What is a VPN?
A VPN — virtual private network — is an encrypted connection between your device and a server somewhere else. Everything you send travels inside it, so the networks in between can see that you are connected but not what you are doing, and the sites you visit see the server’s address instead of yours.
What actually changes when you connect
Without a VPN, your traffic goes from your device to your internet provider, then out across the internet to whatever you are visiting. Your provider sees every destination. The site sees your real address, which identifies your provider and your rough location.
With one, your device first opens an encrypted connection to a VPN server. Everything then travels inside that connection. Your provider still sees that you are sending data, and can see that it is going to a VPN server — but not where it goes afterwards. The site sees the server's address.
That is the entire mechanism. Two changes, both worth understanding precisely:
| Who | Sees without a VPN | Sees with one |
|---|---|---|
| Your internet provider | Every domain you visit | That you are using a VPN, and how much data |
| The café's Wi-Fi | Every domain you visit | The same — encrypted traffic to one server |
| The site you visit | Your address, so your provider and region | The VPN server's address |
| Your VPN provider | Nothing — they are not involved | Everything your provider used to see |
The last row is the one that gets left out of most explanations, and it is the important one. A VPN does not remove the party who can see your browsing. It moves that party, from your internet provider to your VPN provider. Whether that is an improvement depends entirely on which of the two you would rather trust — which is why choosing a provider is the decision that matters, not which encryption they use.
What it does not do
Four things people reasonably expect and do not get:
- It does not make you anonymous. Your browser still has a fingerprint made of your screen size, fonts, GPU and timezone, none of which changes when you connect. You can see yours here. Sites you log into know exactly who you are.
- It does not stop malware. Encrypting a download does not inspect it. Some providers block known-malicious domains as a separate feature, which is useful and is not what the tunnel is doing.
- It does not encrypt anything that was already encrypted. Nearly every site is HTTPS, so the content of your traffic was already protected from the café Wi-Fi. What the VPN adds there is hiding which sites — real, and narrower than "protects you on public Wi-Fi" implies.
- It does not change your browser's idea of where you are. Browser geolocation comes from GPS and nearby Wi-Fi, not your address, so a site asking for your location gets the real answer.
When it is genuinely the right tool
Stated as specifically as possible, because "stay safe online" is not a reason:
- You do not want your internet provider building a list of the sites you visit. This is the strongest everyday case, and it is a privacy argument rather than a security one.
- You are on a network you do not control — hotel, campus, employer — and would rather it saw one encrypted connection than your browsing.
- Something is blocked where you are, whether by a network operator or nationally. This is the case where the protocol matters, because a filtered network blocks the recognisable ones.
- You need to appear to be somewhere else for a service that varies by region.
If none of those describe you, a VPN is not a security failing you need to correct. Two-factor authentication on your accounts and a password manager will do more for you than any tunnel, and both are free.
How to tell whether one is working
Not by whether the app says "connected". The useful check is a comparison: run the same tests before and after, and see what changes.
- Check your address disconnected, then connected. It should change, and the location should follow it.
- Run the DNS leak test both ways. Your device can send DNS queries outside the tunnel even while it is up, which leaks every domain you visit to your provider despite everything.
- Run the WebRTC test. Browsers can reveal your real address through an API that has nothing to do with your proxy settings.
Those three take about a minute and are the difference between believing a VPN is working and knowing it.
Related questions
Does a VPN make me anonymous?
No. It changes which address websites see and hides your traffic from the networks it crosses. It does not touch the things that identify you once you are on a site: your browser fingerprint, your cookies, and the fact that you signed in. Someone logged into their own account is identified regardless of where the connection appears to come from.
Is using a VPN legal?
In most countries, yes, and it is ordinary business technology. A handful of countries restrict or license them — China, Russia, Iran, Turkey and the UAE all regulate VPN use in different ways, and the rules are about specific uses rather than the technology itself. The UAE, for example, penalises using one to commit an offence rather than using one at all. If you are somewhere with restrictions, check the local position rather than a general article.
Do I need a VPN at home?
Less than the marketing suggests. At home your traffic is already encrypted by HTTPS on essentially every site, so the specific thing a VPN adds is hiding which sites you visit from your internet provider — who can otherwise see and, in several countries, sell that list. Whether that matters is a judgement about your provider and your jurisdiction, not a security emergency.
Will a VPN slow my connection down?
Somewhat, always. Your traffic travels further and is encrypted and decrypted on the way, so there is a floor set by the distance to the server. On a modern protocol and a nearby server the difference is often small enough not to notice; on a server on another continent it is unavoidable and has nothing to do with the provider’s quality.
Are free VPNs safe?
Running servers costs money, so a free service is being paid for somehow — and historically that has often meant selling browsing data, injecting advertising, or in several documented cases using subscribers’ connections as exit nodes for other people’s traffic. A free tier from a company with a paid product is a different proposition from a service that is only free, because the business model is visible.