VPN advertising promises a lot: total anonymity, protection from hackers, safety on any network. Some of that is true, some of it is exaggerated, and some of it is simply wrong. A VPN is a useful tool with a narrow job. It changes who can see your internet traffic and where that traffic appears to come from. It does not make you invisible, and it does not replace the basic security habits that stop most real attacks. This guide explains how a VPN works, what it genuinely protects, what it does not, and how to tell whether you need one at all.
How a VPN works
Normally your device sends traffic to your Wi-Fi network or mobile carrier, then on through your internet service provider (ISP) to the website or app you are using. Each of those parties can see some information about the connection, and the website sees your public IP address, which reveals your approximate location and your provider.
A VPN app creates an encrypted tunnel from your device to a server run by the VPN provider. Everything inside the tunnel is unreadable to the local network and your ISP. At the VPN server, your traffic leaves the tunnel and continues to its destination, so the website sees the VPN server's IP address instead of yours. As the US Federal Trade Commission (FTC) puts it, "a VPN app can make traffic from your phone to a website appear to come from the VPN's servers."
The crucial consequence is one people often miss. The FTC continues: a VPN "doesn't render you anonymous. It just shifts trust from those networks to the VPN app provider." The Electronic Frontier Foundation (EFF) makes the same point in its Surveillance Self-Defense guide: what your ISP could see is now visible to the VPN company instead. A VPN does not remove the middleman; it swaps one for another that you choose.
What a VPN genuinely does
- Hides your browsing from the local network and your ISP. Even on HTTPS sites, the network can normally see which domains you visit through DNS lookups and connection metadata. Inside a properly configured VPN tunnel, it sees only that you are connected to a VPN server.
- Hides your IP address from the sites you visit. Websites, game servers and peer-to-peer contacts see the VPN server's address, which hides your home location from them.
- Changes your apparent location. Connecting to a server in another country makes you look as though you are there, which is why people use VPNs to reach services that are restricted where they are.
- Helps get around network censorship. The EFF identifies circumventing network censorship as one of the main legitimate reasons to use a VPN, alongside reaching a workplace's internal network remotely.
What a VPN does not do
It does not make you anonymous
Websites and advertisers can still recognise you through cookies, logged-in accounts and browser fingerprinting, and your phone can still share GPS location with apps. The EFF says plainly: "A VPN is not a tool for anonymity." If you sign in to a social network through a VPN, the network knows exactly who you are.
It does not stop malware, phishing or scams
A VPN carries whatever you send and receive. A malicious download or a fake login page works just as well through an encrypted tunnel. Some VPN apps add optional ad or malware domain blocking, but that is a separate feature, not something the tunnel itself provides.
It does not protect weak accounts
If your password was exposed in a data breach, a criminal can log in from anywhere, VPN or not. Unique passwords, a password manager and two-step verification do far more for account security than any VPN.
It does not hide you from the VPN provider or the law
The provider can see your traffic metadata, and the EFF notes that VPN companies can receive legal demands for data just as ISPs can. A provider's logging policy and the jurisdiction it operates under therefore matter as much as its encryption.
Public Wi-Fi: how much a VPN really adds
Public Wi-Fi is the classic sales pitch, and the reality has changed. Most websites and apps now encrypt their own connections with HTTPS, which protects the content of what you send even on an open network. The FTC now says that "because of the widespread use of encryption, connecting through a public Wi-Fi network is usually safe," and the EFF lists public Wi-Fi as a reduced reason to use a VPN for the same reason.
That does not mean a VPN adds nothing on public Wi-Fi. It hides which sites you visit from whoever runs the hotspot, covers any app that still sends data unencrypted. But it is not the difference between safe and unsafe that marketing suggests. The FTC's own warning is that criminals also "create fake websites and encrypt them to make you think they're safe when they're not", and a VPN does nothing about that.
It is also worth knowing that VPNs have technical limits on hostile networks. A weakness catalogued in the US National Vulnerability Database describes how a network's DHCP server can push routes to a device so that VPN apps relying on routes "can be forced to leak traffic over the physical interface", letting an attacker on the same local network read traffic that was meant to be protected. Keeping your VPN app and operating system updated, and preferring mobile data for anything sensitive on a network you distrust, are sensible responses.
When a VPN is genuinely useful
- Networks you do not trust or control, such as hotels, cafés, airports and conference Wi-Fi, especially when you want to keep your browsing private from the operator.
- Keeping browsing history away from your ISP, if you trust your chosen VPN provider more than your ISP.
- Restrictive or censored networks, at work, school or in countries that block services. Check local law first; some countries restrict VPN use itself.
- Hiding your home IP address from peer-to-peer contacts, game servers or people you do not want to learn your rough location.
- Remote work, where an employer's VPN connects you to internal systems. That is a different product from a consumer privacy VPN and is set up by your employer.
Streaming is a special case. Services license content by region and generally treat VPN use as something to block. Netflix, for example, shows users an error that reads "You seem to be using a VPN or proxy" and asks them to turn it off. Whether a given VPN works with a given service changes constantly, so treat any streaming promise with caution and check the service's terms.
Common VPN myths
- "Strong encryption makes you unhackable." Modern VPN protocols do use strong, standard encryption, but it is the norm rather than a special feature, and it protects only the tunnel between you and the VPN server.
- "No-logs means nothing is ever recorded." A no-logs policy is a promise. Independent audits, published transparency reports and a history of how the company responded to legal requests are what give it weight.
- "A VPN is always on once installed." Apps can disconnect when networks change. A kill switch, which blocks traffic when the tunnel drops, prevents silent leaks.
- "Every VPN encrypts everything." Not so. Researchers who studied 283 Android VPN apps found that 18% used tunnelling protocols without encryption, and that roughly two thirds did not route DNS traffic through the tunnel at all.
How to choose and set up a VPN well
- Decide what problem you are solving. Privacy from your ISP, a hotel network, censorship and region access each point to different priorities.
- Check the protocol. The EFF recommends modern protocols such as WireGuard or OpenVPN and warns against outdated ones such as PPTP.
- Read the privacy policy and look for independent audits. Check what is logged, for how long, and who owns the company.
- Check app permissions. The FTC notes that a VPN app gets "permission to intercept all of your internet traffic", and advises reviewing what else an app asks for. A VPN has no obvious need for your contacts or messages.
- Turn on the kill switch and leak protection and keep the app updated.
- Keep the basics in place. Updates, a password manager, two-step verification and backups matter more than the VPN.
The bottom line
A VPN changes who can see your traffic and where you appear to be. That is genuinely valuable on untrusted networks, against ISP tracking and around censorship. It does not make you anonymous, stop malware or phishing, or secure your accounts, and because the provider sees what your ISP used to see, choosing a trustworthy provider is the whole game. If you decide you want one, our VPN comparison explains how we assess them.
