A VPN, short for virtual private network, sends your internet traffic through an encrypted connection to a server run by the VPN provider. That changes who can see what you do online and where your connection appears to come from. It does not make you anonymous, and it does not fix every privacy problem. This guide explains what a VPN is, how it works, what it hides, what it leaves exposed, and when you can skip it.
What a VPN is
Normally, when you open a website, your request goes through your internet provider to the site. The site sees the address your connection uses, and your internet provider can see which sites you contact.
A VPN adds a middle step. Your device first connects to a server operated by the VPN provider, and that connection is encrypted. Your traffic then travels from that server to the website. The site sees the address of the VPN server instead of your own, and your internet provider sees an encrypted connection to the VPN server instead of a list of the sites you visit.
A VPN does not remove the need to trust someone. It moves some of that trust from your internet provider, and from the network you happen to be on, to the VPN provider. If you are still comparing services, our guide on how to choose a VPN covers what to look for.
How the encrypted tunnel works
People often describe a VPN connection as a tunnel. In practice it works like this.
- You start the app. It contacts the provider's server, and the two sides agree on secret keys that only they know.
- Your traffic is wrapped. Each piece of data leaving your device is encrypted and placed inside another package addressed to the VPN server. Anyone watching the connection sees only scrambled data.
- The server unwraps it. The VPN server decrypts the data and forwards your request to the website.
- The reply returns the same way. The website answers the VPN server, which encrypts the reply and sends it back through the tunnel.
The tunnel only covers the stretch between your device and the VPN server. After that, your traffic continues to the website like any other. If the site uses HTTPS, which most sites now do, that last stretch is still encrypted by the site itself. If it does not, that part of the journey is not protected by the VPN.
What a VPN hides
- The destinations of your traffic from your internet provider. It can see that you use a VPN server and roughly how much data moves, but not which sites you visit inside the tunnel.
- Your real network address from the sites you visit. They see the address of the VPN server, which is often shared with many other customers.
- Your traffic from others on the same local network. On a shared connection, they cannot easily read what passes through the tunnel.
- Your approximate location, as sites infer it from your address. A VPN changes that guess.
These are real benefits, and they are narrower than marketing sometimes suggests.
What a VPN does not hide
Many privacy problems have nothing to do with your network address, so a VPN does not touch them.
- Accounts. If you sign in to a site or app, it knows who you are, whichever address you connect from.
- Cookies. These small files let a site recognise your browser. They keep working through a VPN.
- Browser fingerprinting. Sites can combine details such as browser version, screen size, fonts and settings into a fairly distinctive profile. A VPN does not change those details.
- What you share. If you give a site your name, email address or payment details, it has them. A VPN protects the connection, not the information you hand over.
- Malware and phishing. A VPN does not stop you from opening a harmful file or typing a password into a fake page.
Our guide on VPN privacy myths and limits goes further into these gaps and into claims you should treat with caution.
Your internet provider versus your VPN provider
The clearest way to understand a VPN is to compare who can see what with and without one. This is a simplified summary, and real services differ in their policies and design.
| Who | Without a VPN | With a VPN |
|---|---|---|
| Your internet provider | Can see the sites and services you connect to, and when | Sees a connection to the VPN server, not the sites inside the tunnel |
| The VPN provider | Sees nothing, because you are not using it | Can technically see where you connect, since it forwards your traffic |
| The website you visit | Sees your own network address | Sees the VPN server address instead |
| Others on the same wifi | May see which sites you contact | See only an encrypted connection to the VPN server |
| Accounts, cookies, fingerprinting | Work as normal | Still work as normal |
The VPN provider row is the one people most often overlook. Because your traffic passes through the provider, it is in a position to see your destinations. A trustworthy provider limits what it keeps and says so clearly in its policy. You still have to decide whether you trust the company, since a VPN is a choice about who sees your traffic, not a way of letting nobody see it.
Public wifi
Public wifi in cafes, hotels, airports and trains is the classic reason to use a VPN. The concern is real, but smaller than it used to be.
On an open network, other people may be able to observe unencrypted traffic, and a fake or badly run network could try to interfere with your connection. A VPN encrypts everything between your device and its server, so the wifi operator and other users cannot read it.
However, most sites and apps now use HTTPS, which already protects the content of what you send and receive. So a VPN on public wifi is an extra layer, not the only thing between you and trouble. These habits help on any shared network.
- Check that the network name matches what the venue tells you.
- Look for the HTTPS indicator before entering a password.
