"Just use a VPN" is common advice, but it's only one layer of a browsing security stack that actually has several independent pieces — each encrypting a different part of the picture. Understanding what each one covers (and what it doesn't) helps you close gaps a VPN alone leaves open.
Table of Contents
The Four Layers of Browsing Encryption
Secure browsing isn't one setting to flip — it's four separate layers, each protecting a different part of your connection:
- HTTPS — encrypts the content of the page you're loading, between your browser and the website itself
- Encrypted DNS — encrypts the lookup that translates a domain name into an IP address, before HTTPS even begins
- A VPN — encrypts your entire connection to the local network, hiding both the DNS lookup and the destination from anyone on that network
- Browser settings — control what your browser itself leaks through cookies, fingerprinting, and autofill data
Each layer covers a gap the others leave open. Missing one doesn't cancel out the others, but it does leave a specific hole.
HTTPS: Content in Transit
HTTPS encrypts the data exchanged between your browser and the website, which is why banking and login pages depend on it. But HTTPS has a well-known blind spot: it doesn't hide the fact that you visited a site, or when — only what you exchanged with it once connected. Anyone watching the network traffic (an ISP, a WiFi operator) can typically still see the domain name via the earlier DNS request and the connection's metadata, even though the page content itself stays private.
Encrypted DNS: Hiding What You Look Up
Before your browser can load a site over HTTPS, it needs to resolve the domain name into an IP address — a DNS lookup. Unencrypted DNS is sent in plain text by default, meaning your ISP or network operator can see every domain you look up even if the page content that follows is fully encrypted by HTTPS.
Encrypted DNS protocols (DNS-over-HTTPS or DNS-over-TLS) close this specific gap by encrypting the lookup itself. Many modern browsers and Android's system settings support turning this on independently of any VPN.
A VPN: Hiding It All From the Local Network
A VPN operates one level below both of the above: it encrypts the entire connection between your device and the VPN server, wrapping your DNS lookups and your HTTPS traffic together into a single tunnel. To the local network — a coffee shop router, a school firewall, an ISP — everything looks like undifferentiated encrypted traffic to one destination.
This is what CarrotVPN's WireGuard tunnel does: it doesn't replace HTTPS or encrypted DNS, it wraps a layer around both, so the local network can't see the domains you're resolving or correlate your DNS lookups with your destination traffic, even for sites that only support plain DNS.
Browser-Level Settings Worth Checking
None of the network-level encryption above stops your browser itself from leaking data through its own features:
- Third-party cookies — enable cross-site tracking regardless of how encrypted the connection is; most browsers let you block them
- Browser fingerprinting — sites can often identify your device from its exact screen size, fonts, and settings, independent of your IP address
- Autofill and saved form data — convenient, but worth reviewing on a shared or borrowed device
- Private/incognito windows — clear local history but do nothing about network-level visibility, which is a separate layer entirely
How These Layers Stack Together
In practice, a reasonably complete setup looks like this:
- HTTPS is largely automatic today — nearly all major sites use it, and browsers warn you when one doesn't
- Encrypted DNS can be turned on at the browser or device level as a baseline, independent of anything else
- A VPN adds the network-level layer, hiding activity from local networks and ISPs, and covering DNS even when a specific site or app doesn't support encrypted lookups itself
- Browser privacy settings handle the parts none of the network layers can touch — cookies, fingerprinting, and local data
Running a VPN without HTTPS won't protect page content from the destination server; encrypted DNS without a VPN still leaves your device's IP address and non-DNS traffic visible to the network. They're complementary, not redundant.
Worth Knowing
You don't need to configure all four layers manually every time. Turning on CarrotVPN covers the network-level pieces (DNS and traffic visibility) in one step, while modern browsers now handle HTTPS and often offer encrypted DNS as a toggle in settings.
Quick Checklist
- Confirm your browser shows the padlock/HTTPS indicator on sites you use regularly
- Turn on encrypted DNS (DNS-over-HTTPS) in your browser or Android's network settings
- Connect to CarrotVPN on networks you don't fully trust, to cover DNS and traffic visibility together
- Block third-party cookies and review autofill data periodically
- Remember that private browsing mode clears local history only — it isn't a network privacy tool
Cover the Network Layer in One Tap
CarrotVPN is free, runs on the fast WireGuard protocol, has no data cap, keeps no logs, and needs no account — just install and connect on Android.
Download CarrotVPN Free