN on, the same request left no trace of the site:

--- DNS questions seen on eth0:
0
--- packets containing the text reddit:
0
--- conversations:
     23 172.21.0.2 > 172.21.0.3.39590: UDP
     15 172.21.0.3 > 172.21.0.2.51820: UDP
--- first packet:
IP 172.21.0.3.39590 > 172.21.0.2.51820: UDP, length 148

So the network learns nothing about the sites, but it does see a VPN. Every packet went to one server on port 51820, WireGuard's usual port, and the first one was 148 bytes, the exact size of a WireGuard handshake. Firewalls use patterns like that, and the server's address, to label and block VPNs.

Then we captured on the laptop itself, on the tunnel interface before encryption. The DNS question for www.reddit.com and the server name were there again. Any software running on the laptop has that view, which is the whole problem with a work laptop.

What a VPN hides from your employer, by setup

Work apps are separate from all of this: Slack, Teams and Microsoft 365 log activity on their own servers, VPN or not. Using a personal VPN on company Wi-Fi may also break the network's acceptable use policy.

A personal VPN on a work laptop

A VPN only protects traffic after it leaves the laptop, as the capture on the tunnel interface above showed. Everything that reads activity on the laptop sees it first.

• • Monitoring software such as ActivTrak, Teramind or Hubstaff records the apps and websites you use from inside the laptop, and some take screenshots. A VPN changes nothing for it; see can ActivTrak detect a mouse jiggler for what one such agent collects.
• • A managed browser, such as Chrome or Edge with a company profile, can report browsing to IT and can block VPN extensions.
• • Device management, such as Intune or Jamf, lists installed apps. A VPN app shows up there, and many companies block personal VPN apps outright.
• • Security software on the laptop can see network connections as they are made, including the VPN connection itself.
• • The browser history stays on the laptop, VPN or not.

A personal VPN on a company laptop also tends to get noticed for another reason: it can break access to company systems, and IT sees the support ticket. What each work tool can see on a laptop is in can my employer see my screen.

The company VPN

The company VPN exists so your employer's rules apply wherever you work. While it is connected, traffic it carries passes through company servers, and the company can log:

• • The names of sites and servers you reach, because DNS and connection logs pass through them.
• • Full web addresses and page contents, only if the company also inspects HTTPS with its own certificate installed on your device.
• • When you connected, for how long, and from which public IP address. The IP gives an approximate location, often the city.

Some company VPNs send all traffic through the tunnel. Others use split tunneling, where only traffic to company systems goes through the VPN and the rest goes straight to the internet. On a split tunnel, your personal browsing never reaches company servers, though software on a work laptop still sees it. More on the network side is in can my employer see my browsing history.

Can my company track me on the VPN?

It can see where you connect from, not follow you. The VPN log records the public IP address of each connection, and IP addresses map to a city and an internet provider. That is how a company notices a login from another country. Exact location needs something else, such as location services on a managed phone.

How to check what your traffic goes through

Run these with the VPN on, then off, and compare.

# the public IP address websites see (and your employer's network sees)
curl https://ifconfig.me

# Mac: which network interface carries your traffic; utun usually means a VPN tunnel
route -n get default | grep interface

On Windows, in PowerShell:

# the public IP address websites see
Invoke-RestMethod https://ifconfig.me/ip

# default routes; a VPN adapter at the top usually carries your traffic
Get-NetRoute -DestinationPrefix 0.0.0.0/0 | Sort-Object RouteMetric | Select-Object InterfaceAlias, RouteMetric

If the public IP is your company's with the company VPN on, and your home internet provider's with it off, the VPN carries all traffic. If it stays your home IP with the company VPN on, the VPN is split tunneled. To find monitoring software on a laptop, see how to tell if you are being monitored at work.

The safe setup for private browsing

FAQ

Does a phone hotspot hide a work laptop's browsing?

Not if the laptop runs an always-on VPN, a cloud proxy or a monitoring agent. See can my employer see what I do on my hotspot.

Does incognito mode hide browsing on the company VPN?

No. Incognito keeps history off the device only; the VPN still carries the traffic. More in can my employer see my Incognito history.