HTTPS encrypts the content of a page, but the domain name you visit stays visible to your network. Docognito works on a separate layer entirely, what the page looks like once it has loaded, not DNS lookups or the TLS handshake that expose the domain. IT can still tell which site you opened.
What HTTPS actually encrypts
HTTPS wraps the content of a page, the text, the request bodies, the responses, in encryption between your browser and the server. Anyone intercepting the connection between the two sees scrambled data, not the words on the page or what you typed into it. That is a real and significant protection, and it is why HTTPS became the default for the entire web rather than an optional extra, replacing the plain text HTTP that used to leave every request readable to anything watching the wire.
It was never designed to hide which site you connected to. That information travels through channels HTTPS does not cover, and it always has, since the padlock in the address bar has only ever meant that the content is encrypted, not that the connection itself is invisible.
What stays visible regardless
Before your browser can open an encrypted connection to a site, it has to look up that site's address, and the DNS lookup that does this typically travels in plain text to whichever DNS server your network is configured to use, often one your employer or internet provider controls. The TLS handshake that follows, the exchange that sets up the encryption itself, historically included the site's domain name in plain text too, in a field called Server Name Indication, and even where an encrypted variant of that field is supported, it depends on both ends of the connection choosing to use it, which is not yet the case everywhere.
A network operator watching either exchange, the DNS lookup or the handshake, can read the domain you are connecting to. They do not need to decrypt anything to do it, because the domain was never inside the encrypted part in the first place. On a corporate network, this is often not even passive observation: a company firewall or proxy frequently logs every domain a device connects to as a matter of routine, the same way it logs which printer a document was sent to.
The domain is visible even when everything on the page is encrypted
A company network, a school network or an internet provider can typically see that you connected to claude.ai or chatgpt.com, through DNS records or the TLS handshake, even though the content of every page you loaded stayed encrypted the whole time.
What people assume, what a network sees
| What people assume HTTPS hides | What a network operator can actually see |
|---|---|
| Which website you visited | The domain, typically visible through DNS and the TLS handshake |
| What you typed on the page | Hidden, this is genuinely encrypted content |
| How long you stayed on the site | Often visible, through connection timing and volume |
| The specific page or conversation | Hidden in most cases, this lives inside the encrypted body |
The first row is the one worth sitting with. HTTPS earns its reputation on the second row, hiding what you typed, and people often extend that reputation to the first row by mistake, since the padlock icon looks the same either way.
Where a page disguise sits in this picture
None of the above has anything to do with what your screen displays. Docognito changes the visible page, redrawn as a document editor, the the browser tab title and the the tab icon for a person looking at your monitor. It has no access to DNS traffic or the TLS handshake, and it makes no claim to. anything a workplace network, proxy, DNS log or monitoring agent can see sits entirely outside what a browser extension is able to reach, since a browser extension operates inside the page, well after the DNS lookup and the handshake that expose the domain have already happened.
What genuinely reduces this visibility
A VPN routes your DNS lookups and your encrypted traffic through its own server rather than your local network's, which moves the point of visibility from your network operator to the VPN provider instead of removing it outright. Encrypted DNS, where supported by both your browser and your network, closes the plain text lookup specifically, without touching the TLS handshake on its own. Neither approach is available inside a browser extension, and neither is something Docognito attempts, since both sit at the network layer rather than the page layer a disguise operates on.
A more direct option, where it is available, is simply asking what a network already discloses. Some organisations publish which categories of traffic they log and which they do not, as part of an acceptable use policy or a data handling notice, and that document is a far more reliable answer for your specific network than any general rule about DNS or TLS could be on its own.
Three different layers, three different fixes
Treat HTTPS as protecting what you typed, not which site you opened, since the domain typically remains visible through DNS and the TLS handshake on any network you do not control. If domain level visibility itself is the concern, a VPN or encrypted DNS addresses that layer. A page disguise addresses a different one entirely.