How to see what apps are using the internet on Windows
Find out what apps are using the internet on your PC — the built-in data usage list, a live view in Resource Monitor, and how to block one outright.
Written by the team building DoC Toolbox, every PDF tool you need, running on your own PC.
Software makes claims about what it sends. You do not have to take any of them on trust — Windows can tell you what apps are using the internet, and the check takes about two minutes with tools already on the machine.
This is worth knowing generally, and it is worth knowing specifically before you hand a folder of contracts to something that promises to keep them local.
The quickest check: 30 days of history
The fastest way to see what apps are using the internet is a list Windows already keeps and most people never look at.
Settings → Network & internet → Advanced network settings → Data usage. On Windows 10 it is Settings → Network & Internet → Data usage → View usage per app.
You get every app that has sent or received anything in the last 30 days, sorted by volume. It will not tell you where the data went, but it answers the blunt question well: an app that has moved zero bytes in a month has not been uploading your documents.
The live view: Resource Monitor
For what apps are using the internet right now, including the addresses they are talking to:
Press Win + R and run resmon
Resource Monitor ships with Windows. No download.
Open the Network tab
"Processes with Network Activity" lists everything currently sending or receiving, with live byte counts.
Expand TCP Connections
This is the useful part: process name against remote address. You can watch exactly who an app is talking to.
Now use the app
Run the operation you care about — convert a file, save a document — and watch whether its byte counters move.
The last step is the one people skip. An idle app sends nothing; that proves nothing. Watch it while it is doing the work you are asking about.
The decisive test: take the network away
Everything above is observation, and observation can miss things. Disconnecting cannot.
Turn on airplane mode or unplug the cable, then do the job. If it completes, the work happened on your machine — there is no other possibility. If it hangs or errors, whatever it needed was not on your PC.
Block an app from the network entirely
If you want a guarantee rather than a measurement, take the access away and leave it that way.
Windows Defender Firewall with Advanced Security → Outbound Rules → New Rule → Program → point it at the app's executable → Block the connection.
Two honest caveats. Store apps can be awkward to target this way, because the executable path is not always where you expect. And blocking outbound traffic also blocks update checks, which for most software is a bad trade — you are choosing a permanent privacy guarantee over security fixes.
What a clean result does and does not prove
Be precise about this, because it is where confident conclusions go wrong.
It does prove the app did not transmit while you watched. With the disconnect test, it proves the operation completed with no network at all, which is as strong as this gets.
It does not prove the app will never send anything. Software could queue data and send it later, or behave differently on a different file. And a single quiet afternoon is not a policy.
This is why the disconnect test is worth more than the monitoring: it does not depend on catching the app in the act.
Why we suggest doing this to our own app
Every private-by-design claim is unverifiable marketing until someone checks it. Ours is that DoC Toolbox processes documents on your PC — conversion, OCR, signing, compression, all of it — and does not upload them.
The way to believe that is not this paragraph. It is airplane mode, a real file and two minutes. The Microsoft Store handles installation, updates and the one-time Pro purchase, so those do need a connection; the document work does not, and the test above will show you exactly that.
Once you can see every connection a program opens, it is worth pointing the same tools at the software you trust. That is the test behind why our apps make no network requests — a claim that means nothing unless you can check it.
Common questions
How do I see what apps are using the internet in the background?
The Data usage list in Settings covers the last 30 days including background activity, which is where most of it happens. Resource Monitor shows only what is live at the moment you look.
Does Task Manager show network usage per app?
It has a Network column on the Processes tab showing current throughput, which is enough to spot an active transfer but not to see where it is going. Resource Monitor is the better tool for that.
Why does an app show data usage when I never opened it?
Update checks, telemetry, licence validation and push notifications all run without the app being open. Small, regular amounts are usually one of those; they are not the same thing as your files being uploaded.
Can I tell what data was sent, not just how much?
Not with the built-in tools — they report volume and destination, not contents. Reading the contents means intercepting encrypted traffic, which is a substantial exercise and not something to attempt casually.
Is blocking an app in the firewall safe?
For the app, yes — it will simply fail to reach the network. The risk is that you also block its updates. Reserve it for software you have deliberately decided should never connect.
Does airplane mode affect files already open?
No. Files open from your own disk are unaffected. Anything streaming from a network location or a synced cloud folder will stop, which is itself a useful signal about where a file actually lives.
What if an app needs the internet for something legitimate?
Most do — updates especially. The question worth asking is narrower than "does it connect at all": it is whether your documents are part of what it sends. The disconnect test answers that one specifically, and there is a fuller version of this argument in choosing an offline PDF editor.