A simple picture of how a VPN works
A virtual private network, or VPN, creates an encrypted connection between your device and a server run by the VPN provider. Your internet traffic travels through that connection and then out onto the wider internet from the provider’s server.
Think of it as moving a trusted tunnel into the middle of your journey. People on the local network, such as others in a cafe or the owner of a hotel network, see that you are connected to a VPN but not the contents of what passes through it. Websites you visit see the VPN server’s address instead of your home or mobile connection.
That is the whole core idea. Almost every claim, good or bad, about VPNs follows from it.
What a VPN can genuinely help with
Shielding traffic on untrusted local networks. On a network you do not control, a VPN can hide your activity from other people on that network and from the network operator. This is the main reason people consider one with public Wi-Fi, though much web traffic is already encrypted today, so the added benefit is smaller than it once was.
Hiding your location from websites. Sites typically see the VPN server’s location rather than yours. This can reduce some forms of location-based tracking and change what regional content appears, although the terms of service of some streaming and other services may restrict this use.
Hiding browsing from your internet provider. Your provider can see that you use a VPN, but generally not the specific sites visited through it. The trade-off is covered below.
Connecting to a workplace or school. Organizations often run their own VPN so staff can reach internal systems securely from home. This is a different use from the consumer products advertised to the public, but it relies on the same technology.
What a VPN does not do
It does not make you anonymous. A VPN changes who sees your address. It does not remove other ways of identifying you. If you sign in to an account, the site knows who you are. Cookies, browser characteristics and the information you voluntarily share all continue to identify you. Understanding online anonymity in more detail helps set realistic expectations.
It does not protect you from scams or phishing. If you click a bad link or enter your password on a fake page, the encrypted tunnel simply delivers you to that page safely. Knowing how to recognize phishing emails matters regardless of whether a VPN is on.
It does not stop malware by itself. Downloading a harmful file through a VPN is still downloading a harmful file. Some providers bundle extra protection features, but those are separate from the VPN function, and quality varies.
It does not stop advertisers tracking you. Advertisers use logins, cookies and device information, none of which a VPN removes. The VPN can hide your address, but ad tracking relies on many other signals. Reviewing your privacy settings does more here.
It does not replace updates or strong passwords. A device with known flaws or a reused password remains exposed, with or without a tunnel. A VPN is an additional layer, not a foundation.
It does not guarantee privacy from the VPN company. This is the point most often overlooked, and it deserves its own section.
You are shifting trust, not removing it
When you use a VPN, the provider can potentially see the same things your internet provider or the local network could have seen: the sites you connect to and the timing of your activity. You are choosing to trust the VPN company instead of the network. That can be a sensible trade if the company is trustworthy, and a poor one if it is not.
Because anyone can sell a VPN service, quality varies widely. Free services in particular need scrutiny, since running servers costs money and the funding has to come from somewhere, which can mean advertising or the sale of data. When evaluating a provider, consider the following:
- Who runs it, and is the company clearly identified?
- What does its privacy policy say about records of your activity, in plain terms?
- Has it been independently reviewed, and does it publish the results? Be skeptical of any claims you cannot verify.
- Does it charge a clear price, and does it have a record of keeping its apps updated?
- Does it make exaggerated promises of “total anonymity” or “military-grade” security? Such language is a warning sign.
Review sites and rankings are sometimes funded by commissions from the services they recommend, so treat them with care.
When a VPN is a reasonable choice
A VPN may be worth considering if you often use public networks, travel, or want to keep your browsing away from a network operator or provider you do not fully trust. It may also be useful where your workplace or school provides one. For many people at home, with ordinary habits, other steps give more benefit for the effort: keeping software updates on, using unique passwords and two-step verification, and securing the home router, as described in our material on home Wi-Fi security.
On public networks, using your phone’s mobile data or a hotspot can be a simpler alternative, as discussed in our guide to public Wi-Fi.
Key takeaways
A VPN is a tool with a narrow job: encrypting the path between your device and the provider, and masking your address from the sites and networks along the way. It is useful in the right setting and unhelpful when asked to do more. Choose a provider carefully, keep your expectations modest, and treat it as one layer among several for keeping your devices secure.