What a VPN is
A virtual private network, or VPN, is a service that sends your internet traffic through an encrypted connection to a server run by the VPN provider, and from there out to the wider internet. Apps and websites then see the server’s address rather than the address your home or mobile provider assigned to you.
Originally, VPNs were mainly used by companies so that employees could reach office systems securely from elsewhere. Consumer VPN services adapted the same idea for the general public. It is a useful tool for some situations and a poor fit for others, and the marketing often blurs the two.
How it works
Normally, your device talks to a website through your internet provider (ISP). The ISP carries your traffic and can see which sites you connect to, even when the page content itself is encrypted.
With a VPN switched on:
- Your device creates an encrypted connection, often called a tunnel, to the VPN server.
- Your traffic goes through that tunnel. Anyone watching the local network, such as other users on a cafe’s Wi-Fi or your ISP, sees that you are connected to a VPN server but not the sites inside the tunnel.
- The VPN server forwards your requests to the destination and sends the replies back through the tunnel.
Different protocols handle the tunnel in different ways, with different balances of speed, compatibility and security. Most reputable apps choose sensible defaults, so you rarely need to select one yourself.
What changes, and what does not
Who can no longer see what
- Your local network and ISP can no longer easily read which sites you visit. They can still see that you use a VPN and roughly how much data you send.
- Websites see the VPN server’s address, not your home address, so a site that guesses your general location from your address will see a different place.
Who can still see what
- The VPN provider now sits in the position your ISP used to occupy. It can, in principle, see which sites you connect to and when, unless it is designed and operated not to keep that information. A provider’s promise of “no logs” is a claim about its own practices. Independent audits can add some assurance, but you are still placing trust in a company.
- Websites and apps still know who you are if you log in. Accounts, cookies and browser fingerprinting continue to identify you regardless of your address. The article on online tracking explains why.
- The destination still receives your data. A VPN does not protect what happens at the other end.
When a VPN is worth considering
- On untrusted networks. On shared Wi-Fi, a VPN adds a layer between you and others on the same network. Today most websites use encryption already, so the added protection is smaller than it once was, but it can still help, particularly with apps that do not encrypt well. Public Wi-Fi risks are covered in more detail in their own article.
- Reaching a workplace or home network. This is the original purpose, and a company-provided or self-hosted VPN remains a sound way to reach internal systems.
- Limiting what your ISP sees. If you prefer that your provider not see your browsing destinations, a VPN moves that visibility to the VPN company. Whether that is an improvement depends on whom you trust more.
- Using a different location. Some people use a VPN to appear in another region, for example when travelling. Services may restrict this in their terms of use, and results vary.
When it is less useful
- For anonymity. A VPN is not an anonymity tool. It changes who sees your address, but your accounts, devices and habits still identify you. The topic of anonymity is a separate subject from simple privacy tools.
- For protection from malware or scams. A VPN does not stop a malicious download or a phishing page. Some services bundle extra filtering, but that is a separate feature.
- On a trusted home network with encrypted sites. The benefit can be modest.
- When speed matters. Routing through another server adds distance and processing, so connections are often somewhat slower, though the difference varies widely.
Trade-offs to weigh
- Trust. You are choosing a company to see your traffic. Free services in particular need some way to pay for themselves, and that may involve data or advertising. Be cautious about unknown providers.
- Cost and complexity. Paid services charge subscriptions, and some websites block known VPN addresses, which can be an annoyance.
- Jurisdiction. The country where a provider operates can affect what it may be required to hand over to authorities.
- False confidence. Believing you are fully protected may lead to riskier behavior than before.
Choosing sensibly
If you decide a VPN suits your needs, look for a clear description of what the provider logs, a track record that can be checked, support for current protocols, and a simple way to cancel. Treat dramatic claims such as “military-grade” or “total anonymity” as marketing rather than information. For most people, a VPN is one optional tool alongside stronger basics: unique passwords, two-factor authentication and regular updates. Those habits cover more of the common risks than a VPN does on its own.