- Keep your device and apps up to date.
- Postpone sensitive tasks on a network you do not trust, if you can.
Working remotely
The word VPN covers two different uses. The first is the consumer service described here, which sits between you and the open internet. The second is a business VPN, where your employer runs a server that gives you access to internal systems as if you were in the office.
If your employer asks you to use a VPN, it is almost always the second kind. Use the software they supply and ask your IT team if something fails. A consumer VPN will not give you access to private company systems.
A consumer VPN can still help remote work, for example on a hotel or coworking network. Check your employer's policy first, because some companies do not allow other VPN software to run alongside theirs.
Changing your location
Because a VPN connects you through a server in a chosen place, websites see an address in that place. People use this to see how a site looks in another country, to reach services from home while travelling, or to check an offer as it appears elsewhere.
There are limits, and you should not rely on any of them. Some services detect VPN addresses and block them or show limited content. Others compare your address with your account country or payment details. A location change may work one day and fail the next, and no provider can promise access to a particular service. Our guide on VPN on phone, router and streaming devices covers practical points for that situation.
Laws and service terms also differ by country, and using a VPN to get around a restriction can break a service's rules or, in some places, local law. This is not legal advice, so check the rules where you live and where you travel.
Protocols in plain language
A protocol is the set of rules your device and the VPN server use to build the tunnel and encrypt the data. Most apps let you choose one. The names come up often, so here is what they mean in practice.
- WireGuard. A newer protocol designed to be small and simple. It tends to connect quickly and use less battery on phones. It is a good default if your app offers it.
- OpenVPN. An older, widely trusted protocol that has been used for many years. It is flexible and can run over different kinds of connections, which can help on restrictive networks. It is often a little slower than newer options.
- IKEv2. A protocol that reconnects quickly when your connection changes, for example when your phone moves from wifi to mobile data. That makes it popular on mobile devices.
If you are unsure, leave the app on its automatic setting. If you have trouble with speed, stability or a network that blocks VPN traffic, try another protocol. Be wary of any provider that relies on a secret protocol with no public description, because well known protocols have been examined by many independent people.
Speed impact
A VPN adds extra work, so it can make your connection somewhat slower. Several things contribute.
- Distance. Your traffic takes a detour through the VPN server. The farther away it is, the more delay you notice in calls and games.
- Encryption. Encrypting data takes processing power. Older phones and routers can slow down.
- Server load. A busy server can be slower than a quiet one.
For everyday browsing, many people notice little difference. For large downloads, live video or games, the effect can be clearer. If a VPN feels slow, try a closer server, switch protocol, or test at a different time of day. Compare your speed with the VPN on and off to see what it really costs. Do not expect a VPN to make your connection faster.
When you do not need one
A VPN is a tool for specific situations, not a requirement for being online. You may not need one if the following describes you.
- You mostly use your own home network and are comfortable with your internet provider seeing the sites you visit.
- Your main worry is tracking by websites and advertisers, which browser settings, tracker blocking and careful account habits handle better.
- You want protection from malware, which needs updates and careful behaviour more than a tunnel.
- You want to be anonymous. A VPN is not designed for that.
- Your employer already provides a VPN for work.
A subscription you rarely use is also a cost. Before you commit, read our guide on VPN prices and renewals, because the first price you see is often not the one you pay later.
Short checklist before you use a VPN
- Decide what you want it for, such as public wifi, privacy from your internet provider or a different location.
- Remember that the VPN provider can see your traffic, and read its privacy policy.
- Keep using HTTPS sites and keep your software up to date.
- Do not expect a VPN to remove cookies, stop account tracking or change your fingerprint.
- Start with the automatic protocol, and try WireGuard if you want speed.
- If your employer provides a VPN, use that one for work.
- Do not rely on a location change to reach any particular service, and check local rules and service terms.
Key takeaways
- A VPN encrypts the connection between your device and the provider's server, and moves your trust from your internet provider to the VPN provider.
- Websites see the VPN server's address instead of yours, but accounts, cookies and fingerprinting still identify you.
- The tunnel does not protect traffic after the VPN server unless the website uses HTTPS.
- Public wifi is a reasonable use case, though HTTPS already covers much of the risk.
- A workplace VPN and a consumer VPN are different tools.
- Location changes are unreliable, and laws and service terms differ by country.
- WireGuard, OpenVPN and IKEv2 are the common protocols, and the automatic setting is usually fine.
- Expect some speed loss, and skip the VPN if you have no clear reason to use one.
