Where Your Browsing History Actually Lives
A VPN does not hide your browsing history in the sense most people mean, because “browsing history” is not one thing kept in one place. It exists simultaneously as a list on your device, a copy in whatever account your browser signs into, a set of caches on your machine and your router, a record at whichever resolver answered your lookups, and a log at every site you actually visited. A tunnel changes who can observe one segment of the path. Everything else on that list is untouched.
The list on your own device
The most literal browsing history is a file your browser maintains locally: pages visited, times, search terms typed into the address bar, autofill entries, downloads, and a cache of page content. It is written by the browser because you asked the browser to remember things for you.
Nothing about a tunnel interacts with it. Traffic left your device encrypted and the history was recorded before that happened. Anyone with access to the unlocked device can read it, and that includes anyone who administers the device.
If your reason for asking this question is somebody else who uses the same computer or manages it, the network layer is the wrong layer entirely. The answer lives in accounts, profiles, device passcodes, and who holds administrative rights.
Signing in copies the list to a server
This is the part that surprises people. When a browser is signed into an account with synchronisation enabled, history, bookmarks, open tabs, and often saved passwords are uploaded so they appear on your other devices. That upload happened over the tunnel, which means it was private from the network you were on — and it still ended up on a company’s servers, attached to your name.
The same applies to a signed-in search account, a phone keyboard that syncs, and any browser feature that offers to continue what you were doing on another device. These are useful features and they are also a second copy of the history you were asking about.
The caches you did not know you had
Two more copies sit closer to the wire.
Your operating system keeps a short-lived cache of recent name lookups so it does not repeat them. That cache is on your machine and is readable there; it is also why a tunnel connecting or dropping can leave you talking to the wrong address until it expires, as covered in why flushing the DNS cache fixes odd VPN behavior.
Your home router may keep more than you expect. Many consumer routers log recent lookups or connection attempts, some offer a browsing-activity feature aimed at parents, and some run their own resolver. A tunnel does reduce what the router can see, because destinations move inside the encrypted flow — but only for the device running the tunnel, and only while it is up.
The resolver’s view
Every hostname you visit was resolved by somebody. Unless you changed it, that somebody was chosen for you by the network you joined, which is the argument in who runs your DNS resolver.
A tunnel normally moves resolution to the provider’s own resolvers, so the previous resolver stops seeing your lookups and the tunnel operator starts. The list has not been deleted; it has changed hands. And if the client is misconfigured or falls back under pressure, lookups can go out the original path while everything else goes through the tunnel — which is the most common way people discover their “hidden” history was never hidden.
The destination’s record is the most complete one
Every site you visited kept its own log of the request, and if you were signed in, that log is attached to your account rather than to an address. A tunnel changes which address appears in that log. It does not change the page you requested, the time you requested it, the account you were signed in as, or the cookie that links this visit to the previous one.
For anybody logged into the major services, this is the copy of browsing history that is by far the richest, and it is the one a VPN has the least effect on. Changing the address a site sees while remaining signed in changes almost nothing about what that site knows.
What the tunnel actually covers
Precisely one segment: between your device and the exit server, observation by parties on that path is reduced to a single encrypted flow. The network you are sitting on loses its per-destination view — with the important limits set out in what your internet provider still sees while the tunnel is up — and the sites you reach see the exit address instead of yours.
That is the entirety of the change. It is worth having on a network you do not control. It is not deletion, and nothing in it reaches a single one of the stored copies described above.
What private browsing changes
A private or incognito window stops the browser writing to the local history and drops cookies at the end of the session. That is genuinely useful for the device-sharing case, and it is the one it was designed for.
It does not affect the resolver, the router, the network, or the destination site. Running private browsing and a tunnel together covers the local list and the network path respectively, which is two of the seven or so places history lives — and leaves the synced account and the destination’s own logs exactly where they were.
Getting the question to something answerable
“Can I hide my browsing history” has no single answer, but it becomes tractable once you name the observer. From someone sharing your device: device accounts and private browsing. From your household network: the tunnel helps, on that device. From your access network: the tunnel helps, within the limits above. From the resolver: it changes hands. From the sites themselves, while signed in: not meaningfully at all. Answer for one observer at a time and the contradictions in the advice you have read mostly dissolve.