Are packets "double encrypted" when I visit a HTTPS page while connected via a VPN?

  • So, does that mean that the traffic from my device is encrypted to the VPN provider servers?
    – cyzczy
    Dec 1, 2016 at 18:59
  • With all other answers, now also imagine if your https traffic was passed through Tor then you would have 4 encrypted layers i.e. 2 times the encryption when https is sent over VPN. But note that all other layers of encryption are last till the exit node.
    – defalt
    Dec 2, 2016 at 6:09

2 Answers 2


Yes, from your computer to the VPN exit node the communication will be "double encrypted". Then, from the VPN exit node to the destination it will only be encrypted by HTTPS.

So why is this important - isn't one layer of encryption in HTTPS enough on its own? It is impotant to remember that HTTPS does not encrypt everything - the domains you visit are still in plain text by necessity, and so is your DNS traffic. A good VPN takes care of that by encrypting everything. As a result the already encrypted part of the HTTPS traffic gets encrypted again.

(And if you would send an encrypted file over HTTPS through a VPN it would be tripple encrypted.)


Let's walk down the chain of VPN encryption, then HTTPS encryption:

The Process

From You to the VPN for the Handshake

There is an encryption that happens here, hiding EVERYTHING you send to the VPN inside the VPN encryption. Nothing about what you are doing is visible except at the VPN level where they decrypt, and forward your traffic to the service you want.

From the VPN to the Service

Again, here the VPN will talk to a server over an encrypted channel. This isn't double encryption, just another encryption from the service. Now the VPN will encrypt it and send it BACK to you. At this point the VPN (might) also has a set of those credentials unless the cert was pinned.

From the VPN to You

Now you've recieved an encrypted set of credentials to decrypt on your end to use.

From you, back to the VPN, and from the VPN to the Service

Now you send an encrypted package BACK to the VPN, which has a copy of the credentials(if they wanted) and they forward it back to the service. Then you get a response, rinse, repeat...

Wait so what does this mean?

It means that there are TWO possible scenarios:

  1. The VPN is decrypting your traffic at their end, then inspecting, then encrypting to send to the service using the credentials

    • It may still be double encrypted in transit to them, but they can decrypt it and encrypt at will
    • At this point, there is only a single encryption, and it's been inspected(yes, VPNs have been known to do this, often only for Meta Data though)
  2. The VPN DIDN'T store a copy of your credentials, so it receives an encrypted packet that it decrypts to an encrypted packet, and forwards. This is double encryption(encrypt inception*) to the VPN, but only single encryption to the service

So at any one point what is the weakest level of encryption you have(the baseline for encryption)? One, from the VPN to the service. It has however been encrypted twice on that route. Since this is the weakest link, if someone discovers it you are still only singularly encrypted after the VPN.

Does it mean this model is worthless?

OH GOD NO! KEEP USING IT! If you have a reason to use the VPN, then keep using it. It will make it MUCH harder for people to try and decrypt between you and the VPN, and if the VPN is smart, will be REALLY hard to find the exit point(since each session would be a new/different node possibly). So yes, DO THIS IF YOU NEED TO!

*: Try to say that five times fast

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .